[PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

[PATCH] NFS: sysfs: fix use-after-free on delayed kobject release

[Vasileios Almpanis]

struct nfs_netns_client embeds two kobjects and is freed by
nfs_netns_object_release(), the release function of nfs_net_kobj.
Despite that the first one, p->kobject lives in the same allocation.
Nothing keeps the allocation from being freed before p->kobject
has been released.

When CONFIG_DEBUG_KOBJECT_RELEASE=y each release is instead deferred to
a delayed_work embedded in the kobject, with an independent random
delay, and nfs_net_kobj frees the allocation first in some of those
cases. p->kobject's timer is then left armed inside freed memory, and
the following splat appears:

  [  139.805951][  T131] kobject: 'nfs_client' (ffff888027fdb800): kobject_release, parent 0000000000000000 (delayed 300)
  [  139.808019][  T131] kobject: 'net' (ffff888027fdb898): kobject_release, parent 0000000000000000 (delayed 100)

  BUG: KASAN: slab-use-after-free in __run_timers+0x932/0x980
  Write of size 8 at addr ffff888027fdb868 by task swapper/0/0

Reproduced on a KASAN kernel with CONFIG_NFS_FS=y and
CONFIG_DEBUG_KOBJECT_RELEASE=y by:

  for i in $(seq 16); do unshare -n true; done; sleep 20

Give p->kobject a reference on nfs_net_kobj for its whole lifetime and
drop it from nfs_netns_client_release(), so the allocation is always
freed after p->kobject has been released.

Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique")
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
---
 fs/nfs/sysfs.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c
index 3a197252a1329b30b7b957ee97a437bf18aa5d5b..a5ea51b5935ae700b32123da9ddfb676fa76889b 100644
--- a/fs/nfs/sysfs.c
+++ b/fs/nfs/sysfs.c
@@ -126,6 +126,7 @@ static void nfs_netns_client_release(struct kobject *kobj)
 			kobject);
 
 	kfree(rcu_dereference_raw(c->identifier));
+	kobject_put(&c->nfs_net_kobj);
 }
 
 static const struct ns_common *nfs_netns_client_namespace(const struct kobject *kobj)
@@ -187,6 +188,13 @@ static struct nfs_netns_client *nfs_netns_client_alloc(struct kobject *parent,
 			return NULL;
 		}
 
+		/*
+		 * nfs_net_kobj's release frees the allocation that p->kobject
+		 * itself lives in, so p->kobject holds a reference on it for
+		 * its entire lifetime, dropped by nfs_netns_client_release().
+		 */
+		kobject_get(&p->nfs_net_kobj);
+
 		if (kobject_init_and_add(&p->kobject, &nfs_netns_client_type,
 					&p->nfs_net_kobj, "nfs_client") == 0)
 			return p;

---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260803-nfs-0c6b72947c23

Best regards,
-- 
Vasileios Almpanis <vasilisalmpanis@gmail.com>