linux-kernel - Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z5KTGg7KXfBhHJZA@google.com>
Date: Thu, 23 Jan 2025 19:06:02 +0000
From: Carlos Llamas <cmllamas@...gle.com>
To: syzbot <syzbot+7015dcf45953112c8b45@...kaller.appspotmail.com>
Cc: arve@...roid.com, brauner@...nel.org, gregkh@...uxfoundation.org,
	joel@...lfernandes.org, linux-kernel@...r.kernel.org,
	linux-next@...r.kernel.org, maco@...roid.com, sfr@...b.auug.org.au,
	surenb@...gle.com, syzkaller-bugs@...glegroups.com,
	tkjos@...roid.com
Subject: Re: [syzbot] [kernel?] linux-next test error: KASAN:
 slab-use-after-free Write in binder_add_device

On Thu, Jan 16, 2025 at 03:08:19AM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b323d8e7bc03 Add linux-next specific files for 20250116
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=139dc9df980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=76ebc49148908d34
> dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/a529f1184b45/disk-b323d8e7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/08db885c938e/vmlinux-b323d8e7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2ff92778e2b7/bzImage-b323d8e7.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+7015dcf45953112c8b45@...kaller.appspotmail.com

#syz test

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index bc6bae76ccaf..94c6446604fc 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -274,6 +274,7 @@ static void binderfs_evict_inode(struct inode *inode)
 	mutex_unlock(&binderfs_minors_mutex);
 
 	if (refcount_dec_and_test(&device->ref)) {
+		hlist_del_init(&device->hlist);
 		kfree(device->context.name);
 		kfree(device);
 	}