drivers/android/binder.c | 52 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 49 insertions(+), 3 deletions(-)
From: "JongAn Kim" <jongan.kim@lge.com>
Currently, when a freeze is attempted from a non-init PID namespace,
there is a possibility that the wrong process in the init namespace
may be frozen due to PID collision across namespaces.
For example, if a container with PID namespace has a process with
PID 100 (which maps to PID 5000 in init namespace), attempting to
freeze PID 100 from the container could incorrectly match a different
process with PID 100 in the init namespace.
This patch fixes the issue by:
1. Converting the caller's PID from their namespace to init namespace
2. Matching against binder_proc->pid (which stores init namespace TGID)
3. Returning -EINVAL for invalid PIDs and -ESRCH for not-found processes
This change ensures correct PID handling when binder freeze occurs in
non-init PID namespace.
Signed-off-by: JongAn Kim <jongan.kim@lge.com>
---
drivers/android/binder.c | 52 +++++++++++++++++++++++++++++++++++++---
1 file changed, 49 insertions(+), 3 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index a3a1b5c33ba3..337d1f2c4533 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5607,6 +5607,40 @@ static bool binder_txns_pending_ilocked(struct binder_proc *proc)
return false;
}
+/**
+ * binder_convert_to_init_ns_tgid() - Convert pid to global pid(init namespace)
+ * @pid: pid from user space
+ *
+ * Converts a process ID (TGID) from the caller's PID namespace to the
+ * corresponding TGID in the init namespace.
+ *
+ * Return: On success, returns TGID in init namespace (positive value).
+ * On error, returns -EINVAL if pid <= 0, or -ESRCH if process
+ * not found or not visible in init namespace.
+ */
+static int binder_convert_to_init_ns_tgid(int pid)
+{
+ struct task_struct *task;
+ int init_ns_pid;
+
+ /* already in init namespace */
+ if (task_is_in_init_pid_ns(current))
+ return pid;
+
+ if (pid <= 0)
+ return -EINVAL;
+
+ rcu_read_lock();
+ task = pid_task(find_vpid(pid), PIDTYPE_PID);
+ init_ns_pid = task ? task_tgid_nr_ns(task, &init_pid_ns) : -ESRCH;
+ rcu_read_unlock();
+
+ if (!init_ns_pid)
+ return -ESRCH;
+
+ return init_ns_pid;
+}
+
static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
{
struct binder_node *prev = NULL;
@@ -5715,13 +5749,18 @@ static int binder_ioctl_get_freezer_info(
struct binder_proc *target_proc;
bool found = false;
__u32 txns_pending;
+ int init_ns_pid = 0;
info->sync_recv = 0;
info->async_recv = 0;
+ init_ns_pid = binder_convert_to_init_ns_tgid(info->pid);
+ if (init_ns_pid < 0)
+ return init_ns_pid;
+
mutex_lock(&binder_procs_lock);
hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid == info->pid) {
+ if (target_proc->pid == init_ns_pid) {
found = true;
binder_inner_proc_lock(target_proc);
txns_pending = binder_txns_pending_ilocked(target_proc);
@@ -5867,6 +5906,7 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
struct binder_freeze_info info;
struct binder_proc **target_procs = NULL, *target_proc;
int target_procs_count = 0, i = 0;
+ int init_ns_pid = 0;
ret = 0;
@@ -5875,9 +5915,15 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
goto err;
}
+ init_ns_pid = binder_convert_to_init_ns_tgid(info.pid);
+ if (init_ns_pid < 0) {
+ ret = init_ns_pid;
+ goto err;
+ }
+
mutex_lock(&binder_procs_lock);
hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid == info.pid)
+ if (target_proc->pid == init_ns_pid)
target_procs_count++;
}
@@ -5898,7 +5944,7 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
}
hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid != info.pid)
+ if (target_proc->pid != init_ns_pid)
continue;
binder_inner_proc_lock(target_proc);
--
2.25.1From: "JongAn Kim" <jongan.kim@lge.com>
Currently, when a freeze is attempted from a non-init PID namespace,
there is a possibility that the wrong process in the init namespace
may be frozen due to PID collision across namespaces.
For example, if a container with PID namespace has a process with
PID 100 (which maps to PID 5000 in init namespace), attempting to
freeze PID 100 from the container could incorrectly match a different
process with PID 100 in the init namespace.
