From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.6 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B713DC0650E for ; Wed, 3 Jul 2019 18:46:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7093A21852 for ; Wed, 3 Jul 2019 18:46:36 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="pGPO5o/p" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727004AbfGCSqf (ORCPT ); Wed, 3 Jul 2019 14:46:35 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:41406 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726430AbfGCSqe (ORCPT ); Wed, 3 Jul 2019 14:46:34 -0400 Received: by mail-lj1-f196.google.com with SMTP id 205so3559797ljj.8 for ; Wed, 03 Jul 2019 11:46:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vCIUPeCCEF+OLz7w98udyRcP/O/Khzz7h89sR5YZeg4=; b=pGPO5o/p8zY1Oc4aPFzsn/Mool+es6Sl/wsHeKtG+4T7hctg/2z6k2jLIpWXJjSMD9 7mhnhoZiyom+kOicmb3t+F5QcYtVN4qZr/S1G9PUhNtT9UL3MHWcf0OFmpKDMqnSicg0 A7i4opJIwLQBzzpg2lTwrxtwi1Nn6GpdhNh4go8sUJ9tkD4ds+9ojwVootFLPHDdEw2I ZkwBdGLo4wOw9K5+dtPlMTRelWuyWU5X08SdLgpPGAxPslQUmq1zDZUfrTB/uj4Ii517 e0DTGmeARSOMj4gybq+qQ0TRyCHo9Upj8pKw42NAKUCHu/wTHrDryJwJaRXW7jP05Em/ yt2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vCIUPeCCEF+OLz7w98udyRcP/O/Khzz7h89sR5YZeg4=; b=Cdqo6genagVRNlQeQLLzyqWJD0ueZnussn4RuGkokzvoKAyakOwauBg+tkjjL9L2hP pp7kzdjlRGknTpM6TgkZ5ICabxpkSQArasPMgEdejFdMjN0SX0ZRn1kV6o/6Ff3tTh/1 IR6pGUANJEljVwE7DGO116ivTW0NJ+6NgnipqOZPyJRZFNFcnBuz3yFpVvjv3GpTSISn IwBhV1jHRU355OeyYON3Z/FfmqXugztQPR00VAv6kzvxGT4Gynums4iX1JKE9zu6pn2G MCbmRPl4jEZp/ZaWTxc2Wp0fvaxmE40QTeHdz8Tme1WkCuCwTRSqhAJY3s0ZjSgnGcmn nbnQ== X-Gm-Message-State: APjAAAUjGfNHcaikv6ZgQ/JJ6S43MHk9BMkwcwMhGXylY7dYQJ815EvT 8h4D7J8ZLs/D1p6+IcATwdjg/0PL/UrYDUZe6jwg9w== X-Google-Smtp-Source: APXvYqwiem5/n4z8d4zc+GCZEWpVW1sd4VnYulWvpXNjCar1izXohWHI0hwu9Cczfd1wDW2xf9ddEgTiPFBZQtzl+o4= X-Received: by 2002:a2e:98d7:: with SMTP id s23mr11048254ljj.179.1562179591897; Wed, 03 Jul 2019 11:46:31 -0700 (PDT) MIME-Version: 1.0 References: <20190703050229.GC633@sol.localdomain> In-Reply-To: <20190703050229.GC633@sol.localdomain> From: Todd Kjos Date: Wed, 3 Jul 2019 11:46:20 -0700 Message-ID: Subject: Re: Reminder: 3 open syzbot bugs in "android/binder" subsystem To: Eric Biggers Cc: "open list:ANDROID DRIVERS" , Greg Kroah-Hartman , =?UTF-8?B?QXJ2ZSBIasO4bm5ldsOlZw==?= , Todd Kjos , Martijn Coenen , Joel Fernandes , Christian Brauner , LKML , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jul 2, 2019 at 10:03 PM Eric Biggers wrote: > > [This email was generated by a script. Let me know if you have any suggestions > to make it better, or if you want it re-generated with the latest status.] > > Of the currently open syzbot reports against the upstream kernel, I've manually > marked 3 of them as possibly being bugs in the "android/binder" subsystem. I've > listed these reports below, sorted by an algorithm that tries to list first the > reports most likely to be still valid, important, and actionable. > > Of these 3 bugs, 1 was seen in mainline in the last week. > > Of these 3 bugs, 1 was bisected to a commit from the following person: > > Todd Kjos > > If you believe a bug is no longer valid, please close the syzbot report by > sending a '#syz fix', '#syz dup', or '#syz invalid' command in reply to the > original thread, as explained at https://goo.gl/tpsmEJ#status > > If you believe I misattributed a bug to the "android/binder" subsystem, please > let me know, and if possible forward the report to the correct people