From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8AAD21EF36B for ; Wed, 28 May 2025 02:31:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748399486; cv=none; b=N3pVj/eMRd7SSK/pXl9M8J58PogheM0JDrrI99uqN+FvqC0waQLYxyaO6Gmo1waprRq1DxPbUVeKK8rBFfue0539TM4NwUQ3QDFSPJEbXLyfTxkzCODkO4JlncRWu1gfaIzrsKVo74Yj+NB7OF85hPFuXophf7HMdcvCsMFw+mY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748399486; c=relaxed/simple; bh=/HzPKugMmaCRrhBJ4YFkeZUX/9qBlQMp0yGEzMrprqI=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=KrQ84UvYww2J3Iv6vytIxh8pkSFtSYqgNpXOTA96wVM/b70gLDS4mnLE4z8/toR7S4unExGjPZn0BPHBivtjWdLlw3DKtYcypeDoO74sx2t5SoaQsvAxwUSVZoIv0MYCRN8St9kKBJLpuDKXQLaGmCD0qqyvay/uwRMZZspXkDE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=TtOvO5v8; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="TtOvO5v8" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-234b440afa7so8534655ad.0 for ; Tue, 27 May 2025 19:31:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1748399483; x=1749004283; darn=vger.kernel.org; h=mime-version:message-id:date:user-agent:references:in-reply-to :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to; bh=BQRgW2zDMDyRpGcNs2f/hIRhslp675QORwh/naIQme4=; b=TtOvO5v8XKmaO+o/YTUpcwQPtoqN2dyq2dO9J6x8fsXr8azbIRrfIBP2GiDDrXp9r0 k/Lhm5ibKeRtHzkboUeRk+el23rSQcBBWWlwrEmvMzsUfGCbRksUpQZUBfVToeyudNnq 1w5CZoEa+JakijWe/RUOyaKaj0/0jJtkKiSUEXLM3JW7E7rn4zX7X2yJQHDA311CGyxc k5Vod8L53TdBYJnHy12roaMiRDoMRpOtGvTGuVBK49mQqS3UMDVJhTcoHcPXUPcSuQaw qPmlQSv2o0Z9GywslycIWK/MQlqP4klNwiFmJIi81l/yjWDBn3peZRwgJ9mZ9GKeP3Gz LbBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1748399483; x=1749004283; h=mime-version:message-id:date:user-agent:references:in-reply-to :subject:cc:to:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=BQRgW2zDMDyRpGcNs2f/hIRhslp675QORwh/naIQme4=; b=HcjPwjuaz4l85a+L/P5oWuwx5Q/VW8HAbdbxtZi+9Pa1YWHy54qbCfiyY91D/c2MaY gAkmJ1IZZ+O5c40A/yizTyg1AtEE4J8LpyDuZ46Uj2FT07rk8RYf8+3dge6joYSbKbm1 xMBlBWwgyjt9pL5Fpxc7WJNY1r7JQ/9wjDepHckmxVtB5XnsD/HBupnhLRhAPhx6iee3 DF7Iqy05AzOvHw5zCkb5aL/1DMJc+oAkfd82q7mJkMR5zSzVEvDStzB4mQ3uPuORTzEQ +3B6IErTVaa4jZw9FObnNdEsPzwMcElg/gknPToyrt9Yb+5kOLjvF26RQ6SfuLFGjAC5 H0mw== X-Forwarded-Encrypted: i=1; AJvYcCVyLpUTDbfHAOxSnNMoAZinotReKdM7bjPVNiTMiq/qaueXMx+PAtEsf/nEoiKNS0wW0b+W2VGapvHL0X4=@vger.kernel.org X-Gm-Message-State: AOJu0Yyu1PyaqSoMia1qJ6cfSLjeWfHikxSZMS7ecPUyp/j1djBVbwbw q5cGMMgA2NDivLDvA5tgwd94Xkw8vZmPfc0QdP8m0yesrRxN5lvfPSDVEpLr3T83ctoIl+yuhgC CCO1AUHDf X-Gm-Gg: ASbGncvC+WnGAhodjQkupoUlUB8Ja5N9zQtNgeIH3IxaVqwPAMfBXrCG8nPoHl+IAAV q6P/j9NmnmLUlXDPJVMyRnL5ysac/fGYNIDXaC7gVL934bjlEQ5C8iJB6f69sW04yjPBSILEfy4 /15AnbVZX0CSBzcVbdbLaz15DYhM1XiHJUqOQgVbvDel4oo82Zwt6zvlvoKcDrBYSLZ8kfNFdfT LSMTacekxYtJAP8hdJilj8t/niewH6iE4yf5/pDPxVCvGKl+vYh4TLldAUduhTiXWjMRM46p7wL WDLkAYXdXKka4wJvP+d/zfM6p6MM2+LHCdtJGxPY4Hzp+obW9Z9+WadWbf5kDq/IA/QaCBD5ALT 6TQnaIL3qIrZbRKdyaPBcK7QgwdzLZS5rFqJDg0E4HVOCBa+3 X-Google-Smtp-Source: AGHT+IE52Y2joor7wjefGN/rIOi1GNEnRj6y0peHvF6A3p0ZaVNxrYsUFOHwWucOb5D5xtlgH28nxQ== X-Received: by 2002:a17:903:41cc:b0:22e:b215:1b6 with SMTP id d9443c01a7336-23414fc0524mr198873785ad.28.1748399483313; Tue, 27 May 2025 19:31:23 -0700 (PDT) Received: from ynaffit-andsys.c.googlers.com (163.192.16.34.bc.googleusercontent.com. [34.16.192.163]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-234d2fe204asm1343745ad.80.2025.05.27.19.31.