[PATCH v4 0/7] binder: fix issues with mremap()

[Carlos Llamas]

This is a follow up series fixing some pre-existing issues found by
sashiko during a review of an unrelated patchset here:
https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@xxxxxxxxxx

The goal is to safely reject mremap() requests on binder's vma to
prevent pages from temporary leaking and accidental IPC tear-down.

Cc: Todd Kjos <tkjos@xxxxxxxxxxx>
Cc: Alice Ryhl <aliceryhl@xxxxxxxxxx>
Cc: Suren Baghdasaryan <surenb@xxxxxxxxxx> 

--
v4:
 - Also reject vma splitting. This closes loopholes wrt to partial
   range munmap() that Sashiko pointed out.
 - With splitting denied, we can go back to the simpler ->vm_start
   check in op->close().

v3:
 - Switch to a range-check in vm_ops->close() and protect against
   partial munmap() as Sashiko points out.
https://lore.kernel.org/all/20260901163521.1355535-1-cmllamas@xxxxxxxxxx/

v2:
 - Set VM_DONTEXPAND in [1/5] and [2/5] per Sashiko's feedback.
 - Check vma->vm_start to prevent incorrect ->close() in [3/5] per
   Sashiko's feedback.
https://lore.kernel.org/all/20260901030419.470246-1-cmllamas@xxxxxxxxxx/

v1:
https://lore.kernel.org/all/20260831224145.169403-1-cmllamas@xxxxxxxxxx/

Carlos Llamas (7):
  binder: set VM_DONTEXPAND
  rust_binder: set VM_DONTEXPAND
  binder: forbid vma splitting
  rust_binder: forbid vma splitting
  binder: check vma->vm_start in binder_vma_close()
  binder: reject mremap()
  rust_binder: reject mremap()

 drivers/android/binder.c             | 18 +++++++++++++++++-
 drivers/android/binder/page_range.rs | 20 +++++++++++++++++---
 drivers/android/binder/process.rs    |  1 +
 3 files changed, 35 insertions(+), 4 deletions(-)

-- 
2.55.0.966.g6673acef38-goog