binder: use group leader instead of open thread

The binder allocator assumes that the thread that
called binder_open will never die for the lifetime of
that proc. That thread is normally the group_leader,
however it may not be. Use the group_leader instead
of current.

Bug: 35707103
Test: Created test case to open with temporary thread

Change-Id: Id693f74b3591f3524a8c6e9508e70f3e5a80c588
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Martijn Coenen <maco@android.com>

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 6c24673990bbf16fa8267f1c9d3333eabbe4bb24..24737816c4fe2f6c9bf73599b923a9c56685cb08 100644 (file)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3360,7 +3360,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
        const char *failure_string;
        struct binder_buffer *buffer;
 
-       if (proc->tsk != current)
+       if (proc->tsk != current->group_leader)
                return -EINVAL;
 
        if ((vma->vm_end - vma->vm_start) > SZ_4M)
@@ -3462,8 +3462,8 @@ static int binder_open(struct inode *nodp, struct file *filp)
        proc = kzalloc(sizeof(*proc), GFP_KERNEL);
        if (proc == NULL)
                return -ENOMEM;
-       get_task_struct(current);
-       proc->tsk = current;
+       get_task_struct(current->group_leader);
+       proc->tsk = current->group_leader;
        INIT_LIST_HEAD(&proc->todo);
        init_waitqueue_head(&proc->wait);
        proc->default_priority = task_nice(current);