Skip to content

Conversation

modscleo4
Copy link

Linux 5.15.2 updated security.h security_binder_* functions (like security_binder_transfer_binder(), so it uses struct cred* instead of struct task_struct*)

Linux 5.15.2 updated security.h  security_binder_* functions (like security_binder_transfer_binder(), so it uses struct cred* instead of struct task_struct*)
@Fijxu
Copy link

Fijxu commented Nov 16, 2021

Works good, tested in a clean install

image

@jiyeyuran
Copy link

Works good

@choff choff self-requested a review November 18, 2021 20:22
@choff
Copy link
Owner

choff commented Nov 18, 2021

Thanks a lot for your PR...! I didn't even see it at first because my notifications were not correctly set up :-( ... I will have a look at it this weekend.

@sickcodes
Copy link

@modscleo4 great PR!

I think Linux 5.10.80-1-lts may also affected if you want to change the LINUX_VERSION_CODE range somehow, or would it need something else?

make -C /lib/modules/5.10.80-1-lts/build V=0 M=$PWD
make[1]: Entering directory '/usr/lib/modules/5.10.80-1-lts/build'
  CC [M]  /tmp/anbox-modules-dkms/src/anbox-modules/binder/deps.o
  CC [M]  /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.o
  CC [M]  /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder_alloc.o
  CC [M]  /tmp/anbox-modules-dkms/src/anbox-modules/binder/binderfs.o
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c: In function ‘binder_translate_binder’:
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2441:49: error: passing argument 1 of ‘security_binder_transfer_binder’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2441 |         if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
      |                                             ~~~~^~~~~
      |                                                 |
      |                                                 struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:260:56: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  260 | int security_binder_transfer_binder(const struct cred *from,
      |                                     ~~~~~~~~~~~~~~~~~~~^~~~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2441:67: error: passing argument 2 of ‘security_binder_transfer_binder’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2441 |         if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
      |                                                        ~~~~~~~~~~~^~~~~
      |                                                                   |
      |                                                                   struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:261:56: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  261 |                                     const struct cred *to);
      |                                     ~~~~~~~~~~~~~~~~~~~^~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c: In function ‘binder_translate_handle’:
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2491:49: error: passing argument 1 of ‘security_binder_transfer_binder’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2491 |         if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
      |                                             ~~~~^~~~~
      |                                                 |
      |                                                 struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:260:56: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  260 | int security_binder_transfer_binder(const struct cred *from,
      |                                     ~~~~~~~~~~~~~~~~~~~^~~~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2491:67: error: passing argument 2 of ‘security_binder_transfer_binder’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2491 |         if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
      |                                                        ~~~~~~~~~~~^~~~~
      |                                                                   |
      |                                                                   struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:261:56: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  261 |                                     const struct cred *to);
      |                                     ~~~~~~~~~~~~~~~~~~~^~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c: In function ‘binder_translate_fd’:
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2583:49: error: passing argument 1 of ‘security_binder_transfer_file’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2583 |         ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
      |                                             ~~~~^~~~~
      |                                                 |
      |                                                 struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:262:54: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  262 | int security_binder_transfer_file(const struct cred *from,
      |                                   ~~~~~~~~~~~~~~~~~~~^~~~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2583:67: error: passing argument 2 of ‘security_binder_transfer_file’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2583 |         ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
      |                                                        ~~~~~~~~~~~^~~~~
      |                                                                   |
      |                                                                   struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:263:54: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  263 |                                   const struct cred *to, struct file *file);
      |                                   ~~~~~~~~~~~~~~~~~~~^~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c: In function ‘binder_transaction’:
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2986:53: error: passing argument 1 of ‘security_binder_transaction’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2986 |                 if (security_binder_transaction(proc->tsk,
      |                                                 ~~~~^~~~~
      |                                                     |
      |                                                     struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:258:52: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  258 | int security_binder_transaction(const struct cred *from,
      |                                 ~~~~~~~~~~~~~~~~~~~^~~~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:2987:60: error: passing argument 2 of ‘security_binder_transaction’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 2987 |                                                 target_proc->tsk) < 0) {
      |                                                 ~~~~~~~~~~~^~~~~
      |                                                            |
      |                                                            struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:259:52: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  259 |                                 const struct cred *to);
      |                                 ~~~~~~~~~~~~~~~~~~~^~
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c: In function ‘binder_ioctl_set_ctx_mgr’:
/tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:4933:51: error: passing argument 1 of ‘security_binder_set_context_mgr’ from incompatible pointer type [-Werror=incompatible-pointer-types]
 4933 |         ret = security_binder_set_context_mgr(proc->tsk);
      |                                               ~~~~^~~~~
      |                                                   |
      |                                                   struct task_struct *
In file included from /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.c:63:
./include/linux/security.h:257:56: note: expected ‘const struct cred *’ but argument is of type ‘struct task_struct *’
  257 | int security_binder_set_context_mgr(const struct cred *mgr);
      |                                     ~~~~~~~~~~~~~~~~~~~^~~
cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:280: /tmp/anbox-modules-dkms/src/anbox-modules/binder/binder.o] Error 1
make[1]: *** [Makefile:1822: /tmp/anbox-modules-dkms/src/anbox-modules/binder] Error 2
make[1]: Leaving directory '/usr/lib/modules/5.10.80-1-lts/build'
make: *** [Makefile:8: all] Error 2
==> ERROR: A failure occurred in build().
    Aborting...

