[syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    b323d8e7bc03 Add linux-next specific files for 20250116
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=139dc9df980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=76ebc49148908d34
dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a529f1184b45/disk-b323d8e7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/08db885c938e/vmlinux-b323d8e7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2ff92778e2b7/bzImage-b323d8e7.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1026 [inline]
BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932
Write of size 8 at addr ffff888141fb9408 by task syz-executor/6310

CPU: 0 UID: 0 PID: 6310 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250116-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 hlist_add_head include/linux/list.h:1026 [inline]
 binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932
 binderfs_binder_device_create+0x7bf/0x9c0 drivers/android/binderfs.c:210
 binderfs_fill_super+0x944/0xd90 drivers/android/binderfs.c:729
 vfs_get_super fs/super.c:1280 [inline]
 get_tree_nodev+0xb7/0x140 fs/super.c:1299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f909d3874ca
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe0c3c1d18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f909d401ecb RCX: 00007f909d3874ca
RDX: 00007f909d40ec27 RSI: 00007f909d401ecb RDI: 00007f909d40ec27
RBP: 00007f909d4020c3 R08: 0000000000000000 R09: 00000000000001ff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f909d3e41c8
R13: 00007f909d3e41a8 R14: 0000000000000009 R15: 0000000000000000
 </TASK>

Allocated by task 5832:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4325
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 binderfs_binder_device_create+0x16c/0x9c0 drivers/android/binderfs.c:147
 binderfs_fill_super+0x944/0xd90 drivers/android/binderfs.c:729
 vfs_get_super fs/super.c:1280 [inline]
 get_tree_nodev+0xb7/0x140 fs/super.c:1299
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3560
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5832:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kfree+0x196/0x430 mm/slub.c:4757
 evict+0x4e8/0x9a0 fs/inode.c:796
 __dentry_kill+0x20d/0x630 fs/dcache.c:625
 shrink_kill+0xa9/0x2c0 fs/dcache.c:1070
 shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1097
 shrink_dcache_parent+0xcb/0x3b0
 do_one_tree+0x23/0xe0 fs/dcache.c:1560
 shrink_dcache_for_umount+0xb4/0x180 fs/dcache.c:1577
 generic_shutdown_super+0x6a/0x2d0 fs/super.c:620
 kill_anon_super fs/super.c:1237 [inline]
 kill_litter_super+0x76/0xb0 fs/super.c:1247
 binderfs_kill_super+0x44/0x90 drivers/android/binderfs.c:791
 deactivate_locked_super+0xc4/0x130 fs/super.c:473
 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1413
 task_work_run+0x24f/0x310 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xa2a/0x28e0 kernel/exit.c:938
 do_group_exit+0x207/0x2c0 kernel/exit.c:1087
 get_signal+0x16b2/0x1750 kernel/signal.c:3036
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888141fb9400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 8 bytes inside of
 freed 512-byte region [ffff888141fb9400, ffff888141fb9600)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888141fba800 pfn:0x141fb8
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000240 ffff88801ac41c80 ffffea0005337a10 ffffea0005345c10
raw: ffff888141fba800 000000000010000f 00000000f5000000 0000000000000000
head: 057ff00000000240 ffff88801ac41c80 ffffea0005337a10 ffffea0005345c10
head: ffff888141fba800 000000000010000f 00000000f5000000 0000000000000000
head: 057ff00000000002 ffffea000507ee01 ffffffffffffffff 0000000000000000
head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6801495950, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab+0x8f/0x3a0 mm/slub.c:2587
 new_slab mm/slub.c:2640 [inline]
 ___slab_alloc+0xc27/0x14a0 mm/slub.c:3826
 __slab_alloc+0x58/0xa0 mm/slub.c:3916
 __slab_alloc_node mm/slub.c:3991 [inline]
 slab_alloc_node mm/slub.c:4152 [inline]
 __kmalloc_cache_noprof+0x27b/0x390 mm/slub.c:4320
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 device_private_init drivers/base/core.c:3510 [inline]
 device_add+0xc1/0xbf0 drivers/base/core.c:3561
 device_create_groups_vargs drivers/base/core.c:4347 [inline]
 device_create+0x257/0x2e0 drivers/base/core.c:4386
 bdi_register_va+0x8b/0x760 mm/backing-dev.c:1094
 bdi_register+0xd5/0x120 mm/backing-dev.c:1126
 add_disk_fwnode+0x759/0xfc0 block/genhd.c:510
 add_disk include/linux/blkdev.h:759 [inline]
 brd_alloc+0x547/0x790 drivers/block/brd.c:401
 brd_init+0x126/0x1b0 drivers/block/brd.c:481
 do_one_initcall+0x248/0x870 init/main.c:1257
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888141fb9300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888141fb9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888141fb9400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888141fb9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888141fb9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Aleksandr Nogikh]

