linux-kernel - Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z5JzA2OMokMz4Mic@google.com>
Date: Thu, 23 Jan 2025 16:49:07 +0000
From: Carlos Llamas <cmllamas@...gle.com>
To: Aleksandr Nogikh <nogikh@...gle.com>
Cc: syzbot <syzbot+7015dcf45953112c8b45@...kaller.appspotmail.com>,
	Li Li <dualli@...gle.com>, arve@...roid.com, brauner@...nel.org,
	gregkh@...uxfoundation.org, joel@...lfernandes.org,
	linux-kernel@...r.kernel.org, linux-next@...r.kernel.org,
	maco@...roid.com, sfr@...b.auug.org.au, surenb@...gle.com,
	syzkaller-bugs@...glegroups.com, tkjos@...roid.com
Subject: Re: [syzbot] [kernel?] linux-next test error: KASAN:
 slab-use-after-free Write in binder_add_device

On Thu, Jan 23, 2025 at 01:32:29PM +0100, Aleksandr Nogikh wrote:
> The problem began to appear after:
> 
> commit 12d909cac1e1c4147cc3417fee804ee12fc6b984
> Author: Li Li <dualli@...gle.com>
> Date:   Wed Dec 18 13:29:34 2024 -0800
> 
>     binderfs: add new binder devices to binder_devices
> 

Correct. I tried to mark this commit with a #syz blame or something but
I couldn't find anything. The problem here is we add binderfs devices to
the binder_devices list but we don't remove them when these are kfreed
e.g. during umount.

This is then fairly easy to reproduce, something like:
  $ mount -t binder binder /dev/binderfs
  $ umount /dev/binderfs
  $ mount -t binder binder /dev/binderfs

It should be a simply fix. I'll send a patch later today.

Thanks,
--
Carlos Llamas