Copy link
Owner

@choff choff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make sure that your changes are consistent to the code of "binder.c" in the Linux mainline kernel.

binder/binder.c Outdated
goto done;
}
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,2))
if (security_binder_transfer_binder(proc->tsk->real_cred, target_proc->tsk->real_cred)) {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at the most recent version of binder_translate_binder() in the kernel (see this link), the function is invoked slightly differently:
if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
This differs from your code. It is possible that your code works nonetheless, but I would like to keep binder.c in the modules here as consistent as possible to the version in the upstream kernel. So, could you please change this line accordingly? Please also check the "security_binder_*" calls that you changed below to make sure that the code matches as much as possible to "binder.c" in the kernel.This makes the modules here much easier to maintain.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. Updating as soon as I can

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed to be in same style as Android binder.c, and I noticed there's more changes in the binder.c and struct binder_proc (new fields). A new PR may be needed

@choff
Copy link
Owner

choff commented Nov 21, 2021

@modscleo4 great PR!

I think Linux 5.10.80-1-lts may also affected if you want to change the LINUX_VERSION_CODE range somehow, or would it need something else?

Indeed, it seems that the same changes are also required on this kernel. It seems like this patch was backported to 5.10 and probably also to a plethora of other kernel versions then; probably it's a bugfix or fixes a security problem. But given how many kernel versions are going to receive this fix, it will become increasingly difficult to write a kernel version check using LINUX_VERSION_CODE that reliably verifies whether that kernel has the change or not... But I think we have to try; the only other option would be to create a new branch with the old code and to make an incompatible change on the master branch, which only works on kernels that have this bugfix.

@sickcodes
Copy link

@modscleo4 great PR!

I think Linux 5.10.80-1-lts may also affected if you want to change the LINUX_VERSION_CODE range somehow, or would it need something else?

Indeed, it seems that the same changes are also required on this kernel. It seems like this patch was backported to 5.10 and probably also to a plethora of other kernel versions then; probably it's a bugfix or fixes a security problem. But given how many kernel versions are going to receive this fix, it will become increasingly difficult to write a kernel version check using LINUX_VERSION_CODE that reliably verifies whether that kernel has the change or not... But I think we have to try; the only other option would be to create a new branch with the old code and to make an incompatible change on the master branch, which only works on kernels that have this bugfix.

