From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757428AbcASHeF (ORCPT ); Tue, 19 Jan 2016 02:34:05 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:57147 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752386AbcASHeB (ORCPT ); Tue, 19 Jan 2016 02:34:01 -0500 Date: Mon, 18 Jan 2016 23:33:58 -0800 From: Greg KH To: Chen Feng Cc: arve@android.com, riandrews@android.com, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, yudongbin@hisilicon.com, saberlily.xia@hisilicon.com, suzhuangluan@hisilicon.com, kong.kongxinwei@hisilicon.com, xuyiping@hisilicon.com, z.liuxinliang@hisilicon.com, weidong2@hisilicon.com, w.f@huawei.com, puck.chen@foxmail.com, shimingxing@hisilicon.com, oliver.fu@hisilicon.com, albert.lubing@hisilicon.com, chenxiang9@huawei.com, liuzixing@huawei.com, haojian.zhuang@linaro.org, zhaojunmin@huawei.com, wangjing6@huawei.com, rientjes@google.com, john.stultz@linaro.org, dan.zhao@hisilicon.com, dev@lists.96boards.org, peter.panshilin@hisilicon.com, qijiwen@hisilicon.com, linuxarm@huawei.com Subject: Re: [PATCH RESEND] android: binder: Sanity check at binder ioctl Message-ID: <20160119073358.GA30483@kroah.com> References: <1453175136-3351-1-git-send-email-puck.chen@hisilicon.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1453175136-3351-1-git-send-email-puck.chen@hisilicon.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jan 19, 2016 at 11:45:36AM +0800, Chen Feng wrote: > When a process fork a child process, we should not allow the > child process use the binder which opened by parent process. > > But if the binder-object creater is a thread of one process who exit, > the other thread can also use this binder-object normally. > We can distinguish this by the member proc->tsk->mm. > If the thread exit the tsk->mm will be NULL. > > proc->tsk->mm != current->mm && proc->tsk->mm > > So only allow the shared mm_struct to use the same binder-object and > check the existence of mm_struct. > > Signed-off-by: Chen Feng > Signed-off-by: Wei Dong > Signed-off-by: Junmin Zhao > Reviewed-by: Zhuangluan Su > --- > drivers/android/binder.c | 2 ++ > 1 file changed, 2 insertions(+) Why resend? What changed from the previous version? greg k-h