WARNING in binder_transaction_buffer_release

Status: fixed on 2019/08/14 02:14
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com
Fix commit: 49ed96943a8e binder: prevent transactions to context manager from its own process.
First crash: 2627d, last: 2583d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH] binder: prevent transactions to context manager from its own process. 6 (6) 2019/10/14 19:35
[PATCH 4.19 000/113] 4.19.63-stable review 130 (130) 2019/08/15 07:07
[PATCH 5.2 000/215] 5.2.5-stable review 232 (232) 2019/07/31 09:50
[PATCH 4.14 000/293] 4.14.135-stable review 302 (302) 2019/07/31 09:35
WARNING in binder_transaction_buffer_release 3 (4) 2019/07/17 22:11
Reminder: 3 open syzbot bugs in "android/binder" subsystem 2 (2) 2019/07/03 18:46
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in binder_transaction_buffer_release (2) kernel -1 C done done 442 2212d 2253d 15/29 fixed on 2020/11/16 12:12

Sample crash report:
WARNING: CPU: 1 PID: 8869 at drivers/android/binder.c:2368 binder_transaction_buffer_release+0x673/0x8f0 drivers/android/binder.c:2368
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 8869 Comm: syz-executor.5 Not tainted 5.2.0-rc2+ #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x2cb/0x744 kernel/panic.c:219
 __warn.cold+0x20/0x4d kernel/panic.c:576
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986
RIP: 0010:binder_transaction_buffer_release+0x673/0x8f0 drivers/android/binder.c:2368
Code: 31 ff 41 89 c5 89 c6 e8 9b 81 1e fc 45 85 ed 0f 85 1f 41 01 00 49 8d 47 40 48 89 85 50 fe ff ff e9 9d fa ff ff e8 fd 7f 1e fc <0f> 0b e9 7f fc ff ff e8 f1 7f 1e fc 48 89 d8 45 31 c9 4c 89 fe 4c
RSP: 0018:ffff88807b68f5f0 EFLAGS: 00010293
RAX: ffff8880a032a040 RBX: 0000000000000060 RCX: 1ffff110140654aa
RDX: 0000000000000000 RSI: ffffffff855224a3 RDI: ffff8880a0bd6988
RBP: ffff88807b68f7d8 R08: ffff8880a032a040 R09: ffffed100f6d1ee3
R10: ffffed100f6d1ee2 R11: ffff88807b68f717 R12: ffff88809ac6e080
R13: 0000000000000068 R14: ffff88807b68f7b0 R15: ffff88808eee3080
 binder_transaction+0x153d/0x6620 drivers/android/binder.c:3484
 binder_thread_write+0x87e/0x2820 drivers/android/binder.c:3792
 binder_ioctl_write_read drivers/android/binder.c:4836 [inline]
 binder_ioctl+0x102f/0x1833 drivers/android/binder.c:5013
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x195/0x620 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
 do_fast_syscall_32+0x27b/0xd7d arch/x86/entry/common.c:408
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7ff7849
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f7ff30cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0306201
RDX: 0000000020000140 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (38):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/02 13:18 upstream 3ab4436f688c 53c81ea5 .config console log report syz ci-upstream-kasan-gce-386
2019/06/02 09:55 upstream 3ab4436f688c 53c81ea5 .config console log report syz ci-upstream-kasan-gce-386
2019/05/30 19:07 upstream bec7550cca10 d9aaf3c2 .config console log report syz ci-upstream-kasan-gce-386
2019/05/20 04:28 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/05/19 23:31 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/05/19 20:57 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/05/19 17:46 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/05/19 11:29 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/05/19 07:55 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/05/19 00:05 upstream 72cf0b07418a 5a4461b0 .config console log report syz ci-upstream-kasan-gce-386
2019/07/02 09:50 upstream 6fbc7275c7a9 cccc4302 .config console log report ci-upstream-kasan-gce-selinux-root
2019/07/01 06:32 upstream 6fbc7275c7a9 699d6448 .config console log report ci-upstream-kasan-gce-selinux-root
2019/06/25 13:14 upstream 4b972a01a7da 82c13b6b .config console log report ci-upstream-kasan-gce-root
2019/06/25 13:10 upstream 4b972a01a7da 82c13b6b .config console log report ci-upstream-kasan-gce
2019/06/23 21:04 upstream 241e39004581 472f0082 .config console log report ci-upstream-kasan-gce-root
2019/06/23 03:27 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce
2019/06/23 02:33 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/22 04:34 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-root
2019/06/20 10:32 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-root
2019/06/20 00:12 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce-smack-root
2019/06/19 20:08 upstream bed3c0d84e7e 34bf9440 .config console log report ci-upstream-kasan-gce
2019/06/17 12:52 upstream 963172d9c7e8 442206d7 .config console log report ci-upstream-kasan-gce-root
2019/06/22 04:28 upstream abf02e2964b3 34bf9440 .config console log report ci-upstream-kasan-gce-386
2019/06/02 16:36 upstream 3ab4436f688c 53c81ea5 .config console log report ci-upstream-kasan-gce-386
2019/06/02 13:54 upstream 3ab4436f688c 53c81ea5 .config console log report ci-upstream-kasan-gce-386
2019/06/02 12:22 upstream 3ab4436f688c 53c81ea5 .config console log report ci-upstream-kasan-gce-386
2019/06/02 09:00 upstream 3ab4436f688c 53c81ea5 .config console log report ci-upstream-kasan-gce-386
2019/05/30 18:14 upstream bec7550cca10 d9aaf3c2 .config console log report ci-upstream-kasan-gce-386
2019/05/20 03:57 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/05/19 22:45 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/05/19 20:22 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/05/19 17:00 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/05/19 10:46 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/05/19 07:19 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/05/18 23:22 upstream 72cf0b07418a 5a4461b0 .config console log report ci-upstream-kasan-gce-386
2019/06/28 03:18 linux-next 8087b004bd09 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/27 02:16 linux-next 1dd45f170b7e 7509bf36 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/06/26 06:25 linux-next 902031767aec 0a8d1a96 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.