From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Sasha Levin <sashal@kernel.org>
Cc: Carlos Llamas <cmllamas@google.com>,
stable@vger.kernel.org,
syzbot+7f10c1653e35933c0f1e@syzkaller.appspotmail.com,
Alice Ryhl <aliceryhl@google.com>, Todd Kjos <tkjos@google.com>
Subject: Re: [PATCH 6.1] binder: fix memory leaks of spam and pending work
Date: Sat, 9 Dec 2023 12:41:59 +0100 [thread overview]
Message-ID: <2023120940-quotation-reenter-bf58@gregkh> (raw)
In-Reply-To: <ZXQSnm8Ye5IYzniU@sashalap>
On Sat, Dec 09, 2023 at 02:09:18AM -0500, Sasha Levin wrote:
> On Fri, Dec 08, 2023 at 03:49:23AM +0000, Carlos Llamas wrote:
> > commit 1aa3aaf8953c84bad398adf6c3cabc9d6685bf7d upstream
> >
> > A transaction complete work is allocated and queued for each
> > transaction. Under certain conditions the work->type might be marked as
> > BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT to notify userspace about
> > potential spamming threads or as BINDER_WORK_TRANSACTION_PENDING when
> > the target is currently frozen.
> >
> > However, these work types are not being handled in binder_release_work()
> > so they will leak during a cleanup. This was reported by syzkaller with
> > the following kmemleak dump:
> >
> > BUG: memory leak
> > unreferenced object 0xffff88810e2d6de0 (size 32):
> > comm "syz-executor338", pid 5046, jiffies 4294968230 (age 13.590s)
> > hex dump (first 32 bytes):
> > e0 6d 2d 0e 81 88 ff ff e0 6d 2d 0e 81 88 ff ff .m-......m-.....
> > 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > backtrace:
> > [<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
> > [<ffffffff83d41873>] kmalloc include/linux/slab.h:599 [inline]
> > [<ffffffff83d41873>] kzalloc include/linux/slab.h:720 [inline]
> > [<ffffffff83d41873>] binder_transaction+0x573/0x4050 drivers/android/binder.c:3152
> > [<ffffffff83d45a05>] binder_thread_write+0x6b5/0x1860 drivers/android/binder.c:4010
> > [<ffffffff83d486dc>] binder_ioctl_write_read drivers/android/binder.c:5066 [inline]
> > [<ffffffff83d486dc>] binder_ioctl+0x1b2c/0x3cf0 drivers/android/binder.c:5352
> > [<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
> > [<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
> > [<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
> > [<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
> > [<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > [<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
> > [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >
> > Fix the leaks by kfreeing these work types in binder_release_work() and
> > handle them as a BINDER_WORK_TRANSACTION_COMPLETE cleanup.
> >
> > Cc: stable@vger.kernel.org
> > Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
> > Reported-by: syzbot+7f10c1653e35933c0f1e@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=7f10c1653e35933c0f1e
> > Suggested-by: Alice Ryhl <aliceryhl@google.com>
> > Signed-off-by: Carlos Llamas <cmllamas@google.com>
> > Reviewed-by: Alice Ryhl <aliceryhl@google.com>
> > Acked-by: Todd Kjos <tkjos@google.com>
> > Link: https://lore.kernel.org/r/20230922175138.230331-1-cmllamas@google.com
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > [cmllamas: backport to v6.1 by dropping BINDER_WORK_TRANSACTION_PENDING
> > as commit 0567461a7a6e is not present. Remove fixes tag accordingly.]
>
> Queued up, thanks!
Did you not push this out? I don't see this in the queue at the moment.
thanks,
greg k-h
prev parent reply other threads:[~2023-12-09 11:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-08 3:49 [PATCH 6.1] binder: fix memory leaks of spam and pending work Carlos Llamas
2023-12-09 7:09 ` Sasha Levin
2023-12-09 11:41 ` Greg Kroah-Hartman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2023120940-quotation-reenter-bf58@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=aliceryhl@google.com \
--cc=cmllamas@google.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+7f10c1653e35933c0f1e@syzkaller.appspotmail.com \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.