linux/drivers/android
Alice Ryhl dd7aea9ee2 rust_binder: do not query current thread for all ioctls
The get_current_thread() method is currently called for every ioctl to
ensure that a Thread struct exists for the thread calling into the
driver. However, not all ioctls require a Thread object, so this means
we are unnecessarily creating these objects in cases where we don't need
to. If said thread does not invoke BINDER_THREAD_EXIT on exit, Binder's
Thread struct stays around until the fd is closed. For long-lived
processes the Thread object is effectively leaked.

Furthermore, when the BINDER_GET_NODE_DEBUG_INFO ioctl is invoked by
libmemunreachable to ensure that objects reachable only through the
Binder driver are not considered leaked, this is done from a fork of the
process owning the fd, which means that it fails the group_leader check
inside get_current_thread(). This results in EINVAL errors for this
ioctl, causing libmemunreachable to report a false positive memory leak.

Thus, do not invoke get_current_thread() for ioctls that do not require
it.

Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Cc: stable <stable@kernel.org>
Fixes: eafedbc7c0 ("rust_binder: add Rust Binder driver")
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260727-binder-cur-thread-v1-1-8edf2b64e235@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-31 11:00:42 +02:00
..
binder rust_binder: do not query current thread for all ioctls 2026-07-31 11:00:42 +02:00
tests binder: mark binder_alloc_exhaustive_test as slow 2025-11-26 13:24:19 +01:00
binder_alloc.c mm: rename zap_page_range_single() to zap_vma_range() 2026-04-05 13:53:15 -07:00
binder_alloc.h binder: Convert binder_alloc selftests to KUnit 2025-07-16 14:11:59 +02:00
binder_internal.h binder: add t->is_async and t->is_reply 2025-08-19 12:53:01 +02:00
binder_netlink.c tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
binder_netlink.h tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
binder_trace.h binder: add tracepoint for netlink reports 2025-08-19 12:53:02 +02:00
binder.c binder: fix UAF in binder_free_transaction() 2026-07-03 12:28:12 +02:00
binderfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dbitmap.h binder: fix double-free in dbitmap 2025-09-18 17:20:00 +02:00
Kconfig rust_binder: add Rust Binder driver 2025-09-19 09:40:46 +02:00
Makefile rust_binder: add Rust Binder driver 2025-09-19 09:40:46 +02:00