Good point—

I honestly think it could be easier just keeping it in just one version, perhaps just tag new releases rather than support the old releases. It might get messy? @choff

@sickcodes
Copy link

@choff this woks good on all of the following kernels (all except binder on 5.10-lts):

==> dkms install --no-depmod binder/1 -k 5.15.5-arch1-1
==> dkms install --no-depmod ashmem/1 -k 5.15.5-arch1-1
==> dkms install --no-depmod binder/1 -k 5.15.5-zen1-1-zen
==> dkms install --no-depmod binder/1 -k 5.10.82-1-lts
Error! Bad return status for module build on kernel: 5.10.82-1-lts (x86_64)
Consult /var/lib/dkms/binder/1/build/make.log for more information.
==> WARNING: `dkms install --no-depmod binder/1 -k 5.10.82-1-lts' exited 10
==> dkms install --no-depmod ashmem/1 -k 5.15.5-zen1-1-zen
==> dkms install --no-depmod ashmem/1 -k 5.10.82-1-lts

@sickcodes
Copy link

@modscleo4 can you check: modscleo4#1

==> dkms install --no-depmod binder/1 -k 5.15.5-arch1-1
==> dkms install --no-depmod ashmem/1 -k 5.15.5-arch1-1
==> dkms install --no-depmod binder/1 -k 5.15.5-zen1-1-zen
==> dkms install --no-depmod binder/1 -k 5.10.82-1-lts
==> dkms install --no-depmod ashmem/1 -k 5.15.5-zen1-1-zen
==> dkms install --no-depmod ashmem/1 -k 5.10.82-1-lts

@choff choff merged commit 8148a16 into choff:master Nov 29, 2021
@choff
Copy link
Owner

choff commented Nov 29, 2021

Hello @sickcodes and @modscleo4 ,

thanks for the PR and for testing it! I have now merged your code. The only thing I still want to do is to remove some unused fields in the "struct binder_proc", which @modscleo4 also added (e.g. "outstanding_txns"), but I will do that in a separate commit. And then there's also the issue with the latest 5.10 kernel still to be fixed. For that, we'd need to improve the version checking as I really wouldn't like to introduce an incompatibility at this point. I will try to also look into that.

Best regards,

Christian

@modscleo4
Copy link
Author

modscleo4 commented Nov 29, 2021

Hello @sickcodes and @modscleo4 ,

thanks for the PR and for testing it! I have now merged your code. The only thing I still want to do is to remove some unused fields in the "struct binder_proc", which @modscleo4 also added (e.g. "outstanding_txns"), but I will do that in a separate commit. And then there's also the issue with the latest 5.10 kernel still to be fixed. For that, we'd need to improve the version checking as I really wouldn't like to introduce an incompatibility at this point. I will try to also look into that.

Best regards,

Christian

oh sorry I only meant to add the cred field but somehow all other fields were added too

@sickcodes
Copy link

Hey @choff here was the 5.10 fix: modscleo4#1

@sickcodes
Copy link

Removing the ifdefs works on latest kernel and lts 😋 I opened a PR on @modscleo4's fork, but it works without the ifdefs.

I think just tag pre commit as 5.14, and remove the ifdefs, should be fine.

==> dkms install --no-depmod binder/1 -k 5.15.5-arch1-1
==> dkms install --no-depmod ashmem/1 -k 5.15.5-arch1-1
==> dkms install --no-depmod binder/1 -k 5.15.5-zen1-1-zen
==> dkms install --no-depmod binder/1 -k 5.10.82-1-lts
==> dkms install --no-depmod ashmem/1 -k 5.15.5-zen1-1-zen
==> dkms install --no-depmod ashmem/1 -k 5.10.82-1-lts

@Beryesa
Copy link

Beryesa commented Dec 5, 2021

Works for 5.15.6 but fails for lts (master branch)

(12/21) Install DKMS modules
==> dkms install --no-depmod anbox-binder/1 -k 5.10.83-1-lts
Error! Bad return status for module build on kernel: 5.10.83-1-lts (x86_64)
Consult /var/lib/dkms/anbox-binder/1/build/make.log for more information.
==> WARNING: `dkms install --no-depmod anbox-binder/1 -k 5.10.83-1-lts' exited 10

@sickcodes
Copy link

@04ELY use my PR fork, works on 5.10

@sickcodes
Copy link

@sickcodes I tested out your fork on the Manjaro 5.10-LTS fork and it gives errors for binder when compiling and eventually crashes the OS.

It's fixed now for 5.10 in the AUR. I've tested on 5.10 thru 5.14. Let me know if you have any issues!

choff pushed a commit that referenced this pull request Apr 2, 2024
* removed obsolete name="%k", added binder symlink

* removed obsolete name="%k", added binder symlink
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants