Re: KASAN: use-after-free Read in binder_release_work

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Apr 23, 2018 at 11:18 AM, Martijn Coenen <maco@xxxxxxxxxxx> wrote:
> On Thu, Apr 19, 2018 at 11:35 PM, Eric Biggers <ebiggers3@xxxxxxxxx> wrote:
>> Martijn, this is going to be fixed by
>> https://patchwork.kernel.org/patch/10312345/
>> ("ANDROID: binder: prevent transactions into own process"), right?
>> The syzbot bug ID in that patch is for a bug that is already closed,
>> so if it's not too late you should use this one.
>
> Yeah that should fix it. Why was it closed? I think the syzbot bug ID
> I used in that patch was from the original report to LKML. Greg
> mentioned the patch was already in his queue.

Hi Martijn,

In short: too many bugs in kernel + long turnaround time for fixes.
Originally it was detected as "KASAN: use-after-free Read in
__list_del_entry_valid (3)":
https://syzkaller.appspot.com/bug?extid=09e05aba06723a94d43d
and that happened in binder. But then syzkaller found a reproducer for
it, but it turned out to be in rdma subsystem. It's generally not
possible to properly distinguish different bugs that look similar, and
if syzbot does more sensitive bug classification, then it will also
inevitably report more duplicates. So that bug was closed as an rdma
bug.
Now syzbot already skips list_del frame and takes the next one, so it
should become slightly better.

Let's close this one with the binder fix (since that one was closed
with an rdma fix):

#syz fix: ANDROID: binder: prevent transactions into own process.
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel



[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux