From: Eric Biggers <ebiggers3@gmail.com>
To: syzbot
<bot+f2a32269c7d88a3653ef36f3d516f19ece83fdb5@syzkaller.appspotmail.com>
Cc: dan.carpenter@oracle.com, gregkh@linuxfoundation.org,
hdegoede@redhat.com, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, mateuszb@fastmail.fm,
mingo@kernel.org, mingo@redhat.com, peterz@infradead.org,
stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com,
viro@zeniv.linux.org.uk, vskrishn@codeaurora.org,
yamada.masahiro@socionext.com
Subject: Re: KASAN: use-after-free Read in __lock_acquire (2)
Date: Tue, 12 Dec 2017 16:04:04 -0800 [thread overview]
Message-ID: <20171213000404.GA62138@gmail.com> (raw)
In-Reply-To: <001a1149750a83b8db055f5db0d2@google.com>
On Sat, Dec 02, 2017 at 08:08:01AM -0800, syzbot wrote:
> Allocated by task 3086:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:447
> set_track mm/kasan/kasan.c:459 [inline]
> kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
> kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3613
> kmalloc include/linux/slab.h:499 [inline]
> kzalloc include/linux/slab.h:688 [inline]
> binder_get_thread+0x1cf/0x870 drivers/android/binder.c:4184
> binder_poll+0x8c/0x390 drivers/android/binder.c:4286
> ep_item_poll.isra.10+0xec/0x320 fs/eventpoll.c:884
> ep_insert+0x6a3/0x1b10 fs/eventpoll.c:1455
> SYSC_epoll_ctl fs/eventpoll.c:2106 [inline]
> SyS_epoll_ctl+0x12e4/0x1ab0 fs/eventpoll.c:1992
> do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
> do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
> entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125
>
> Freed by task 3086:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:447
> set_track mm/kasan/kasan.c:459 [inline]
> kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
> __cache_free mm/slab.c:3491 [inline]
> kfree+0xca/0x250 mm/slab.c:3806
> binder_free_thread drivers/android/binder.c:4211 [inline]
> binder_thread_dec_tmpref+0x27f/0x310 drivers/android/binder.c:1808
> binder_thread_release+0x27d/0x540 drivers/android/binder.c:4275
> binder_ioctl+0xc05/0x141a drivers/android/binder.c:4492
> C_SYSC_ioctl fs/compat_ioctl.c:1473 [inline]
> compat_SyS_ioctl+0x151/0x2a30 fs/compat_ioctl.c:1419
> do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
> do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
> entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125
>
This is a bug in the "binder" driver: binder_poll() tells the poll system to use
a waitqueue which can be freed before the file is closed. I'll send this to the
binder maintainers and take lockdep maintainers, USB maintainers, etc. off Cc.
Eric
next prev parent reply other threads:[~2017-12-13 0:04 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <001a1147c73265e0a2055e43711e@google.com>
2017-12-02 16:08 ` KASAN: use-after-free Read in __lock_acquire (2) syzbot
2017-12-13 0:04 ` Eric Biggers [this message]
2017-12-13 0:05 ` binder epoll bug (was KASAN: use-after-free Read in __lock_acquire (2)) Eric Biggers
2018-01-30 21:07 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171213000404.GA62138@gmail.com \
--to=ebiggers3@gmail.com \
--cc=bot+f2a32269c7d88a3653ef36f3d516f19ece83fdb5@syzkaller.appspotmail.com \
--cc=dan.carpenter@oracle.com \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mateuszb@fastmail.fm \
--cc=mingo@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
--cc=vskrishn@codeaurora.org \
--cc=yamada.masahiro@socionext.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.