Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1fe8a2bb authored by Todd Kjos's avatar Todd Kjos
Browse files

BACKPORT: binder: use euid from cred instead of using task 



Save the 'struct cred' associated with a binder process
at initial open to avoid potential race conditions
when converting to an euid.

Set a transaction's sender_euid from the 'struct cred'
saved at binder_open() instead of looking up the euid
from the binder proc's 'struct task'. This ensures
the euid is associated with the security context that
of the task that opened binder.

Cc: stable@vger.kernel.org # 4.4+
Fixes: 457b9a6f ("Staging: android: add binder driver")
Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
Suggested-by: default avatarStephen Smalley <stephen.smalley.work@gmail.com>
Suggested-by: default avatarJann Horn <jannh@google.com>
Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
Bug: 200688826
(cherry picked from commit 29bc22ac5e5bc63275e850f0c8fc549e3d0e306b)
[ refactored to avoid changing KMI: struct binder_proc ]
Change-Id: Icaf996a7f5543b7d6943dff3cbe89bfc3614044c
parent a0800501

drivers/android/binder.c

+9 −3
Original line number Diff line number Diff line
@@ -2819,7 +2819,7 @@ static void binder_transaction(struct binder_proc *proc, 
		t->from = thread;

	else

		t->from = NULL;

	t->sender_euid = task_euid(proc->tsk);

	t->sender_euid = binder_get_cred(proc)->euid;

	t->to_proc = target_proc;

	t->to_thread = target_thread;

	t->code = tr->code;
@@ -4430,6 +4430,8 @@ static struct binder_thread *binder_get_thread(struct binder_proc *proc) 
static void binder_free_proc(struct binder_proc *proc)

{

	struct binder_device *device;

	struct binder_proc_ext *eproc =

		container_of(proc, struct binder_proc_ext, proc);



	BUG_ON(!list_empty(&proc->todo));

	BUG_ON(!list_empty(&proc->delivered_death));
@@ -4440,8 +4442,9 @@ static void binder_free_proc(struct binder_proc *proc) 
	}

	binder_alloc_deferred_release(&proc->alloc);

	put_task_struct(proc->tsk);

	put_cred(eproc->cred);

	binder_stats_deleted(BINDER_STAT_PROC);

	kfree(proc);

	kfree(eproc);

}



static void binder_free_thread(struct binder_thread *thread)
@@ -4953,6 +4956,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 
static int binder_open(struct inode *nodp, struct file *filp)

{

	struct binder_proc *proc, *itr;

	struct binder_proc_ext *eproc;

	struct binder_device *binder_dev;

	struct binderfs_info *info;

	struct dentry *binder_binderfs_dir_entry_proc = NULL;
@@ -4961,13 +4965,15 @@ static int binder_open(struct inode *nodp, struct file *filp) 
	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,

		     current->group_leader->pid, current->pid);



	proc = kzalloc(sizeof(*proc), GFP_KERNEL);

	eproc = kzalloc(sizeof(*eproc), GFP_KERNEL);

	proc = &eproc->proc;

	if (proc == NULL)

		return -ENOMEM;

	spin_lock_init(&proc->inner_lock);

	spin_lock_init(&proc->outer_lock);

	get_task_struct(current->group_leader);

	proc->tsk = current->group_leader;

	eproc->cred = get_cred(filp->f_cred);

	INIT_LIST_HEAD(&proc->todo);

	if (binder_supported_policy(current->policy)) {

		proc->default_priority.sched_policy = current->policy;

drivers/android/binder_internal.h

+23 −0
Original line number Diff line number Diff line
@@ -449,6 +449,29 @@ struct binder_proc { 
	struct dentry *binderfs_entry;

};



/**

 * struct binder_proc_ext - binder process bookkeeping

 * @proc:            element for binder_procs list

 * @cred                  struct cred associated with the `struct file`

 *                        in binder_open()

 *                        (invariant after initialized)

 *

 * Extended binder_proc -- needed to add the "cred" field without

 * changing the KMI for binder_proc.

 */

struct binder_proc_ext {

	struct binder_proc proc;

	const struct cred *cred;

};



static inline const struct cred *binder_get_cred(struct binder_proc *proc)

{

	struct binder_proc_ext *eproc;



	eproc = container_of(proc, struct binder_proc_ext, proc);

	return eproc->cred;

}



/**

 * struct binder_thread - binder thread bookkeeping

 * @proc:                 binder process for this thread