diff options
Diffstat (limited to 'drivers/android/binder.c')
| -rw-r--r-- | drivers/android/binder.c | 23 | 
1 files changed, 10 insertions, 13 deletions
| diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 49fb74196d02..c75fb600740c 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2710,7 +2710,7 @@ static void binder_transaction(struct binder_proc *proc,  		t->from = thread;  	else  		t->from = NULL; -	t->sender_euid = proc->cred->euid; +	t->sender_euid = task_euid(proc->tsk);  	t->to_proc = target_proc;  	t->to_thread = target_thread;  	t->code = tr->code; @@ -4422,23 +4422,20 @@ static int binder_thread_release(struct binder_proc *proc,  	__release(&t->lock);  	/* -	 * If this thread used poll, make sure we remove the waitqueue -	 * from any epoll data structures holding it with POLLFREE. -	 * waitqueue_active() is safe to use here because we're holding -	 * the inner lock. +	 * If this thread used poll, make sure we remove the waitqueue from any +	 * poll data structures holding it.  	 */ -	if ((thread->looper & BINDER_LOOPER_STATE_POLL) && -	    waitqueue_active(&thread->wait)) { -		wake_up_poll(&thread->wait, EPOLLHUP | POLLFREE); -	} +	if (thread->looper & BINDER_LOOPER_STATE_POLL) +		wake_up_pollfree(&thread->wait);  	binder_inner_proc_unlock(thread->proc);  	/* -	 * This is needed to avoid races between wake_up_poll() above and -	 * and ep_remove_waitqueue() called for other reasons (eg the epoll file -	 * descriptor being closed); ep_remove_waitqueue() holds an RCU read -	 * lock, so we can be sure it's done after calling synchronize_rcu(). +	 * This is needed to avoid races between wake_up_pollfree() above and +	 * someone else removing the last entry from the queue for other reasons +	 * (e.g. ep_remove_wait_queue() being called due to an epoll file +	 * descriptor being closed).  Such other users hold an RCU read lock, so +	 * we can be sure they're done after we call synchronize_rcu().  	 */  	if (thread->looper & BINDER_LOOPER_STATE_POLL)  		synchronize_rcu(); |