On Mon, Apr 23, 2018 at 11:18 AM, Martijn Coenen <maco@xxxxxxxxxxx> wrote: > On Thu, Apr 19, 2018 at 11:35 PM, Eric Biggers <ebiggers3@xxxxxxxxx> wrote: >> Martijn, this is going to be fixed by >> https://patchwork.kernel.org/patch/10312345/ >> ("ANDROID: binder: prevent transactions into own process"), right? >> The syzbot bug ID in that patch is for a bug that is already closed, >> so if it's not too late you should use this one. > > Yeah that should fix it. Why was it closed? I think the syzbot bug ID > I used in that patch was from the original report to LKML. Greg > mentioned the patch was already in his queue. Hi Martijn, In short: too many bugs in kernel + long turnaround time for fixes. Originally it was detected as "KASAN: use-after-free Read in __list_del_entry_valid (3)": https://syzkaller.appspot.com/bug?extid=09e05aba06723a94d43d and that happened in binder. But then syzkaller found a reproducer for it, but it turned out to be in rdma subsystem. It's generally not possible to properly distinguish different bugs that look similar, and if syzbot does more sensitive bug classification, then it will also inevitably report more duplicates. So that bug was closed as an rdma bug. Now syzbot already skips list_del frame and takes the next one, so it should become slightly better. Let's close this one with the binder fix (since that one was closed with an rdma fix): #syz fix: ANDROID: binder: prevent transactions into own process. _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
