ANDROID: binder: don't check prio permissions on restore.

Because we have disabled RT priority inheritance for
the regular binder domain, the following can happen:

1) thread A (prio 98) calls into thread B
2) because RT prio inheritance is disabled, thread B
   runs at the lowest nice (prio 100) instead
3) thread B calls back into A; A will run at prio 100
   for the duration of the transaction
4) When thread A is done with the call from B, we will
   try to restore the prio back to 98. But, we fail
   because the process doesn't hold CAP_SYS_NICE,
   neither is RLIMIT_RT_PRIO set.

While the proper fix going forward will be to
correctly apply CAP_SYS_NICE or RLIMIT_RT_PRIO,
for now it seems reasonable to not check permissions
on the restore path.

Change-Id: Ibede5960c9b7bb786271c001e405de50be64d944
Signed-off-by: Martijn Coenen <maco@android.com>

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 07bb592b2a89b44d0771727221f17ee3788d697c..11f65175f944e9d2ac566b8186123be3763799ce 100644 (file)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1116,8 +1116,9 @@ static int to_kernel_prio(int policy, int user_priority)
                return MAX_USER_RT_PRIO - 1 - user_priority;
 }
 
-static void binder_set_priority(struct task_struct *task,
-                               struct binder_priority desired)
+static void binder_do_set_priority(struct task_struct *task,
+                                  struct binder_priority desired,
+                                  bool verify)
 {
        int priority; /* user-space prio value */
        bool has_cap_nice;
@@ -1130,7 +1131,7 @@ static void binder_set_priority(struct task_struct *task,
 
        priority = to_userspace_prio(policy, desired.prio);
 
-       if (is_rt_policy(policy) && !has_cap_nice) {
+       if (verify && is_rt_policy(policy) && !has_cap_nice) {
                long max_rtprio = task_rlimit(task, RLIMIT_RTPRIO);
 
                if (max_rtprio == 0) {
@@ -1141,7 +1142,7 @@ static void binder_set_priority(struct task_struct *task,
                }
        }
 
-       if (is_fair_policy(policy) && !has_cap_nice) {
+       if (verify && is_fair_policy(policy) && !has_cap_nice) {
                long min_nice = (MAX_NICE - task_rlimit(task, RLIMIT_NICE) + 1);
 
                if (min_nice > MAX_NICE) {
@@ -1174,6 +1175,18 @@ static void binder_set_priority(struct task_struct *task,
                set_user_nice(task, priority);
 }
 
+static void binder_set_priority(struct task_struct *task,
+                               struct binder_priority desired)
+{
+       binder_do_set_priority(task, desired, /* verify = */ true);
+}
+
+static void binder_restore_priority(struct task_struct *task,
+                                   struct binder_priority desired)
+{
+       binder_do_set_priority(task, desired, /* verify = */ false);
+}
+
 static void binder_transaction_priority(struct task_struct *task,
                                        struct binder_transaction *t,
                                        struct binder_priority node_prio,
@@ -3211,7 +3224,7 @@ static void binder_transaction(struct binder_proc *proc,
                binder_enqueue_work_ilocked(&t->work, &target_thread->todo);
                binder_inner_proc_unlock(target_proc);
                wake_up_interruptible_sync(&target_thread->wait);
-               binder_set_priority(current, in_reply_to->saved_priority);
+               binder_restore_priority(current, in_reply_to->saved_priority);
                binder_free_transaction(in_reply_to);
        } else if (!(t->flags & TF_ONE_WAY)) {
                BUG_ON(t->buffer->async_transaction != 0);
@@ -3300,7 +3313,7 @@ err_no_context_mgr_node:
 
        BUG_ON(thread->return_error.cmd != BR_OK);
        if (in_reply_to) {
-               binder_set_priority(current, in_reply_to->saved_priority);
+               binder_restore_priority(current, in_reply_to->saved_priority);
                thread->return_error.cmd = BR_TRANSACTION_COMPLETE;
                binder_enqueue_work(thread->proc,
                                    &thread->return_error.work,
@@ -3900,7 +3913,7 @@ retry:
                        wait_event_interruptible(binder_user_error_wait,
                                                 binder_stop_on_user_error < 2);
                }
-               binder_set_priority(current, proc->default_priority);
+               binder_restore_priority(current, proc->default_priority);
        }
 
        if (non_block) {