diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 2cc96a0e75ae..2d2457cc0752 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2842,7 +2842,7 @@ static void binder_transaction(struct binder_proc *proc, t->from = thread; else t->from = NULL; - t->sender_euid = task_euid(proc->tsk); + t->sender_euid = binder_get_cred(proc)->euid; t->to_proc = target_proc; t->to_thread = target_thread; t->code = tr->code; @@ -4486,6 +4486,8 @@ static struct binder_thread *binder_get_thread(struct binder_proc *proc) static void binder_free_proc(struct binder_proc *proc) { struct binder_device *device; + struct binder_proc_ext *eproc = + container_of(proc, struct binder_proc_ext, proc); BUG_ON(!list_empty(&proc->todo)); BUG_ON(!list_empty(&proc->delivered_death)); @@ -4499,8 +4501,9 @@ static void binder_free_proc(struct binder_proc *proc) } binder_alloc_deferred_release(&proc->alloc); put_task_struct(proc->tsk); + put_cred(eproc->cred); binder_stats_deleted(BINDER_STAT_PROC); - kfree(proc); + kfree(eproc); } static void binder_free_thread(struct binder_thread *thread) @@ -5187,6 +5190,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) static int binder_open(struct inode *nodp, struct file *filp) { struct binder_proc *proc, *itr; + struct binder_proc_ext *eproc; struct binder_device *binder_dev; struct binderfs_info *info; struct dentry *binder_binderfs_dir_entry_proc = NULL; @@ -5195,13 +5199,15 @@ static int binder_open(struct inode *nodp, struct file *filp) binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__, current->group_leader->pid, current->pid); - proc = kzalloc(sizeof(*proc), GFP_KERNEL); + eproc = kzalloc(sizeof(*eproc), GFP_KERNEL); + proc = &eproc->proc; if (proc == NULL) return -ENOMEM; spin_lock_init(&proc->inner_lock); spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; + eproc->cred = get_cred(filp->f_cred); INIT_LIST_HEAD(&proc->todo); init_waitqueue_head(&proc->freeze_wait); if (binder_supported_policy(current->policy)) { diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h index 8508a7e45865..93f02395b0d7 100644 --- a/drivers/android/binder_internal.h +++ b/drivers/android/binder_internal.h @@ -473,6 +473,29 @@ struct binder_proc { bool oneway_spam_detection_enabled; }; +/** + * struct binder_proc_ext - binder process bookkeeping + * @proc: element for binder_procs list + * @cred struct cred associated with the `struct file` + * in binder_open() + * (invariant after initialized) + * + * Extended binder_proc -- needed to add the "cred" field without + * changing the KMI for binder_proc. + */ +struct binder_proc_ext { + struct binder_proc proc; + const struct cred *cred; +}; + +static inline const struct cred *binder_get_cred(struct binder_proc *proc) +{ + struct binder_proc_ext *eproc; + + eproc = container_of(proc, struct binder_proc_ext, proc); + return eproc->cred; +} + /** * struct binder_thread - binder thread bookkeeping * @proc: binder process for this thread