title: Tasklist list in wait queue different than allocated by Binder
body: <p>I am looking into Android Kernel Vulnerability disclosed by Google's Project Zero. Reproducing it for learning purposes on my mobile.</p>
  
  <p>Question:</p>
  
  <p>"somehow queue address is NOT the same as thread->wait.... that where UAF comes in, any ideas why? shouldn't be it the same? it is head of the list, isn't it?"</p>
  
  <p>p0 link: <a href="https://bugs.chromium.org/p/project-zero/issues/detail?id=1942" rel="nofollow noreferrer">https://bugs.chromium.org/p/project-zero/issues/detail?id=1942</a> 
  PoC: <a href="https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=414030" rel="nofollow noreferrer">https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=414030</a> </p>
  
  <p>I had to adjust the PoC slightly ... to trigger it on my mobile kernel. I just want to see that queue address (remove wait queue) is the same as thread->wait , but it is not :( any ideas what I am missing?</p>
  
  <p>Maybe you know why .. below some code + debug, checking out Android Binder UAF</p>
  
  <p>Working without KASAN is a pain, also not to be able to debug kernel on the fly ... heheheh....</p>
  
  <p><a href="https://github.com/S3NEO/android_kernel_samsung_s3ve3g/blob/24c9b3454fddc6a5b332989cb4f4455c21867a42/drivers/staging/android/binder.c#L3222" rel="nofollow noreferrer">https://github.com/S3NEO/android_kernel_samsung_s3ve3g/blob/24c9b3454fddc6a5b332989cb4f4455c21867a42/drivers/staging/android/binder.c#L3222</a></p>
  
  <p>thread->wait address and freed below taken from above function:</p>
  
  <pre><code>[87254.673335] wq queue:e4fb5398
  [87254.673343] epoll struct:e4fb5380
  [87254.673356] wq queue:e4fb5418
  [87254.673362] epoll struct:e4fb5400
  [87254.673389] binder_ioctl: 21697:21697 40046208 0
  [87254.673396] iovec str size:8
  [87254.673402] thread-&gt;wait:e5c5ed2c
  [87254.673407] proc-&gt;wait:e5034268
  [87254.673413] binder_free_thread size:252 worker_off:44
  [87254.673421] freed thread:e5c5ed00
  [87254.673859] ep_unregister_pollwait struct:e4fb5380 epi struct:e4fb5180
  [87254.673915] ep_unregister_pollwait struct:e4fb5400 epi struct:e4fb5a80
  [87254.673923] ep_unregister_pollwait list not empty
  [87254.673929] whead before
  [87254.673934] remove wait queue:e734d96c
  [87254.673940] remove wait queue task list:e734d978
  [87254.673946] ep_unregister_pollwait list not empty
  [87254.673952] whead before
  </code></pre>
  
  <p><a href="https://github.com/S3NEO/android_kernel_samsung_s3ve3g/blob/348ef929213854f5c7ce6b608e2ca0216d6bdce7/fs/eventpoll.c#L533" rel="nofollow noreferrer">https://github.com/S3NEO/android_kernel_samsung_s3ve3g/blob/348ef929213854f5c7ce6b608e2ca0216d6bdce7/fs/eventpoll.c#L533</a></p>
  
  <pre><code>[87254.673957] remove wait queue:e734d9e4
  [87254.673963] remove wait queue task list:e734d9f0
  
  
  [87254.673989] ep_free
  [87254.674000] ep_free
  </code></pre>
  
  <p>BUT somehow queue address is NOT the same as thread->wait.... that where UAF comes in, any ideas why? shouldn't be it the same? it is head of the list, isn't it?</p>
  
  <p>Maybe above help, unless you cannot tell from it.</p>
  
  <p>Thanks,</p>