The problem began to appear after:

commit 12d909cac1e1c4147cc3417fee804ee12fc6b984
Author: Li Li <dualli@google.com>
Date:   Wed Dec 18 13:29:34 2024 -0800

    binderfs: add new binder devices to binder_devices

On Thu, Jan 16, 2025 at 12:09 PM syzbot
<syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    b323d8e7bc03 Add linux-next specific files for 20250116
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=139dc9df980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=76ebc49148908d34
> dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/a529f1184b45/disk-b323d8e7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/08db885c938e/vmlinux-b323d8e7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2ff92778e2b7/bzImage-b323d8e7.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1026 [inline]
> BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932
> Write of size 8 at addr ffff888141fb9408 by task syz-executor/6310
>
> CPU: 0 UID: 0 PID: 6310 Comm: syz-executor Not tainted 6.13.0-rc7-next-20250116-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:94 [inline]
>  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
>  print_address_description mm/kasan/report.c:378 [inline]
>  print_report+0x169/0x550 mm/kasan/report.c:489
>  kasan_report+0x143/0x180 mm/kasan/report.c:602
>  hlist_add_head include/linux/list.h:1026 [inline]
>  binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932
>  binderfs_binder_device_create+0x7bf/0x9c0 drivers/android/binderfs.c:210
>  binderfs_fill_super+0x944/0xd90 drivers/android/binderfs.c:729
>  vfs_get_super fs/super.c:1280 [inline]
>  get_tree_nodev+0xb7/0x140 fs/super.c:1299
>  vfs_get_tree+0x90/0x2b0 fs/super.c:1814
>  do_new_mount+0x2be/0xb40 fs/namespace.c:3560
>  do_mount fs/namespace.c:3900 [inline]
>  __do_sys_mount fs/namespace.c:4111 [inline]
>  __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f909d3874ca
> Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffe0c3c1d18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007f909d401ecb RCX: 00007f909d3874ca
> RDX: 00007f909d40ec27 RSI: 00007f909d401ecb RDI: 00007f909d40ec27
> RBP: 00007f909d4020c3 R08: 0000000000000000 R09: 00000000000001ff
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f909d3e41c8
> R13: 00007f909d3e41a8 R14: 0000000000000009 R15: 0000000000000000
>  </TASK>
>
> Allocated by task 5832:
>  kasan_save_stack mm/kasan/common.c:47 [inline]
>  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
>  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
>  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
>  kasan_kmalloc include/linux/kasan.h:260 [inline]
>  __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4325
>  kmalloc_noprof include/linux/slab.h:901 [inline]
>  kzalloc_noprof include/linux/slab.h:1037 [inline]
>  binderfs_binder_device_create+0x16c/0x9c0 drivers/android/binderfs.c:147
>  binderfs_fill_super+0x944/0xd90 drivers/android/binderfs.c:729
>  vfs_get_super fs/super.c:1280 [inline]
>  get_tree_nodev+0xb7/0x140 fs/super.c:1299
>  vfs_get_tree+0x90/0x2b0 fs/super.c:1814
>  do_new_mount+0x2be/0xb40 fs/namespace.c:3560
>  do_mount fs/namespace.c:3900 [inline]
>  __do_sys_mount fs/namespace.c:4111 [inline]
>  __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 5832:
>  kasan_save_stack mm/kasan/common.c:47 [inline]
>  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
>  kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
>  poison_slab_object mm/kasan/common.c:247 [inline]
>  __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
>  kasan_slab_free include/linux/kasan.h:233 [inline]
>  slab_free_hook mm/slub.c:2353 [inline]
>  slab_free mm/slub.c:4609 [inline]
>  kfree+0x196/0x430 mm/slub.c:4757
>  evict+0x4e8/0x9a0 fs/inode.c:796
>  __dentry_kill+0x20d/0x630 fs/dcache.c:625
>  shrink_kill+0xa9/0x2c0 fs/dcache.c:1070
