KASAN: slab-use-after-free Read in fserror_worker

All of lore.kernel.org
 help / color / mirror / Atom feed

From: sanan.hasanou@gmail.com
To: viro@zeniv.linux.org.uk, brauner@kernel.org, jack@suse.cz,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: KASAN: slab-use-after-free Read in fserror_worker
Date: Fri, 26 Jun 2026 14:29:21 -0700 (PDT)	[thread overview]
Message-ID: <6a3eef31.2bc1d9cf.3ebea.506b@mx.google.com> (raw)

Good day, dear maintainers,

We found a bug using a modified version of syzkaller.

Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1dd0qteaHHIsE3puUVyWFoRLtF4bP2IOy>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!

Best regards,
Sanan Hasanov

==================================================================
BUG: KASAN: slab-use-after-free in inode_state_read_once include/linux/fs.h:884 [inline]
BUG: KASAN: slab-use-after-free in iput+0x34c/0xc60 fs/inode.c:1986
Read of size 4 at addr ffff888066ffafb8 by task kworker/0:1/448004

CPU: 0 UID: 0 PID: 448004 Comm: kworker/0:1 Tainted: G             L      7.0.0-rc1 #1 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events fserror_worker
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:120
 print_address_description+0x51/0x1e0 mm/kasan/report.c:378
 print_report+0x67/0x80 mm/kasan/report.c:482
 kasan_report+0x135/0x170 mm/kasan/report.c:595
 __asan_report_load4_noabort+0x18/0x20 mm/kasan/report_generic.c:380
 inode_state_read_once include/linux/fs.h:884 [inline]
 iput+0x34c/0xc60 fs/inode.c:1986
 fserror_worker+0x215/0x310 fs/fserror.c:69
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xa30/0x13d0 kernel/workqueue.c:3358
 worker_thread+0xacb/0x1060 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x5e4/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 475317:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x73/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4501 [inline]
 slab_alloc_node mm/slub.c:4830 [inline]
 kmem_cache_alloc_lru_noprof+0x2bc/0x4a0 mm/slub.c:4849
 xfs_inode_alloc+0xf8/0x7b0 fs/xfs/xfs_icache.c:97
 xfs_iget_cache_miss fs/xfs/xfs_icache.c:635 [inline]
 xfs_iget+0x635/0x2330 fs/xfs/xfs_icache.c:799
 xfs_lookup+0x2fb/0x4f0 fs/xfs/xfs_inode.c:553
 xfs_vn_lookup+0x11d/0x1e0 fs/xfs/xfs_iops.c:327
 __lookup_slow+0x28f/0x3c0 fs/namei.c:1916
 lookup_slow+0x5c/0x80 fs/namei.c:1933
 walk_component fs/namei.c:2279 [inline]
 lookup_last fs/namei.c:2780 [inline]
 path_lookupat+0x403/0x8f0 fs/namei.c:2804
 filename_lookup+0x217/0x570 fs/namei.c:2833
 filename_listxattr fs/xattr.c:945 [inline]
 path_listxattrat+0x117/0x3a0 fs/xattr.c:975
 __do_sys_listxattr fs/xattr.c:988 [inline]
 __se_sys_listxattr fs/xattr.c:985 [inline]
 __x64_sys_listxattr+0x8b/0xa0 fs/xattr.c:985
 x64_sys_call+0x1899/0x2900 arch/x86/include/generated/asm/syscalls_64.h:195
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x13f/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Freed by task 15:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
 kasan_save_free_info+0x4a/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x63/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2687 [inline]
 slab_free mm/slub.c:6124 [inline]
 kmem_cache_free+0x20c/0x5a0 mm/slub.c:6254
 xfs_inode_free_callback+0x1ad/0x1e0 fs/xfs/xfs_icache.c:165
 rcu_do_batch+0x541/0xc90 kernel/rcu/tree.c:2617
 rcu_core+0x455/0x870 kernel/rcu/tree.c:2869
 rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2886
 handle_softirqs+0x229/0x750 kernel/softirq.c:622
 run_ksoftirqd+0x3f/0x70 kernel/softirq.c:1063
 smpboot_thread_fn+0x611/0xbe0 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x5e4/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xc1/0xd0 mm/kasan/generic.c:556
 __call_rcu_common kernel/rcu/tree.c:3131 [inline]
 call_rcu+0xec/0x7d0 kernel/rcu/tree.c:3251
 __xfs_inode_free fs/xfs/xfs_icache.c:177 [inline]
 xfs_inode_free+0x1c5/0x240 fs/xfs/xfs_icache.c:197
 xfs_iget_cache_miss fs/xfs/xfs_icache.c:740 [inline]
 xfs_iget+0x6b6/0x2330 fs/xfs/xfs_icache.c:799
 xfs_lookup+0x2fb/0x4f0 fs/xfs/xfs_inode.c:553
 xfs_vn_lookup+0x11d/0x1e0 fs/xfs/xfs_iops.c:327
 __lookup_slow+0x28f/0x3c0 fs/namei.c:1916
 lookup_slow+0x5c/0x80 fs/namei.c:1933
 walk_component fs/namei.c:2279 [inline]
 lookup_last fs/namei.c:2780 [inline]
 path_lookupat+0x403/0x8f0 fs/namei.c:2804
 filename_lookup+0x217/0x570 fs/namei.c:2833
 filename_listxattr fs/xattr.c:945 [inline]
 path_listxattrat+0x117/0x3a0 fs/xattr.c:975
 __do_sys_listxattr fs/xattr.c:988 [inline]
 __se_sys_listxattr fs/xattr.c:985 [inline]
 __x64_sys_listxattr+0x8b/0xa0 fs/xattr.c:985
 x64_sys_call+0x1899/0x2900 arch/x86/include/generated/asm/syscalls_64.h:195
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x13f/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

