On Wed, Dec 18, 2024 at 12:37:40PM -0800, Li Li wrote:
> From: Li Li <dualli@xxxxxxxxxx>
> @@ -6137,6 +6264,11 @@ static int binder_release(struct inode *nodp, struct file *filp)
>
> binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
>
> + if (proc->pid == proc->context->report_portid) {
> + proc->context->report_portid = 0;
> + proc->context->report_flags = 0;
Isn't ->portid the pid from the netlink report manager? How is this ever
going to match a certain proc->pid here? Is this manager supposed to
_also_ open a regular binder fd?
It seems we are tying the cleanup of the netlink interface to the exit
of the regular binder device, correct? This seems unfortunate as using
the netlink interface should be independent.
I was playing around with this patch with my own PoC and now I'm stuck:
root@debian:~# ./binder-netlink
./binder-netlink: nlmsgerr No permission to set flags from 1301: Unknown error -1
Is there a different way to reset the protid?
--
Carlos Llamas