>  shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1097
>  shrink_dcache_parent+0xcb/0x3b0
>  do_one_tree+0x23/0xe0 fs/dcache.c:1560
>  shrink_dcache_for_umount+0xb4/0x180 fs/dcache.c:1577
>  generic_shutdown_super+0x6a/0x2d0 fs/super.c:620
>  kill_anon_super fs/super.c:1237 [inline]
>  kill_litter_super+0x76/0xb0 fs/super.c:1247
>  binderfs_kill_super+0x44/0x90 drivers/android/binderfs.c:791
>  deactivate_locked_super+0xc4/0x130 fs/super.c:473
>  cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1413
>  task_work_run+0x24f/0x310 kernel/task_work.c:227
>  exit_task_work include/linux/task_work.h:40 [inline]
>  do_exit+0xa2a/0x28e0 kernel/exit.c:938
>  do_group_exit+0x207/0x2c0 kernel/exit.c:1087
>  get_signal+0x16b2/0x1750 kernel/signal.c:3036
>  arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
>  exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
>  exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
>  __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
>  syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
>  do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> The buggy address belongs to the object at ffff888141fb9400
>  which belongs to the cache kmalloc-512 of size 512
> The buggy address is located 8 bytes inside of
>  freed 512-byte region [ffff888141fb9400, ffff888141fb9600)
>
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888141fba800 pfn:0x141fb8
> head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> flags: 0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff)
> page_type: f5(slab)
> raw: 057ff00000000240 ffff88801ac41c80 ffffea0005337a10 ffffea0005345c10
> raw: ffff888141fba800 000000000010000f 00000000f5000000 0000000000000000
> head: 057ff00000000240 ffff88801ac41c80 ffffea0005337a10 ffffea0005345c10
> head: ffff888141fba800 000000000010000f 00000000f5000000 0000000000000000
> head: 057ff00000000002 ffffea000507ee01 ffffffffffffffff 0000000000000000
> head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6801495950, free_ts 0
>  set_page_owner include/linux/page_owner.h:32 [inline]
>  post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
>  prep_new_page mm/page_alloc.c:1559 [inline]
>  get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3477
>  __alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
>  alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
>  alloc_slab_page mm/slub.c:2423 [inline]
>  allocate_slab+0x8f/0x3a0 mm/slub.c:2587
>  new_slab mm/slub.c:2640 [inline]
>  ___slab_alloc+0xc27/0x14a0 mm/slub.c:3826
>  __slab_alloc+0x58/0xa0 mm/slub.c:3916
>  __slab_alloc_node mm/slub.c:3991 [inline]
>  slab_alloc_node mm/slub.c:4152 [inline]
>  __kmalloc_cache_noprof+0x27b/0x390 mm/slub.c:4320
>  kmalloc_noprof include/linux/slab.h:901 [inline]
>  kzalloc_noprof include/linux/slab.h:1037 [inline]
>  device_private_init drivers/base/core.c:3510 [inline]
>  device_add+0xc1/0xbf0 drivers/base/core.c:3561
>  device_create_groups_vargs drivers/base/core.c:4347 [inline]
>  device_create+0x257/0x2e0 drivers/base/core.c:4386
>  bdi_register_va+0x8b/0x760 mm/backing-dev.c:1094
>  bdi_register+0xd5/0x120 mm/backing-dev.c:1126
>  add_disk_fwnode+0x759/0xfc0 block/genhd.c:510
>  add_disk include/linux/blkdev.h:759 [inline]
>  brd_alloc+0x547/0x790 drivers/block/brd.c:401
>  brd_init+0x126/0x1b0 drivers/block/brd.c:481
>  do_one_initcall+0x248/0x870 init/main.c:1257
> page_owner free stack trace missing
>
> Memory state around the buggy address:
>  ffff888141fb9300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  ffff888141fb9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ffff888141fb9400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>                       ^
>  ffff888141fb9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ffff888141fb9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/6788e8a3.050a0220.20d369.0031.GAE%40google.com.

