Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in binder_release_work

[Hillf Danton]

On Wed, 02 Oct 2024 14:10:22 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    ad46e8f95e93 Merge tag 'pm-6.12-rc1-2' of git://git.kernel..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10ff3507980000

#syz test

--- x/drivers/android/binder.c
+++ y/drivers/android/binder.c
@@ -6252,6 +6252,7 @@ static void binder_deferred_release(stru
 		ref = rb_entry(n, struct binder_ref, rb_node_desc);
 		outgoing_refs++;
 		binder_cleanup_ref_olocked(ref);
+		binder_dequeue_work(proc, &ref->freeze->work);
 		binder_proc_unlock(proc);
 		binder_free_ref(ref);
 		binder_proc_lock(proc);
--