Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35979513 authored by Martijn Coenen's avatar Martijn Coenen
Browse files

binder: use group leader instead of open thread 



The binder allocator assumes that the thread that
called binder_open will never die for the lifetime of
that proc. That thread is normally the group_leader,
however it may not be. Use the group_leader instead
of current.

Bug: 35707103
Test: Created test case to open with temporary thread

Change-Id: Id693f74b3591f3524a8c6e9508e70f3e5a80c588
Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
Signed-off-by: default avatarMartijn Coenen <maco@android.com>
parent 33af4c0c

drivers/android/binder.c

+3 −3
Original line number Diff line number Diff line
@@ -3359,7 +3359,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 
	const char *failure_string;

	struct binder_buffer *buffer;



	if (proc->tsk != current)

	if (proc->tsk != current->group_leader)

		return -EINVAL;



	if ((vma->vm_end - vma->vm_start) > SZ_4M)
@@ -3461,8 +3461,8 @@ static int binder_open(struct inode *nodp, struct file *filp) 
	proc = kzalloc(sizeof(*proc), GFP_KERNEL);

	if (proc == NULL)

		return -ENOMEM;

	get_task_struct(current);

	proc->tsk = current;

	get_task_struct(current->group_leader);

	proc->tsk = current->group_leader;

	INIT_LIST_HEAD(&proc->todo);

	init_waitqueue_head(&proc->wait);

	proc->default_priority = task_nice(current);