KASAN: use-after-free Read in kernfs_add_one

Status: auto-obsoleted due to no activity on 2023/09/26 01:13
Reported-by: syzbot+91af4b4fcb0a6faed7c0@syzkaller.appspotmail.com
First crash: 1148d, last: 1148d
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in kernfs_add_one kernfs 19 syz, C error inconclusive 39 851d 1782d 0/29 auto-obsoleted due to no activity on 2024/08/14 07:44
linux-6.1 KASAN: use-after-free Read in kernfs_add_one (2) 19 1 841d 841d 0/3 auto-obsoleted due to no activity on 2024/07/29 04:04
linux-6.1 KASAN: use-after-free Read in kernfs_add_one (3) 19 1 734d 734d 0/3 auto-obsoleted due to no activity on 2024/11/13 12:08
linux-6.1 KASAN: use-after-free Read in kernfs_add_one (4) origin:upstream missing-backport 19 syz, C inconclusive 5 368d 595d 0/3 upstream: reported C repro on 2024/12/22 11:05
linux-5.15 KASAN: use-after-free Read in kernfs_add_one (2) 19 2 333d 409d 0/3 auto-obsoleted due to no activity on 2025/12/19 02:39
linux-5.15 KASAN: use-after-free Read in kernfs_add_one 19 1 1044d 1044d 0/3 auto-obsoleted due to no activity on 2024/01/09 18:18
upstream KASAN: slab-use-after-free Read in kernfs_add_one kernfs 19 6 520d 681d 0/29 auto-obsoleted due to no activity on 2025/06/15 10:44

Sample crash report:
usb 3-1: Direct firmware load for ueagle-atm/adi930.fw failed with error -2
usb 3-1: Falling back to sysfs fallback for: ueagle-atm/adi930.fw
==================================================================
BUG: KASAN: use-after-free in kernfs_root fs/kernfs/kernfs-internal.h:66 [inline]
BUG: KASAN: use-after-free in kernfs_next_descendant_post fs/kernfs/dir.c:1299 [inline]
BUG: KASAN: use-after-free in kernfs_activate fs/kernfs/dir.c:1354 [inline]
BUG: KASAN: use-after-free in kernfs_add_one+0x4ae/0x850 fs/kernfs/dir.c:786
Read of size 8 at addr ffff88801766ab10 by task kworker/0:4/3637

CPU: 0 PID: 3637 Comm: kworker/0:4 Not tainted 6.1.34-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15f/0x4f0 mm/kasan/report.c:395
 kasan_report+0x136/0x160 mm/kasan/report.c:495
 kernfs_root fs/kernfs/kernfs-internal.h:66 [inline]
 kernfs_next_descendant_post fs/kernfs/dir.c:1299 [inline]
 kernfs_activate fs/kernfs/dir.c:1354 [inline]
 kernfs_add_one+0x4ae/0x850 fs/kernfs/dir.c:786
 kernfs_create_dir_ns+0x1c0/0x230 fs/kernfs/dir.c:1031
 sysfs_create_dir_ns+0x185/0x390 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:63 [inline]
 kobject_add_internal+0x6df/0xd10 lib/kobject.c:231
 kobject_add_varg lib/kobject.c:366 [inline]
 kobject_add+0x14e/0x210 lib/kobject.c:418
 device_add+0x476/0xfd0 drivers/base/core.c:3599
 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:82 [inline]
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:158 [inline]
 firmware_fallback_sysfs+0x2fd/0x940 drivers/base/firmware_loader/fallback.c:234
 _request_firmware+0xc13/0x1200 drivers/base/firmware_loader/main.c:856
 request_firmware_work_func+0x126/0x270 drivers/base/firmware_loader/main.c:1105
 process_one_work+0x8aa/0x11f0 kernel/workqueue.c:2289
 worker_thread+0xa5f/0x1210 kernel/workqueue.c:2436
 kthread+0x26e/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Allocated by task 3637:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x50/0x370 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x10c/0x2d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 __kernfs_new_node+0xdb/0x730 fs/kernfs/dir.c:608
 kernfs_new_node fs/kernfs/dir.c:670 [inline]
 kernfs_create_dir_ns+0x90/0x230 fs/kernfs/dir.c:1021
 sysfs_create_dir_ns+0x185/0x390 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:63 [inline]
 kobject_add_internal+0x6df/0xd10 lib/kobject.c:231
 kobject_add_varg lib/kobject.c:366 [inline]
 kobject_add+0x14e/0x210 lib/kobject.c:418
 device_add+0x476/0xfd0 drivers/base/core.c:3599
 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:82 [inline]
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:158 [inline]
 firmware_fallback_sysfs+0x2fd/0x940 drivers/base/firmware_loader/fallback.c:234
 _request_firmware+0xc13/0x1200 drivers/base/firmware_loader/main.c:856
 request_firmware_work_func+0x126/0x270 drivers/base/firmware_loader/main.c:1105
 process_one_work+0x8aa/0x11f0 kernel/workqueue.c:2289
 worker_thread+0xa5f/0x1210 kernel/workqueue.c:2436
 kthread+0x26e/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Freed by task 3640:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 kmem_cache_free+0x292/0x510 mm/slub.c:3683
 kernfs_put+0x325/0x4a0 fs/kernfs/dir.c:562
 __kernfs_remove+0x5fc/0x710 fs/kernfs/dir.c:1453
 kernfs_remove+0x76/0x90 fs/kernfs/dir.c:1473
 __kobject_del+0xe2/0x310 lib/kobject.c:596
 kobject_del+0x41/0x60 lib/kobject.c:619
 device_del+0x9f6/0xbd0 drivers/base/core.c:3863
 usb_disconnect+0x58f/0x8c0 drivers/usb/core/hub.c:2264
 hub_port_connect drivers/usb/core/hub.c:5199 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5499 [inline]
 port_event drivers/usb/core/hub.c:5655 [inline]
 hub_event+0x1dfa/0x57b0 drivers/usb/core/hub.c:5737
 process_one_work+0x8aa/0x11f0 kernel/workqueue.c:2289
 process_scheduled_works kernel/workqueue.c:2352 [inline]
 worker_thread+0xd1c/0x1210 kernel/workqueue.c:2438
 kthread+0x26e/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

