[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240713132101.1009-1-hdanton@sina.com>
Date: Sat, 13 Jul 2024 21:21:01 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+3dae065ca76952a67257@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [kernel?] kernel BUG in binder_inc_ref_for_node
On Sat, 13 Jul 2024 03:25:20 -0700
> syzbot found the following issue on:
>
> HEAD commit: 82d01fe6ee52 Add linux-next specific files for 20240709
> git tree: linux-next
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16a4869e980000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 82d01fe6ee52
--- x/drivers/android/binder.c
+++ y/drivers/android/binder.c
@@ -1131,6 +1131,7 @@ static struct binder_ref *binder_get_ref
struct binder_ref *ref;
struct rb_node *parent;
struct rb_node **p;
+ struct rb_node **p0, *pa0;
u32 desc;
retry:
@@ -1147,6 +1148,8 @@ retry:
else
return ref;
}
+ p0 = p;
+ pa0 = parent;
if (!new_ref)
return NULL;
@@ -1158,11 +1161,10 @@ retry:
new_ref->data.debug_id = atomic_inc_return(&binder_last_id);
new_ref->proc = proc;
new_ref->node = node;
- rb_link_node(&new_ref->rb_node_node, parent, p);
- rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
new_ref->data.desc = desc;
p = &proc->refs_by_desc.rb_node;
+ parent = NULL;
while (*p) {
parent = *p;
ref = rb_entry(parent, struct binder_ref, rb_node_desc);
@@ -1172,11 +1174,14 @@ retry:
else if (new_ref->data.desc > ref->data.desc)
p = &(*p)->rb_right;
else
- BUG();
+ return ref;
}
rb_link_node(&new_ref->rb_node_desc, parent, p);
rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
+ rb_link_node(&new_ref->rb_node_node, pa0, p0);
+ rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
+
binder_node_lock(node);
hlist_add_head(&new_ref->node_entry, &node->refs);
--
Powered by blists - more mailing lists