Re: [PATCH v3 1/3] binder: handle PID namespace conversion for freeze operation

[Yury Norov <ynorov@nvidia.com>]

On Wed, Feb 04, 2026 at 06:05:21PM +0900, jongan.kim@lge.com wrote:
> On Tue, Feb 03, 2026 at 03:38:59PM -0500, Yury Norov wrote:
> > On Tue, Feb 03, 2026 at 03:59:26PM +0900, jongan.kim@lge.com wrote:
> > > From: JongAn Kim <jongan.kim@lge.com>
> > >
> > > Currently, when a freeze is attempted from a non-init PID namespace,
> > > there is a possibility that the wrong process in the init namespace
> > > may be frozen due to PID collision across namespaces.
> > >
> > > For example, if a container with PID namespace has a process with
> > > PID 100 (which maps to PID 5000 in init namespace), attempting to
> > > freeze PID 100 from the container could incorrectly match a different
> > > process with PID 100 in the init namespace.
> > >
> > > This patch fixes the issue by:
> > > 1. Converting the caller's PID from their namespace to init namespace
> > > 2. Matching against binder_proc->pid (which stores init namespace TGID)
> > > 3. Returning -EINVAL for invalid PIDs and -ESRCH for not-found processes
> > >
> > > This change ensures correct PID handling when binder freeze occurs in
> > > non-init PID namespace.
> > >
> > > Signed-off-by: JongAn Kim <jongan.kim@lge.com>
> > > ---
> > > v2 -> v3 : change to use task->tgid instead of task_tgid_nr_ns()
> > >
> > >  drivers/android/binder.c | 53 +++++++++++++++++++++++++++++++++++++---
> > >  1 file changed, 50 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> > > index 535fc881c8da..4c4366089ecb 100644
> > > --- a/drivers/android/binder.c
> > > +++ b/drivers/android/binder.c
> > > @@ -5609,6 +5609,41 @@ static bool binder_txns_pending_ilocked(struct binder_proc *proc)
> > >        return false;
> > >  }
> > > 
> > > +/**
> > > + * binder_convert_to_init_ns_tgid() - Convert pid to global pid(init namespace)
> > 
> > For global PIDs we've got task_pid_nr(), see include/linux/pid.h:
> > 
> >  /*
> >   * the helpers to get the task's different pids as they are seen
> >   * from various namespaces
> >   *
> >   * task_xid_nr()     : global id, i.e. the id seen from the init namespace;
> >   * task_xid_vnr()    : virtual id, i.e. the id seen from the pid namespace of
> >   *                     current.
> >   * task_xid_nr_ns()  : id seen from the ns specified;
> >   *
> >   * see also pid_nr() etc in include/linux/pid.h
> >   */
> > 
> > I think task_tgid_nr(current) would work for you. Or I misunderstand
> > something?
> > 
> > If your "binder_convert" returns something not covered by one from
> > the above, please put your function in include/linux/pid.h and give
> > it a proper name.
> 
> Thank you for the suggestion. However, task_tgid_nr(current) returns the TGID 
> of the *current* process, not the target process we want to freeze.
>
> What we need is to convert a TGID from the caller's PID namespace to the 
> corresponding TGID in the init namespace for a *different* process (the one 
> being frozen). The flow is:
> 
> 1. User space passes a TGID in their own namespace
> 2. We find the task_struct for that TGID via find_vpid()
> 3. We return task->tgid, which is always in init namespace
> 
> This differs from the existing task_xid_nr() family because we're converting
> a PID from one namespace (caller's) to init namespace for a different task.

OK, I think I see now. Thanks for the explanation. Maybe add it in commit
message?

> > > + * @pid:    pid from user space
> > > + *
> > > + * Converts a process ID (TGID) from the caller's PID namespace to the
> > > + * corresponding TGID in the init namespace.
> > 
> > Process ID (PID) is not the same as TGID, but you use the names
> > interchangeably. This is very confusing. Can you reword?
> 
> Binder driver handles TGID for bind freeze operation.
> To avoid confusion, I will unify the variable names and terminology to use
> "TGID" consistently.
> 
> > > + * Return: On success, returns TGID in init namespace (positive value).
> > > + *         On error, returns -EINVAL if pid <= 0, or -ESRCH if process
> > > + *         not found or not visible in init namespace.
> > > + */
> > > +static int binder_convert_to_init_ns_tgid(u32 pid)
> > 
> > This should use pid_t.
> 
> Ok. I will change to use pid_t for next patch.
>  
> > > +{
> > > +     struct task_struct *task;
> > > +     int init_ns_pid = 0;
> > > +
> > > +     /* already in init namespace */
> > > +     if (task_is_in_init_pid_ns(current))
> > > +             return pid;
> > > +
> > > +     if (pid == 0)
> > > +             return -EINVAL;
> > 
> > Can you comment what is wrong with pid == 0?
> 
> Since find_vpid() always returns NULL when the input value is 0, it returns
> an EINVAL error before calling rcu_read_lock().

OK, so it's a performance trick. Can you discuss performance impact
then? I just wonder how often this function is called with the pid
of idle task?  If no performance impact, maybe it's worth to keep
code simpler?

This also adds inconsistency: if you're running on behalf of root ns,
you return 0 if pid == 0, otherwise you return an error. That's weird
because idle is 0 for any namespace. If it's intended, can you explicitly
mention it?

If you still want to bail out early for pid == 0, maybe:
 
             if (pid == 0 || task_is_in_init_pid_ns(current))
                     return pid;

> > > +     rcu_read_lock();
> > > +     task = pid_task(find_vpid(pid), PIDTYPE_PID);
> > > +     if (task)
> > > +             init_ns_pid = task->tgid;
> > 
> > So I've been replying with the same suggestion to v2, but you did it
> > in this v3 yourself.
> > 
> > > +     rcu_read_unlock();
> > > +
> > > +     if (!init_ns_pid)
> > > +             return -ESRCH;
> > 
> > You can assign init_ns_pid to -ESRCH at declaration and drop this chunk.
> >
> > > +
> > > +     return init_ns_pid;
> > > +}
> > 
> > Thanks,
> > Yury
> 
> Thanks for suggestion. I will apply it (init_ns_pid = -ESRCH) in the next
> patch. 
> 
> Thanks,
> JongAn Kim.