Re: [syzbot] [kernel?] kernel BUG in binder_inc_ref_for_node

Carlos Llamas
2024-07-15T20:23:19Z

On Sat, Jul 13, 2024 at 03:25:20AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 82d01fe6ee52 Add linux-next specific files for 20240709
> git tree: linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=106472a5980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=95a20e7acf357998
> dashboard link: https://syzkaller.appspot.com/bug?extid=3dae065ca76952a67257
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f2e87e980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16a4869e980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 82d01fe6ee52

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 0c2161b1f057..f54e5c0c7d04 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1046,13 +1046,13 @@ static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc,
}

/* Find the smallest unused descriptor the "slow way" */
-static u32 slow_desc_lookup_olocked(struct binder_proc *proc)
+static u32 slow_desc_lookup_olocked(struct binder_proc *proc, u32 offset)
{
struct binder_ref *ref;
struct rb_node *n;
u32 desc;

- desc = 1;
+ desc = offset;
for (n = rb_first(&proc->refs_by_desc); n; n = rb_next(n)) {
ref = rb_entry(n, struct binder_ref, rb_node_desc);
if (ref->data.desc > desc)
@@ -1073,21 +1073,18 @@ static int get_ref_desc_olocked(struct binder_proc *proc,
u32 *desc)
{
struct dbitmap *dmap = &proc->dmap;
+ unsigned int nbits, offset;
unsigned long *new, bit;
- unsigned int nbits;

/* 0 is reserved for the context manager */
- if (node == proc->context->binder_context_mgr_node) {
- *desc = 0;
- return 0;
- }
+ offset = (node == proc->context->binder_context_mgr_node) ? 0 : 1;

if (!dbitmap_enabled(dmap)) {
- *desc = slow_desc_lookup_olocked(proc);
+ *desc = slow_desc_lookup_olocked(proc, offset);
return 0;
}

- if (dbitmap_acquire_first_zero_bit(dmap, &bit) == 0) {
+ if (dbitmap_acquire_next_zero_bit(dmap, offset, &bit) == 0) {
*desc = bit;
return 0;
}
diff --git a/drivers/android/dbitmap.h b/drivers/android/dbitmap.h
index b8ac7b4764fd..1d58c2e7abd6 100644
--- a/drivers/android/dbitmap.h
+++ b/drivers/android/dbitmap.h
@@ -6,8 +6,7 @@
*
* Used by the binder driver to optimize the allocation of the smallest
* available descriptor ID. Each bit in the bitmap represents the state
- * of an ID, with the exception of BIT(0) which is used exclusively to
- * reference binder's context manager.
+ * of an ID.
*
* A dbitmap can grow or shrink as needed. This part has been designed
* considering that users might need to briefly release their locks in
@@ -132,16 +131,17 @@ dbitmap_grow(struct dbitmap *dmap, unsigned long *new, unsigned int nbits)
}

/*
- * Finds and sets the first zero bit in the bitmap. Upon success @bit
+ * Finds and sets the next zero bit in the bitmap. Upon success @bit
* is populated with the index and 0 is returned. Otherwise, -ENOSPC
* is returned to indicate that a dbitmap_grow() is needed.
*/
static inline int
-dbitmap_acquire_first_zero_bit(struct dbitmap *dmap, unsigned long *bit)
+dbitmap_acquire_next_zero_bit(struct dbitmap *dmap, unsigned long offset,
+ unsigned long *bit)
{
unsigned long n;

- n = find_first_zero_bit(dmap->map, dmap->nbits);
+ n = find_next_zero_bit(dmap->map, dmap->nbits, offset);
if (n == dmap->nbits)
return -ENOSPC;

@@ -154,9 +154,7 @@ dbitmap_acquire_first_zero_bit(struct dbitmap *dmap, unsigned long *bit)
static inline void
dbitmap_clear_bit(struct dbitmap *dmap, unsigned long bit)
{
- /* BIT(0) should always set for the context manager */
- if (bit)
- clear_bit(bit, dmap->map);
+ clear_bit(bit, dmap->map);
}

static inline int dbitmap_init(struct dbitmap *dmap)
@@ -168,8 +166,6 @@ static inline int dbitmap_init(struct dbitmap *dmap)
}

dmap->nbits = NBITS_MIN;
- /* BIT(0) is reserved for the context manager */
- set_bit(0, dmap->map);

return 0;
}