This patch fixes the issue by:
1. Converting the caller's PID from their namespace to init namespace
2. Matching against binder_proc->pid (which stores init namespace TGID)
3. Returning -EINVAL for invalid PIDs and -ESRCH for not-found processes
This change ensures correct PID handling when binder freeze occurs in
non-init PID namespace.
Signed-off-by: JongAn Kim <jongan.kim@lge.com>
---
drivers/android/binder.c | 52 +++++++++++++++++++++++++++++++++++++---
1 file changed, 49 insertions(+), 3 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index a3a1b5c33ba3..337d1f2c4533 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5607,6 +5607,40 @@ static bool binder_txns_pending_ilocked(struct binder_proc *proc)
return false;
}
+/**
+ * binder_convert_to_init_ns_tgid() - Convert pid to global pid(init namespace)
+ * @pid: pid from user space
+ *
+ * Converts a process ID (TGID) from the caller's PID namespace to the
+ * corresponding TGID in the init namespace.
+ *
+ * Return: On success, returns TGID in init namespace (positive value).
+ * On error, returns -EINVAL if pid <= 0, or -ESRCH if process
+ * not found or not visible in init namespace.
+ */
+static int binder_convert_to_init_ns_tgid(int pid)
+{
+ struct task_struct *task;
+ int init_ns_pid;
+
+ /* already in init namespace */
+ if (task_is_in_init_pid_ns(current))
+ return pid;
+
+ if (pid <= 0)
+ return -EINVAL;
+
+ rcu_read_lock();
+ task = pid_task(find_vpid(pid), PIDTYPE_PID);
+ init_ns_pid = task ? task_tgid_nr_ns(task, &init_pid_ns) : -ESRCH;
+ rcu_read_unlock();
+
+ if (!init_ns_pid)
+ return -ESRCH;
+
+ return init_ns_pid;
+}
+
static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
{
struct binder_node *prev = NULL;
@@ -5715,13 +5749,18 @@ static int binder_ioctl_get_freezer_info(
struct binder_proc *target_proc;
bool found = false;
__u32 txns_pending;
+ int init_ns_pid = 0;
info->sync_recv = 0;
info->async_recv = 0;
+ init_ns_pid = binder_convert_to_init_ns_tgid(info->pid);
+ if (init_ns_pid < 0)
+ return init_ns_pid;
+
mutex_lock(&binder_procs_lock);
hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid == info->pid) {
+ if (target_proc->pid == init_ns_pid) {
found = true;
binder_inner_proc_lock(target_proc);
txns_pending = binder_txns_pending_ilocked(target_proc);
@@ -5867,6 +5906,7 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
struct binder_freeze_info info;
struct binder_proc **target_procs = NULL, *target_proc;
int target_procs_count = 0, i = 0;
+ int init_ns_pid = 0;
ret = 0;
@@ -5875,9 +5915,15 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
goto err;
}
+ init_ns_pid = binder_convert_to_init_ns_tgid(info.pid);
+ if (init_ns_pid < 0) {
+ ret = init_ns_pid;
+ goto err;
+ }
+
mutex_lock(&binder_procs_lock);
hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid == info.pid)
+ if (target_proc->pid == init_ns_pid)
target_procs_count++;
}
@@ -5898,7 +5944,7 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
}
hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid != info.pid)
+ if (target_proc->pid != init_ns_pid)
continue;
binder_inner_proc_lock(target_proc);
--
2.25.1On Thu, Jan 08, 2026 at 10:10:11AM +0900, jongan.kim@lge.com wrote: > From: "JongAn Kim" <jongan.kim@lge.com> > > Currently, when a freeze is attempted from a non-init PID namespace, > there is a possibility that the wrong process in the init namespace > may be frozen due to PID collision across namespaces. I did not think that binder worked with pid namespaces. I think I've asked this before and was told it was not supported. So how are you running into this? What system requires this? > For example, if a container with PID namespace has a process with > PID 100 (which maps to PID 5000 in init namespace), attempting to > freeze PID 100 from the container could incorrectly match a different > process with PID 100 in the init namespace. > > This patch fixes the issue by: > 1. Converting the caller's PID from their namespace to init namespace > 2. Matching against binder_proc->pid (which stores init namespace TGID) > 3. Returning -EINVAL for invalid PIDs and -ESRCH for not-found processes Are you sure this is the only place pid namespaces come into play in binder? If this is going to be supported, I think all uses of pids need to handle namespaces. or am I confused as to what is broken here? thanks, greg k-h
© 2016 - 2026 Red Hat, Inc.