[PATCH 01/37] Revert "android: binder: Sanity check at binder ioctl"

[PATCH 01/37] Revert "android: binder: Sanity check at binder ioctl"

[Todd Kjos]

This reverts commit a906d6931f3ccaf7de805643190765ddd7378e27.

Signed-off-by: Todd Kjos <tkjos@google.com>
---
 drivers/android/binder.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index aae4d8d4be36..157bd3e49ff4 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3247,10 +3247,6 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	/*pr_info("binder_ioctl: %d:%d %x %lx\n",
 			proc->pid, current->pid, cmd, arg);*/
 
-	if (unlikely(current->mm != proc->vma_vm_mm)) {
-		pr_err("current mm mismatch proc mm\n");
-		return -EINVAL;
-	}
 	trace_binder_ioctl(cmd, arg);
 
 	ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
@@ -3466,7 +3462,6 @@ static int binder_open(struct inode *nodp, struct file *filp)
 		return -ENOMEM;
 	get_task_struct(current);
 	proc->tsk = current;
-	proc->vma_vm_mm = current->mm;
 	INIT_LIST_HEAD(&proc->todo);
 	init_waitqueue_head(&proc->wait);
 	proc->default_priority = task_nice(current);
-- 
2.13.2.725.g09c95d1e9-goog

Re: [PATCH 01/37] Revert "android: binder: Sanity check at binder ioctl"

[Greg KH]

On Wed, Jul 05, 2017 at 09:08:48AM -0700, Todd Kjos wrote:
> It is reverted here because if we keep it, it would need to be refactored as
> part of this patchset since vma_vm_mm is no longer in struct binder_proc (moved
> to binder_alloc). The patch introduces a race condition in the driver and an
> attempt to fix it was submitted in "[PATCH v2] android: binder: fix dangling
> pointer comparison" and the conclusion then was to revert this patch. After
> discussing with Arve we decided reverting now was better than refactoring it to
> work with FGL.
> 
> Do you want me to add rationale to the commit message?

Yes, please do :)

thanks,

greg k-h

Re: [PATCH 01/37] Revert "android: binder: Sanity check at binder ioctl"

[Greg KH]

On Thu, Jun 29, 2017 at 12:01:35PM -0700, Todd Kjos wrote:
> This reverts commit a906d6931f3ccaf7de805643190765ddd7378e27.
> 

I need a reason why this is to be reverted here :)

thanks,

greg k-h

[PATCH 01/37] Revert "android: binder: Sanity check at binder ioctl"

[Todd Kjos]

This reverts commit a906d6931f3ccaf7de805643190765ddd7378e27.

Signed-off-by: Todd Kjos <tkjos@google.com>
---
 drivers/android/binder.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index aae4d8d4be36..157bd3e49ff4 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3247,10 +3247,6 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	/*pr_info("binder_ioctl: %d:%d %x %lx\n",
 			proc->pid, current->pid, cmd, arg);*/
 
-	if (unlikely(current->mm != proc->vma_vm_mm)) {
-		pr_err("current mm mismatch proc mm\n");
-		return -EINVAL;
-	}
 	trace_binder_ioctl(cmd, arg);
 
 	ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
@@ -3466,7 +3462,6 @@ static int binder_open(struct inode *nodp, struct file *filp)
 		return -ENOMEM;
 	get_task_struct(current);
 	proc->tsk = current;
-	proc->vma_vm_mm = current->mm;
 	INIT_LIST_HEAD(&proc->todo);
 	init_waitqueue_head(&proc->wait);
 	proc->default_priority = task_nice(current);
-- 
2.13.2.725.g09c95d1e9-goog