Re: [syzbot] [kernel?] linux-next test error: KASAN: slab-use-after-free Write in binder_add_device

[Carlos Llamas]

On Thu, Jan 16, 2025 at 03:08:19AM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b323d8e7bc03 Add linux-next specific files for 20250116
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=139dc9df980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=76ebc49148908d34
> dashboard link: https://syzkaller.appspot.com/bug?extid=7015dcf45953112c8b45
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/a529f1184b45/disk-b323d8e7.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/08db885c938e/vmlinux-b323d8e7.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2ff92778e2b7/bzImage-b323d8e7.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+7015dcf45953112c8b45@xxxxxxxxxxxxxxxxxxxxxxxxx

#syz test

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index bc6bae76ccaf..94c6446604fc 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -274,6 +274,7 @@ static void binderfs_evict_inode(struct inode *inode)
 	mutex_unlock(&binderfs_minors_mutex);
 
 	if (refcount_dec_and_test(&device->ref)) {
+		hlist_del_init(&device->hlist);
 		kfree(device->context.name);
 		kfree(device);
 	}