binder: fix issues with mremap()

This is a follow up series fixing some pre-existing issues found by sashiko during a review of an unrelated patchset here:
https://sashiko.dev/#/patchset/[email protected]

The goal is to safely reject mremap() requests on binder's vma to prevent pages from temporary leaking and accidental IPC tear-down.

--
v4:
- Also reject vma splitting. This closes loopholes wrt to partial range munmap() that Sashiko pointed out.
- With splitting denied, we can go back to the simpler ->vm_start check in op->close().

v3:
- Switch to a range-check in vm_ops->close() and protect against partial munmap() as Sashiko points out.
https://lore.kernel.org/all/[email protected]/

v2:
- Set VM_DONTEXPAND in [1/5] and [2/5] per Sashiko's feedback.
- Check vma->vm_start to prevent incorrect ->close() in [3/5] per Sashiko's feedback.
https://lore.kernel.org/all/[email protected]/

v1:
https://lore.kernel.org/all/[email protected]/

Carlos Llamas (7):
binder: set VM_DONTEXPAND
rust_binder: set VM_DONTEXPAND
binder: forbid vma splitting
rust_binder: forbid vma splitting
binder: check vma->vm_start in binder_vma_close()
binder: reject mremap()
rust_binder: reject mremap()

 drivers/android/binder.c             | 18 +++++++++++++++++-
 drivers/android/binder/page_range.rs | 20 +++++++++++++++++---
 drivers/android/binder/process.rs    |  1 +
 3 files changed, 35 insertions(+), 4 deletions(-)

2.55.0.966.g6673acef38-goog