android: binder: Sanity check at binder ioctl (a906d693) · Commits · 戴 / test

Sanity check at binder ioctl function, Only allow the shared mm_struct to use the same binder-object to do binder operate. And add proc->vma_vm_mm = current->mm at the open function. The libbinder do ioctl before mmap called. V2: Fix compile error for error commit V3: Change the condition to proc->vma_vm_mm Signed-off-by:

Chen Feng <puck.chen@hisilicon.com> Signed-off-by:

Wei Dong <weidong2@hisilicon.com> Signed-off-by:

Junmin Zhao <zhaojunmin@huawei.com> Reviewed-by:

Zhuangluan Su <suzhuangluan@hisilicon.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/android/binder.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -2737,6 +2737,10 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		/*pr_info("binder_ioctl: %d:%d %x %lx\n",
		proc->pid, current->pid, cmd, arg);*/

		if (unlikely(current->mm != proc->vma_vm_mm)) {
		pr_err("current mm mismatch proc mm\n");
		return -EINVAL;
		}
		trace_binder_ioctl(cmd, arg);

		ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
		@@ -2951,6 +2955,7 @@ static int binder_open(struct inode nodp, struct file filp)
		return -ENOMEM;
		get_task_struct(current);
		proc->tsk = current;
		proc->vma_vm_mm = current->mm;
		INIT_LIST_HEAD(&proc->todo);
		init_waitqueue_head(&proc->wait);
		proc->default_priority = task_nice(current);

Admin message