Hacker News Reader

Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller:

That was apparently fixed?

> No longer occurring on linux-next, probably fixed by the following commit:

> #syz fix: ANDROID: binder: remove waitqueue when thread exits.

Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels.

See for example:

Not sure if it's that exact one, but according to https://bugs.chromium.org/p/project-zero/issues/detail?id=19... it was fixed in "Dec 2017 in the 4.14 LTS kernel, AOSP android 3.18 kernel, AOSP android 4.4 kernel, and AOSP android 4.9 kernel".