Re: kernel BUG at drivers/android/binder_alloc.c:LINE! (3)

[Todd Kjos]

Sigh. One more try... master with the same patch as an attachment.
(the patch is already queued up in gregkh's 'char-misc-linus' branch).

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
master

On Thu, Mar 28, 2019 at 5:20 PM syzbot
<syzbot+f9f3f388440283da2965@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> Hello,
>
> syzbot tried to test the proposed patch but build/boot failed:
>
> timed out
>
>
>
>
>
>
> Tested on:
>
> commit:         0532a1b0 virt: vbox: Implement passing requestor info to t..
> git tree:
> git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
> char-misc-linus
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8dcdce25ea72bedf
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>
From d49c95c944c15732ef57f1c876e24838b2ddf34b Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@xxxxxxxxxx>
Date: Tue, 19 Mar 2019 09:53:01 -0700
Subject: [PATCH] binder: fix BUG_ON found by selinux-testsuite

The selinux-testsuite found an issue resulting in a BUG_ON()
where a conditional relied on a size_t going negative when
checking the validity of a buffer offset.

Fixes: 7a67a39320df ("binder: add function to copy binder object from buffer")
Reported-by: Paul Moore <paul@xxxxxxxxxxxxxx>
Tested-by: Paul Moore <paul@xxxxxxxxxxxxxx>
Signed-off-by: Todd Kjos <tkjos@xxxxxxxxxx>
---
Please add to 5.1 (fixes problem introduced in 5.1-rc1)

 drivers/android/binder.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 8685882da64cd..4b9c7ca492e6d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2057,7 +2057,8 @@ static size_t binder_get_object(struct binder_proc *proc,
 	size_t object_size = 0;
 
 	read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
-	if (read_size < sizeof(*hdr) || !IS_ALIGNED(offset, sizeof(u32)))
+	if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
+	    !IS_ALIGNED(offset, sizeof(u32)))
 		return 0;
 	binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
 				      offset, read_size);
-- 
2.21.0.225.g810b269d1ac-goog