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Carlos Llamas]

On Thu, Jan 23, 2025 at 01:32:29PM +0100, Aleksandr Nogikh wrote:
> The problem began to appear after:
> 
> commit 12d909cac1e1c4147cc3417fee804ee12fc6b984
> Author: Li Li <dualli@google.com>
> Date:   Wed Dec 18 13:29:34 2024 -0800
> 
>     binderfs: add new binder devices to binder_devices
> 

Correct. I tried to mark this commit with a #syz blame or something but
I couldn't find anything. The problem here is we add binderfs devices to
the binder_devices list but we don't remove them when these are kfreed
e.g. during umount.

This is then fairly easy to reproduce, something like:
  $ mount -t binder binder /dev/binderfs
  $ umount /dev/binderfs
  $ mount -t binder binder /dev/binderfs

It should be a simply fix. I'll send a patch later today.

Thanks,
--
Carlos Llamas

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Carlos Llamas]

On Thu, Jan 16, 2025 at 03:08:19AM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b323d8e7bc03 Add linux-next specific files for 20250116
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=139dc9df980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=76ebc49148908d34
> dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/a529f1184b45/disk-b323d8e7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/08db885c938e/vmlinux-b323d8e7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2ff92778e2b7/bzImage-b323d8e7.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com

#syz test

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index bc6bae76ccaf..94c6446604fc 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -274,6 +274,7 @@ static void binderfs_evict_inode(struct inode *inode)
 	mutex_unlock(&binderfs_minors_mutex);
 
 	if (refcount_dec_and_test(&device->ref)) {
+		hlist_del_init(&device->hlist);
 		kfree(device->context.name);
 		kfree(device);
 	}