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 May 2025 19:31:22 -0700 (PDT) From: Tiffany Yang To: "'Carlos Llamas' via kernel-team" Cc: Alice Ryhl , Greg Kroah-Hartman , =?utf-8?Q?Arve_Hj=C3=B8nnev=C3=A5g?= , Todd Kjos , Martijn Coenen , Joel Fernandes , Christian Brauner , Carlos Llamas , Suren Baghdasaryan , Li Li , stable@vger.kernel.org, syzbot+4af454407ec393de51d6@syzkaller.appspotmail.com, "open list:ANDROID DRIVERS" Subject: Re: [PATCH] binder: fix yet another UAF in binder_devices In-Reply-To: <20250524220758.915028-1-cmllamas@google.com> (via kernel-team's message of "Sat, 24 May 2025 22:07:58 +0000") References: <20250524220758.915028-1-cmllamas@google.com> User-Agent: mu4e 1.12.8; emacs 30.1 Date: Wed, 28 May 2025 02:31:21 +0000 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain "'Carlos Llamas' via kernel-team" writes: > Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") > addressed a use-after-free where devices could be released without first > being removed from the binder_devices list. However, there is a similar > path in binder_free_proc() that was missed: > > ================================================================== > BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100 > Write of size 8 at addr ffff0000c773b900 by task umount/467 > CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT > Hardware name: linux,dummy-virt (DT) > Call trace: > binder_remove_device+0xd4/0x100 > binderfs_evict_inode+0x230/0x2f0 > evict+0x25c/0x5dc > iput+0x304/0x480 > dentry_unlink_inode+0x208/0x46c > __dentry_kill+0x154/0x530 > [...] > > Allocated by task 463: > __kmalloc_cache_noprof+0x13c/0x324 > binderfs_binder_device_create.isra.0+0x138/0xa60 > binder_ctl_ioctl+0x1ac/0x230 > [...] > > Freed by task 215: > kfree+0x184/0x31c > binder_proc_dec_tmpref+0x33c/0x4ac > binder_deferred_func+0xc10/0x1108 > process_one_work+0x520/0xba4 > [...] > ================================================================== > > Call binder_remove_device() within binder_free_proc() to ensure the > device is removed from the binder_devices list before being kfreed. > > Cc: stable@vger.kernel.org > Fixes: 12d909cac1e1 ("binderfs: add new binder devices to binder_devices") > Reported-by: syzbot+4af454407ec393de51d6@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=4af454407ec393de51d6 > Tested-by: syzbot+4af454407ec393de51d6@syzkaller.appspotmail.com > Signed-off-by: Carlos Llamas > --- > drivers/android/binder.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index 682bbe4ad550..c463ca4a8fff 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -5241,6 +5241,7 @@ static void binder_free_proc(struct binder_proc *proc) > __func__, proc->outstanding_txns); > device = container_of(proc->context, struct binder_device, context); > if (refcount_dec_and_test(&device->ref)) { > + binder_remove_device(device); > kfree(proc->context->name); > kfree(device); > } Reviewed-by: Tiffany Yang -- Tiffany Y. Yang