Re: [PATCH] binderfs: fix UAF write in binder_add_device

[Peiyang He]

On 2026/9/13 16:56, Peiyang He wrote:
> binderfs_binder_device_create() publishes the new dentry with
> d_make_persistent() and then calls simple_done_creating(), which drops
> the parent directory lock and the creator's dentry reference. It then
> calls binder_add_device() to register the device in the global
> binder_devices list.
> 
> After simple_done_creating() releases the parent directory lock, a
> concurrent unlinkat() can remove the new device entry. Dropping the
> creator's dentry reference can then trigger binderfs_evict_inode(),
> freeing the device. binder_add_device() later accesses the freed
> object, causing UAF write.
> 

For your reference, I checked the Rust binder code, this UAF should not be possible there.
Also I ran the PoC against the Rust binder, it triggered nothing.

Best,
Peiyang