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

0][   T52]  ieee80211_unregister_hw+0x5d/0x2c0
[   72.827744][   T52]  mac80211_hwsim_del_radio+0x2c4/0x4c0
[   72.827761][   T52]  ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
[   72.827777][   T52]  hwsim_exit_net+0x5c1/0x670
[   72.827790][   T52]  ? __pfx_hwsim_exit_net+0x10/0x10
[   72.827802][   T52]  ? __ip_vs_dev_cleanup_batch+0x239/0x260
[   72.827818][   T52]  cleanup_net+0x812/0xd60
[   72.827831][   T52]  ? __pfx_cleanup_net+0x10/0x10
[   72.827847][   T52]  ? process_scheduled_works+0x976/0x1840
[   72.827861][   T52]  process_scheduled_works+0xa66/0x1840
[   72.827882][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
[   72.827898][   T52]  ? assign_work+0x364/0x3d0
[   72.827913][   T52]  worker_thread+0x870/0xd30
[   72.827931][   T52]  ? __kthread_parkme+0x169/0x1d0
[   72.827946][   T52]  ? __pfx_worker_thread+0x10/0x10
[   72.827960][   T52]  kthread+0x7a9/0x920
[   72.827975][   T52]  ? __pfx_kthread+0x10/0x10
[   72.827991][   T52]  ? __pfx_worker_thread+0x10/0x10
[   72.828004][   T52]  ? __pfx_kthread+0x10/0x10
[   72.828019][   T52]  ? __pfx_kthread+0x10/0x10
[   72.828035][   T52]  ? __pfx_kthread+0x10/0x10
[   72.828057][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
[   72.828073][   T52]  ? lockdep_hardirqs_on+0x99/0x150
[   72.828083][   T52]  ? __pfx_kthread+0x10/0x10
[   72.828099][   T52]  ret_from_fork+0x4b/0x80
[   72.828115][   T52]  ? __pfx_kthread+0x10/0x10
[   72.828130][   T52]  ret_from_fork_asm+0x1a/0x30
[   72.828147][   T52]  </TASK>
[   73.225971][ T5846] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   73.272138][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0
[   73.285789][ T5846] 8021q: adding VLAN 0 to HW filter on device team0
[   73.297132][   T12] bridge0: port 1(bridge_slave_0) entered blocking state
[   73.304260][   T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[   73.315883][ T3458] bridge0: port 2(bridge_slave_1) entered blocking state
[   73.323014][ T3458] bridge0: port 2(bridge_slave_1) entered forwarding state
[   73.369208][ T5146] Bluetooth: hci0: command tx timeout
[   73.423445][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0
[   73.447473][ T5846] veth0_vlan: entered promiscuous mode
[   73.463271][ T5846] veth1_vlan: entered promiscuous mode
[   73.482621][ T5846] veth0_macvtap: entered promiscuous mode
[   73.490813][ T5846] veth1_macvtap: entered promiscuous mode
[   73.503910][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.513805][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.525794][ T5846] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.534958][ T5846] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.543749][ T5846] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.553559][ T5846] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2025/01/23 20:25:37 executed programs: 0
[   73.650024][ T5897] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   73.657273][ T5897] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   73.658001][   T52] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   73.666246][ T5897] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   73.682494][ T5897] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   73.690142][ T5897] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   73.697286][ T5897] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   73.755858][   T52] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   73.775051][ T5929] chnl_net:caif_netlink_parms(): no params data found
[   73.811171][   T52] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   73.822996][ T5929] bridge0: port 1(bridge_slave_0) entered blocking state
[   73.830321][ T5929] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.837466][ T5929] bridge_slave_0: entered allmulticast mode
[   73.844302][ T5929] bridge_slave_0: entered promiscuous mode
[   73.854059][   T52] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   73.865862][ T5929] bridge0: port 2(bridge_slave_1) entered blocking state
[   73.873181][ T5929] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.880397][ T5929] bridge_slave_1: entered allmulticast mode
[   73.886763][ T5929] bridge_slave_1: entered promiscuous mode
[   73.905971][ T5929] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   73.917313][ T5929] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   73.938272][ T5929] team0: Port device team_slave_0 added
[   73.945367][ T5929] team0: Port device team_slave_1 added
[   73.959711][ T5929] batman_adv: batadv0: Adding interface: batadv_slave_0
[   73.966762][ T5929] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   73.993111][ T5929] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   74.005166][ T5929] batman_adv: batadv0: Adding interface: batadv_slave_1
[   74.012388][ T5929] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   74.038749][ T5929] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   74.066987][ T5929] hsr_slave_0: entered promiscuous mode
[   74.073635][ T5929] hsr_slave_1: entered promiscuous mode
[   74.079902][ T5929] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   74.087455][ T5929] Cannot create hsr debugfs directory
[   75.449017][ T5897] Bluetooth: hci0: command tx timeout
[   75.769077][ T5897] Bluetooth: hci1: command tx timeout
[   77.119131][   T52] bridge_slave_1: left allmulticast mode
[   77.124824][   T52] bridge_slave_1: left promiscuous mode
[   77.134269][   T52] bridge0: port 2(bridge_slave_1) entered disabled state
[   77.142674][   T52] bridge_slave_0: left allmulticast mode
[   77.148309][   T52] bridge_slave_0: left promiscuous mode
[   77.154184][   T52] bridge0: port 1(bridge_slave_0) entered disabled state
[   77.253950][   T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   77.263928][   T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   77.273441][   T52] bond0 (unregistering): Released all slaves
[   77.383555][   T52] hsr_slave_0: left promiscuous mode
[   77.390134][   T52] hsr_slave_1: left promiscuous mode
[   77.395926][   T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   77.403407][   T52] batman_adv: batadv0: Removing interface: batadv_slave_0
