diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 020aadc4f0a9..51bfb4d55ff2 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2819,7 +2819,7 @@ static void binder_transaction(struct binder_proc *proc, t->from = thread; else t->from = NULL; - t->sender_euid = task_euid(proc->tsk); + t->sender_euid = binder_get_cred(proc)->euid; t->to_proc = target_proc; t->to_thread = target_thread; t->code = tr->code; @@ -4430,6 +4430,8 @@ static struct binder_thread *binder_get_thread(struct binder_proc *proc) static void binder_free_proc(struct binder_proc *proc) { struct binder_device *device; + struct binder_proc_ext *eproc = + container_of(proc, struct binder_proc_ext, proc); BUG_ON(!list_empty(&proc->todo)); BUG_ON(!list_empty(&proc->delivered_death)); @@ -4440,8 +4442,9 @@ static void binder_free_proc(struct binder_proc *proc) } binder_alloc_deferred_release(&proc->alloc); put_task_struct(proc->tsk); + put_cred(eproc->cred); binder_stats_deleted(BINDER_STAT_PROC); - kfree(proc); + kfree(eproc); } static void binder_free_thread(struct binder_thread *thread) @@ -4953,6 +4956,7 @@ err_bad_arg: static int binder_open(struct inode *nodp, struct file *filp) { struct binder_proc *proc, *itr; + struct binder_proc_ext *eproc; struct binder_device *binder_dev; struct binderfs_info *info; struct dentry *binder_binderfs_dir_entry_proc = NULL; @@ -4961,13 +4965,15 @@ static int binder_open(struct inode *nodp, struct file *filp) binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__, current->group_leader->pid, current->pid); - proc = kzalloc(sizeof(*proc), GFP_KERNEL); + eproc = kzalloc(sizeof(*eproc), GFP_KERNEL); + proc = &eproc->proc; if (proc == NULL) return -ENOMEM; spin_lock_init(&proc->inner_lock); spin_lock_init(&proc->outer_lock); get_task_struct(current->group_leader); proc->tsk = current->group_leader; + eproc->cred = get_cred(filp->f_cred); INIT_LIST_HEAD(&proc->todo); if (binder_supported_policy(current->policy)) { proc->default_priority.sched_policy = current->policy; diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h index 9765fde875a5..594699029568 100644 --- a/drivers/android/binder_internal.h +++ b/drivers/android/binder_internal.h @@ -449,6 +449,29 @@ struct binder_proc { struct dentry *binderfs_entry; }; +/** + * struct binder_proc_ext - binder process bookkeeping + * @proc: element for binder_procs list + * @cred struct cred associated with the `struct file` + * in binder_open() + * (invariant after initialized) + * + * Extended binder_proc -- needed to add the "cred" field without + * changing the KMI for binder_proc. + */ +struct binder_proc_ext { + struct binder_proc proc; + const struct cred *cred; +}; + +static inline const struct cred *binder_get_cred(struct binder_proc *proc) +{ + struct binder_proc_ext *eproc; + + eproc = container_of(proc, struct binder_proc_ext, proc); + return eproc->cred; +} + /** * struct binder_thread - binder thread bookkeeping * @proc: binder process for this thread