linux-kernel - Re: KASAN: use-after-free Read in binder_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Apr 2018 11:28:27 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Martijn Coenen <maco@...roid.com>
Cc:     Eric Biggers <ebiggers3@...il.com>,
        Arve Hjønnevåg <arve@...roid.com>,
        "open list:ANDROID DRIVERS" <devel@...verdev.osuosl.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Todd Kjos <tkjos@...roid.com>,
        syzbot <syzbot+0cf1f1aa154f56ff2e8d@...kaller.appspotmail.com>
Subject: Re: KASAN: use-after-free Read in binder_release_work

On Mon, Apr 23, 2018 at 11:18 AM, Martijn Coenen <maco@...roid.com> wrote:
> On Thu, Apr 19, 2018 at 11:35 PM, Eric Biggers <ebiggers3@...il.com> wrote:
>> Martijn, this is going to be fixed by
>> https://patchwork.kernel.org/patch/10312345/
>> ("ANDROID: binder: prevent transactions into own process"), right?
>> The syzbot bug ID in that patch is for a bug that is already closed,
>> so if it's not too late you should use this one.
>
> Yeah that should fix it. Why was it closed? I think the syzbot bug ID
> I used in that patch was from the original report to LKML. Greg
> mentioned the patch was already in his queue.

Hi Martijn,

In short: too many bugs in kernel + long turnaround time for fixes.
Originally it was detected as "KASAN: use-after-free Read in
__list_del_entry_valid (3)":
https://syzkaller.appspot.com/bug?extid=09e05aba06723a94d43d
and that happened in binder. But then syzkaller found a reproducer for
it, but it turned out to be in rdma subsystem. It's generally not
possible to properly distinguish different bugs that look similar, and
if syzbot does more sensitive bug classification, then it will also
inevitably report more duplicates. So that bug was closed as an rdma
bug.
Now syzbot already skips list_del frame and takes the next one, so it
should become slightly better.

Let's close this one with the binder fix (since that one was closed
with an rdma fix):

#syz fix: ANDROID: binder: prevent transactions into own process.