[   77.411905][   T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   77.419472][   T52] batman_adv: batadv0: Removing interface: batadv_slave_1
[   77.432774][   T52] veth1_macvtap: left promiscuous mode
[   77.438318][   T52] veth0_macvtap: left promiscuous mode
[   77.447662][   T52] veth1_vlan: left promiscuous mode
[   77.453909][   T52] veth0_vlan: left promiscuous mode
[   77.529653][ T5897] Bluetooth: hci0: command tx timeout
[   77.572399][   T52] team0 (unregistering): Port device team_slave_1 removed
[   77.596882][   T52] team0 (unregistering): Port device team_slave_0 removed
[   77.696933][ T5929] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   77.714514][ T5929] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   77.725334][ T5929] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   77.735884][ T5929] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   77.805349][ T5929] 8021q: adding VLAN 0 to HW filter on device bond0
[   77.822003][ T5929] 8021q: adding VLAN 0 to HW filter on device team0
[   77.834543][ T3423] bridge0: port 1(bridge_slave_0) entered blocking state
[   77.841705][ T3423] bridge0: port 1(bridge_slave_0) entered forwarding state
[   77.849243][ T5897] Bluetooth: hci1: command tx timeout
[   77.870686][ T3423] bridge0: port 2(bridge_slave_1) entered blocking state
[   77.877810][ T3423] bridge0: port 2(bridge_slave_1) entered forwarding state
[   77.973541][ T5929] 8021q: adding VLAN 0 to HW filter on device batadv0
[   78.000016][ T5929] veth0_vlan: entered promiscuous mode
[   78.008639][ T5929] veth1_vlan: entered promiscuous mode
[   78.024796][ T5929] veth0_macvtap: entered promiscuous mode
[   78.033395][ T5929] veth1_macvtap: entered promiscuous mode
[   78.045017][ T5929] batman_adv: batadv0: Interface activated: batadv_slave_0
[   78.056288][ T5929] batman_adv: batadv0: Interface activated: batadv_slave_1
[   78.065987][ T5929] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   78.074959][ T5929] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   78.084639][ T5929] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   78.093477][ T5929] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   78.115638][ T5929] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[   78.132089][   T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   78.133333][ T5929] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[   78.150518][   T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   78.165307][   T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   78.173380][   T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build784600658=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at f6a35ef3a5
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go: downloading github.com/prometheus/client_golang v1.20.5
go: downloading github.com/VividCortex/gohistogram v1.0.0
go: downloading golang.org/x/sys v0.29.0
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/procfs v0.15.1
go: downloading github.com/prometheus/client_model v0.6.1
go: downloading github.com/prometheus/common v0.55.0
go: downloading google.golang.org/protobuf v1.35.2
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f6a35ef3a59d5a0ad14de993e51c186016ea91de -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250123-131638'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"f6a35ef3a59d5a0ad14de993e51c186016ea91de\"
go: downloading github.com/ulikunitz/xz v0.5.12
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/google/flatbuffers v24.3.25+incompatible
go: downloading google.golang.org/api v0.198.0
go: downloading cloud.google.com/go/storage v1.43.0
go: downloading github.com/ianlancetaylor/demangle v0.0.0-20240312041847-bd984b5ce465
go: downloading cloud.google.com/go/spanner v1.67.0
go: downloading golang.org/x/exp v0.0.0-20240909161429-701f63a606c0
go: downloading golang.org/x/sync v0.10.0
go: downloading cloud.google.com/go v0.116.0
go: downloading github.com/sergi/go-diff v1.3.1
go: downloading cloud.google.com/go/bigquery v1.63.0
go: downloading cloud.google.com/go/iam v1.2.1
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1
go: downloading google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1
go: downloading go.opentelemetry.io/otel/trace v1.29.0
go: downloading github.com/googleapis/gax-go/v2 v2.13.0
go: downloading go.opentelemetry.io/otel v1.29.0
go: downloading cloud.google.com/go/compute/metadata v0.5.1
go: downloading google.golang.org/grpc v1.66.2
go: downloading go.opencensus.io v0.24.0
go: downloading golang.org/x/oauth2 v0.24.0
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1
go: downloading go.opentelemetry.io/otel/metric v1.29.0
go: downloading github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.0
go: downloading github.com/apache/arrow/go/v15 v15.0.2
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading github.com/go-logr/logr v1.4.2
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading golang.org/x/net v0.34.0
go: downloading github.com/envoyproxy/go-control-plane v0.12.1-0.20240621013728-1eb8caab5155
go: downloading github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b
go: downloading github.com/envoyproxy/protoc-gen-validate v1.0.4
go: downloading cel.dev/expr v0.15.0
go: downloading golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
go: downloading github.com/klauspost/compress v1.17.9
go: downloading github.com/pierrec/lz4/v4 v4.1.18
go: downloading github.com/goccy/go-json v0.10.3
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading github.com/klauspost/cpuid/v2 v2.2.8
go: downloading golang.org/x/text v0.21.0
go: downloading github.com/census-instrumentation/opencensus-proto v0.4.1
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.4
go: downloading github.com/google/s2a-go v0.1.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0
go: downloading cloud.google.com/go/auth v0.9.4
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.4
go: downloading golang.org/x/time v0.7.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading golang.org/x/crypto v0.32.0
/usr/bin/ld: /tmp/cc8ycaYm.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=102ce5df980000