The buggy address belongs to the object at ffff888066ffad00
 which belongs to the cache xfs_inode of size 1776
The buggy address is located 696 bytes inside of
 freed 1776-byte region [ffff888066ffad00, ffff888066ffb3f0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888066ffe180 pfn:0x66ff8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888066ff8719
flags: 0x2000000000000240(workingset|head|zone=1)
page_type: f5(slab)
raw: 2000000000000240 ffff888019fd2640 ffff888019fd1ac8 ffffea0000adde10
raw: ffff888066ffe180 0000078000110009 00000000f5000000 ffff888066ff8719
head: 2000000000000240 ffff888019fd2640 ffff888019fd1ac8 ffffea0000adde10
head: ffff888066ffe180 0000078000110009 00000000f5000000 ffff888066ff8719
head: 2000000000000003 ffffea00019bfe01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 40578, tgid 40575 (syz.3.7187), ts 249736208593, free_ts 245599182745
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x25f/0x490 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x2da9/0x2ed0 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x17c/0x340 mm/page_alloc.c:5250
 alloc_slab_page+0x62/0x130 mm/slub.c:-1
 allocate_slab+0x7a/0x530 mm/slub.c:3444
 new_slab mm/slub.c:3502 [inline]
 refill_objects+0x4bf/0x640 mm/slub.c:7134
 refill_sheaf+0x32/0x50 mm/slub.c:2804
 alloc_full_sheaf mm/slub.c:2825 [inline]
 __pcs_replace_empty_main+0x335/0x580 mm/slub.c:4588
 alloc_from_pcs mm/slub.c:4681 [inline]
 slab_alloc_node mm/slub.c:4815 [inline]
 kmem_cache_alloc_lru_noprof+0x41c/0x4a0 mm/slub.c:4849
 xfs_inode_alloc+0xf8/0x7b0 fs/xfs/xfs_icache.c:97
 xfs_iget_cache_miss fs/xfs/xfs_icache.c:635 [inline]
 xfs_iget+0x635/0x2330 fs/xfs/xfs_icache.c:799
 xfs_mountfs+0xf84/0x2050 fs/xfs/xfs_mount.c:1072
 xfs_fs_fill_super+0x1225/0x16a0 fs/xfs/xfs_super.c:1938
 get_tree_bdev_flags+0x407/0x4d0 fs/super.c:1694
 get_tree_bdev+0x28/0x30 fs/super.c:1717
 xfs_fs_get_tree+0x25/0x30 fs/xfs/xfs_super.c:1985
page last free pid 5023 tgid 5023 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0xb63/0x1040 mm/page_alloc.c:2978
 free_frozen_pages+0x14/0x20 mm/page_alloc.c:3016
 __free_slab+0x1a2/0x290 mm/slub.c:3518
 free_slab+0xdd/0x100 mm/slub.c:3552
 discard_slab+0x28/0x30 mm/slub.c:3558
 __slab_free+0x2a8/0x2b0 mm/slub.c:5532
 ___cache_free+0x72/0x80 mm/slub.c:6199
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0xa3/0x110 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x13f/0x150 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x28/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4501 [inline]
 slab_alloc_node mm/slub.c:4830 [inline]
 __do_kmalloc_node mm/slub.c:5218 [inline]
 __kmalloc_noprof+0x329/0x610 mm/slub.c:5231
 kmalloc_noprof include/linux/slab.h:966 [inline]
 tomoyo_realpath_from_path+0x172/0x710 security/tomoyo/realpath.c:251
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x208/0x460 security/tomoyo/file.c:827
 tomoyo_inode_getattr+0x25/0x30 security/tomoyo/tomoyo.c:123
 security_inode_getattr+0x1eb/0x3d0 security/security.c:1869
 vfs_getattr fs/stat.c:259 [inline]
 vfs_fstat fs/stat.c:281 [inline]
 __do_sys_newfstat fs/stat.c:551 [inline]
 __se_sys_newfstat+0xe9/0x3e0 fs/stat.c:546

Memory state around the buggy address:
 ffff888066ffae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888066ffaf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888066ffaf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888066ffb000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888066ffb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

                 reply	other threads:[~2026-06-26 21:29 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6a3eef31.2bc1d9cf.3ebea.506b@mx.google.com \
    --to=sanan.hasanou@gmail.com \
    --cc=brauner@kernel.org \
    --cc=contact@pgazz.com \
    --cc=jack@suse.cz \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.