The buggy address belongs to the object at ffff88801766aae0
 which belongs to the cache kernfs_node_cache of size 168
The buggy address is located 48 bytes inside of
 168-byte region [ffff88801766aae0, ffff88801766ab88)

The buggy address belongs to the physical page:
page:ffffea00005d9a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1766a
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0001e29e00 dead000000000006 ffff88801261ac80
raw: 0000000000000000 0000000080110011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3591, tgid 3591 (syz-executor.1), ts 266260478693, free_ts 266068867917
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2533
 prep_new_page mm/page_alloc.c:2540 [inline]
 get_page_from_freelist+0x32ed/0x3480 mm/page_alloc.c:4292
 __alloc_pages+0x28d/0x770 mm/page_alloc.c:5559
 alloc_slab_page+0x6a/0x150 mm/slub.c:1794
 allocate_slab mm/slub.c:1939 [inline]
 new_slab+0x84/0x2d0 mm/slub.c:1992
 ___slab_alloc+0xa71/0x1080 mm/slub.c:3180
 __slab_alloc mm/slub.c:3279 [inline]
 slab_alloc_node mm/slub.c:3364 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x1a5/0x2d0 mm/slub.c:3422
 kmem_cache_zalloc include/linux/slab.h:679 [inline]
 __kernfs_new_node+0xdb/0x730 fs/kernfs/dir.c:608
 kernfs_new_node+0x95/0x160 fs/kernfs/dir.c:670
 __kernfs_create_file+0x45/0x2e0 fs/kernfs/file.c:1043
 sysfs_add_file_mode_ns+0x246/0x300 fs/sysfs/file.c:294
 create_files fs/sysfs/group.c:64 [inline]
 internal_create_group+0x545/0xed0 fs/sysfs/group.c:148
 internal_create_groups fs/sysfs/group.c:188 [inline]
 sysfs_create_groups+0x52/0x110 fs/sysfs/group.c:214
 create_dir lib/kobject.c:68 [inline]
 kobject_add_internal+0x725/0xd10 lib/kobject.c:231
 kobject_add_varg lib/kobject.c:366 [inline]
 kobject_init_and_add+0x120/0x190 lib/kobject.c:449
 netdev_queue_add_kobject net/core/net-sysfs.c:1666 [inline]
 netdev_queue_update_kobjects+0x1f2/0x480 net/core/net-sysfs.c:1718
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1460 [inline]
 free_pcp_prepare mm/page_alloc.c:1510 [inline]
 free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3388
 free_unref_page+0x98/0x570 mm/page_alloc.c:3484
 qlist_free_all+0x22/0x60 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x162/0x180 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x50/0x370 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 kmem_cache_alloc_node+0x136/0x310 mm/slub.c:3443
 __alloc_skb+0xdf/0x620 net/core/skbuff.c:497
 alloc_skb include/linux/skbuff.h:1268 [inline]
 nlmsg_new include/net/netlink.h:970 [inline]
 rtmsg_ifinfo_build_skb+0x81/0x180 net/core/rtnetlink.c:3911
 rtmsg_ifinfo_event net/core/rtnetlink.c:3947 [inline]
 rtnetlink_event+0xee/0x1b0 net/core/rtnetlink.c:6148
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd0/0x170 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:1945 [inline]
 netdev_lower_state_changed+0x1b9/0x260 net/core/dev.c:8305
 team_lower_state_changed drivers/net/team/team.c:89 [inline]
 team_refresh_port_linkup drivers/net/team/team.c:99 [inline]
 __team_port_change_send+0x215/0x5b0 drivers/net/team/team.c:2921
 __team_port_change_port_added drivers/net/team/team.c:2974 [inline]
 team_port_add drivers/net/team/team.c:1289 [inline]
 team_add_slave+0x1ffc/0x2620 drivers/net/team/team.c:1985
 do_set_master net/core/rtnetlink.c:2578 [inline]
 do_setlink+0xd92/0x3e60 net/core/rtnetlink.c:2781
 __rtnl_newlink net/core/rtnetlink.c:3553 [inline]
 rtnl_newlink+0x16f7/0x1fa0 net/core/rtnetlink.c:3600

Memory state around the buggy address:
 ffff88801766aa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88801766aa80: 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb fb
>ffff88801766ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88801766ab80: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
 ffff88801766ac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/18 01:13 linux-6.1.y ca87e77a2ef8 f3921d4d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in kernfs_add_one
* Struck through repros no longer work on HEAD.