or mailing > list. > > Here are the bugs: > > -------------------------------------------------------------------------------- > Title: kernel BUG at drivers/android/binder_alloc.c:LINE! (4) > Last occurred: 6 days ago > Reported: 14 days ago > Branches: Mainline and others > Dashboard link: https://syzkaller.appspot.com/bug?id=bbf40136a49ffaa8ac60906edcbe77f825b2c406 > Original thread: https://lkml.kernel.org/lkml/000000000000b6b25b058b96d5c3@google.com/T/#u > > This bug has a C reproducer. > > This bug was bisected to: > > commit bde4a19fc04f5f46298c86b1acb7a4af1d5f138d > Author: Todd Kjos > Date: Fri Feb 8 18:35:20 2019 +0000 > > binder: use userspace pointer as base of buffer space > > The original thread for this bug has received 3 replies; the last was 4 days > ago. Fix posted: https://lore.kernel.org/lkml/20190628165012.4841-1-tkjos@google.com/ > > If you fix this bug, please add the following tag to the commit: > Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com > > If you send any email or patch for this bug, please reply to the original > thread, which had activity only 4 days ago. For the git send-email command to > use, or tips on how to reply if the thread isn't in your mailbox, see the "Reply > instructions" at https://lkml.kernel.org/r/000000000000b6b25b058b96d5c3@google.com > > -------------------------------------------------------------------------------- > Title: WARNING in binder_transaction_buffer_release > Last occurred: 0 days ago > Reported: 43 days ago > Branches: Mainline and others > Dashboard link: https://syzkaller.appspot.com/bug?id=4e0a6a529aef923a8d61c5d20b8fc0605c730138 > Original thread: https://lkml.kernel.org/lkml/000000000000afe2c70589526668@google.com/T/#u Assigned to Hridya Valsaraju (b/134585943) > > This bug has a syzkaller reproducer only. > > The original thread for this bug has received 2 replies; the last was 20 days > ago. > > If you fix this bug, please add the following tag to the commit: > Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com > > If you send any email or patch for this bug, please consider replying to the > original thread. For the git send-email command to use, or tips on how to reply > if the thread isn't in your mailbox, see the "Reply instructions" at > https://lkml.kernel.org/r/000000000000afe2c70589526668@google.com > > -------------------------------------------------------------------------------- > Title: possible deadlock in uprobe_clear_state > Last occurred: 165 days ago > Reported: 202 days ago > Branches: Mainline > Dashboard link: https://syzkaller.appspot.com/bug?id=a1ce9b3da349209c5085bb8c4fee753d68c3697f > Original thread: https://lkml.kernel.org/lkml/00000000000010a9fb057cd14174@google.com/T/#u > > Unfortunately, this bug does not have a reproducer. > > [Note: the uprobe developers think this is a bug in binder, not uprobes. > See https://marc.info/?l=linux-kernel&m=155119805728815&w=2 > for a suggested fix for this bug.] Just learned about this, but looks like a straightforward fix. > > If you fix this bug, please add the following tag to the commit: > Reported-by: syzbot+1068f09c44d151250c33@syzkaller.appspotmail.com > > If you send any email or patch for this bug, please consider replying to the > original thread. For the git send-email command to use, or tips on how to reply > if the thread isn't in your mailbox, see the "Reply instructions" at > https://lkml.kernel.org/r/00000000000010a9fb057cd14174@google.com >