Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in binder_add_device

[syzbot <syzbot+810b8555076779a07399@syzkaller.appspotmail.com>]

> On Sun, Mar 16, 2025 at 03:51:27PM -0700, syzbot wrote:
>> Hello,
>> 
>> syzbot found the following issue on:
>> 
>> HEAD commit:    b7f94fcf5546 Merge tag 'sched_ext-for-6.14-rc6-fixes' of g..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=134f303f980000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=cdc24cb631dc9bc4
>> dashboard link: https://syzkaller.appspot.com/bug?extid=810b8555076779a07399
>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>
> #syz test

This crash does not have a reproducer. I cannot test it.

>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 76052006bd87..bf79a0e339fe 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -79,6 +79,8 @@ static HLIST_HEAD(binder_deferred_list);
>  static DEFINE_MUTEX(binder_deferred_lock);
>  
>  static HLIST_HEAD(binder_devices);
> +static DEFINE_SPINLOCK(binder_devices_lock);
> +
>  static HLIST_HEAD(binder_procs);
>  static DEFINE_MUTEX(binder_procs_lock);
>  
> @@ -6929,7 +6931,16 @@ const struct binder_debugfs_entry binder_debugfs_entries[] = {
>  
>  void binder_add_device(struct binder_device *device)
>  {
> +	spin_lock(&binder_devices_lock);
>  	hlist_add_head(&device->hlist, &binder_devices);
> +	spin_unlock(&binder_devices_lock);
> +}
> +
> +void binder_remove_device(struct binder_device *device)
> +{
> +	spin_lock(&binder_devices_lock);
> +	hlist_del_init(&device->hlist);
> +	spin_unlock(&binder_devices_lock);
>  }
>  
>  static int __init init_binder_device(const char *name)
> @@ -6956,7 +6967,7 @@ static int __init init_binder_device(const char *name)
>  		return ret;
>  	}
>  
> -	hlist_add_head(&binder_device->hlist, &binder_devices);
> +	binder_add_device(binder_device);
>  
>  	return ret;
>  }
> @@ -7018,7 +7029,7 @@ static int __init binder_init(void)
>  err_init_binder_device_failed:
>  	hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) {
>  		misc_deregister(&device->miscdev);
> -		hlist_del(&device->hlist);
> +		binder_remove_device(device);
>  		kfree(device);
>  	}
>  
> diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
> index e4eb8357989c..c5d68c1d3780 100644
> --- a/drivers/android/binder_internal.h
> +++ b/drivers/android/binder_internal.h
> @@ -584,9 +584,13 @@ struct binder_object {
>  /**
>   * Add a binder device to binder_devices
>   * @device: the new binder device to add to the global list
> - *
> - * Not reentrant as the list is not protected by any locks
>   */
>  void binder_add_device(struct binder_device *device);
>  
> +/**
> + * Remove a binder device to binder_devices
> + * @device: the binder device to remove from the global list
> + */
> +void binder_remove_device(struct binder_device *device);
> +
>  #endif /* _LINUX_BINDER_INTERNAL_H */
> diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
> index 94c6446604fc..44d430c4ebef 100644
> --- a/drivers/android/binderfs.c
> +++ b/drivers/android/binderfs.c
> @@ -274,7 +274,7 @@ static void binderfs_evict_inode(struct inode *inode)
>  	mutex_unlock(&binderfs_minors_mutex);
>  
>  	if (refcount_dec_and_test(&device->ref)) {
> -		hlist_del_init(&device->hlist);
> +		binder_remove_device(device);
>  		kfree(device->context.name);
>  		kfree(device);
>  	}