linux-kernel - Re: [PATCH RESEND] binder: handle PID namespace conversion for freeze operation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260116055222.6069-1-jongan.kim@lge.com>
Date: Fri, 16 Jan 2026 14:52:22 +0900
From: jongan.kim@....com
To: aliceryhl@...gle.com,
	gregkh@...uxfoundation.org
Cc: arve@...roid.com,
	brauner@...nel.org,
	cmllamas@...gle.com,
	heesu0025.kim@....com,
	ht.hong@....com,
	jongan.kim@....com,
	jungsu.hwang@....com,
	kernel-team@...roid.com,
	linux-kernel@...r.kernel.org,
	sanghun.lee@....com,
	seulgi.lee@....com,
	sunghoon.kim@....com,
	tkjos@...roid.com
Subject: Re: [PATCH RESEND] binder: handle PID namespace conversion for freeze operation

Alice Ryhl @ 2026-01-15  8:41 UTC wrote:
> On Thu, Jan 15, 2026 at 05:06:19PM +0900, jongan.kim@....com wrote:
> > As Alice mentioned, since only the freeze operation takes a pid as input, it
> > receives the local pid of the namespace. This patch converts this pid to the
> > global pid of the init namespace for matching pid of binder_procs properly.
> > (binder_procs has `task->group_leader->pid`). Are there any concerns or 
> > problems for this logic?
>
> This isn't new with your changes ... but it does have a race where the
> target process dies and gets replaced by a new process with the same pid
> just before you invoke the freeze ioctl.

Thanks for sharing! Has this issue been encountered before? I think there may
be a potential problem, although it is very unlikely to occur. (It is also very
hard to fix and verify the problem I guess...)
For now I want to focus on the patch submitted regarding the PID namespace on
this thread. Please check if there are any issues with merging this patch into
the binder driver.

Thanks. // JongAn, Kim