Tested on:

commit:         853d1f41 Add linux-next specific files for 20250123
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=364db892f6981d27
dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10d7a9f8580000

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Carlos Llamas]

On Thu, Jan 23, 2025 at 12:26:03PM -0800, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
> 0][   T52]  ieee80211_unregister_hw+0x5d/0x2c0
> [   72.827744][   T52]  mac80211_hwsim_del_radio+0x2c4/0x4c0
> [   72.827761][   T52]  ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
> [   72.827777][   T52]  hwsim_exit_net+0x5c1/0x670
> [   72.827790][   T52]  ? __pfx_hwsim_exit_net+0x10/0x10
> [   72.827802][   T52]  ? __ip_vs_dev_cleanup_batch+0x239/0x260
> [   72.827818][   T52]  cleanup_net+0x812/0xd60
> [   72.827831][   T52]  ? __pfx_cleanup_net+0x10/0x10
> [   72.827847][   T52]  ? process_scheduled_works+0x976/0x1840
> [   72.827861][   T52]  process_scheduled_works+0xa66/0x1840
> [   72.827882][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
> [   72.827898][   T52]  ? assign_work+0x364/0x3d0
> [   72.827913][   T52]  worker_thread+0x870/0xd30
> [   72.827931][   T52]  ? __kthread_parkme+0x169/0x1d0
> [   72.827946][   T52]  ? __pfx_worker_thread+0x10/0x10
> [   72.827960][   T52]  kthread+0x7a9/0x920
> [   72.827975][   T52]  ? __pfx_kthread+0x10/0x10
> [   72.827991][   T52]  ? __pfx_worker_thread+0x10/0x10
> [   72.828004][   T52]  ? __pfx_kthread+0x10/0x10
> [   72.828019][   T52]  ? __pfx_kthread+0x10/0x10
> [   72.828035][   T52]  ? __pfx_kthread+0x10/0x10
> [   72.828057][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
> [   72.828073][   T52]  ? lockdep_hardirqs_on+0x99/0x150
> [   72.828083][   T52]  ? __pfx_kthread+0x10/0x10
> [   72.828099][   T52]  ret_from_fork+0x4b/0x80
> [   72.828115][   T52]  ? __pfx_kthread+0x10/0x10
> [   72.828130][   T52]  ret_from_fork_asm+0x1a/0x30
> [   72.828147][   T52]  </TASK>

Huh? it sounds like linux-next is broken right now. This is some
unrelated lockdep issue. Let me retry with char-misc tree instead.

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Carlos Llamas]

On Thu, Jan 16, 2025 at 03:08:19AM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b323d8e7bc03 Add linux-next specific files for 20250116
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=139dc9df980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=76ebc49148908d34
> dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/a529f1184b45/disk-b323d8e7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/08db885c938e/vmlinux-b323d8e7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2ff92778e2b7/bzImage-b323d8e7.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-next

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index bc6bae76ccaf..94c6446604fc 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -274,6 +274,7 @@ static void binderfs_evict_inode(struct inode *inode)
 	mutex_unlock(&binderfs_minors_mutex);
 
 	if (refcount_dec_and_test(&device->ref)) {
+		hlist_del_init(&device->hlist);
 		kfree(device->context.name);
 		kfree(device);
 	}

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com
Tested-by: syzbot+7015dcf45953112c8b45@syzkaller.appspotmail.com

Tested on:

commit:         970b9757 ntsync: Fix reference leaks in the remaining ..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=5ef5646cab25e74a
dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17e5e5df980000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Aleksandr Nogikh]

On Thu, Jan 23, 2025 at 5:49 PM Carlos Llamas <cmllamas@google.com> wrote:
>
> On Thu, Jan 23, 2025 at 01:32:29PM +0100, Aleksandr Nogikh wrote:
> > The problem began to appear after:
> >
> > commit 12d909cac1e1c4147cc3417fee804ee12fc6b984
> > Author: Li Li <dualli@google.com>
> > Date:   Wed Dec 18 13:29:34 2024 -0800
> >
> >     binderfs: add new binder devices to binder_devices
> >
>
> Correct. I tried to mark this commit with a #syz blame or something but
> I couldn't find anything.

That's not supported at the moment. I've just added a +1 to our
related backlog issue:
https://github.com/google/syzkaller/issues/3491.

> The problem here is we add binderfs devices to
> the binder_devices list but we don't remove them when these are kfreed
> e.g. during umount.
>
> This is then fairly easy to reproduce, something like:
>   $ mount -t binder binder /dev/binderfs
>   $ umount /dev/binderfs
>   $ mount -t binder binder /dev/binderfs
>
> It should be a simply fix. I'll send a patch later today.

Thanks for having taken a look and fixing this bug!

-- 
Aleksandr

>
> Thanks,
> --
> Carlos Llamas