Re: [PATCH v2 1/3] binder: handle PID namespace conversion for freeze operation

[Alice Ryhl]

On Thu, Jan 29, 2026 at 05:41:17PM +0900, jongan.kim@xxxxxxx wrote:
> From: JongAn Kim <jongan.kim@xxxxxxx>
> 
> Currently, when a freeze is attempted from a non-init PID namespace,
> there is a possibility that the wrong process in the init namespace
> may be frozen due to PID collision across namespaces.
> 
> For example, if a container with PID namespace has a process with
> PID 100 (which maps to PID 5000 in init namespace), attempting to
> freeze PID 100 from the container could incorrectly match a different
> process with PID 100 in the init namespace.
> 
> This patch fixes the issue by:
> 1. Converting the caller's PID from their namespace to init namespace
> 2. Matching against binder_proc->pid (which stores init namespace TGID)
> 3. Returning -EINVAL for invalid PIDs and -ESRCH for not-found processes
> 
> This change ensures correct PID handling when binder freeze occurs in
> non-init PID namespace.
> 
> Signed-off-by: JongAn Kim <jongan.kim@xxxxxxx>

> +	rcu_read_lock();
> +	task = pid_task(find_vpid(pid), PIDTYPE_PID);
> +	init_ns_pid = task ? task_tgid_nr_ns(task, &init_pid_ns) : -ESRCH;

You know this is making me think ... here we are obtaining a pointer to
the `struct task_struct`, then we convert it to a pid, and we compare
with the pid of the binder_proc's task.

Why not just outright compare the `struct task_struct` pointers?

Alice