Re: [BUG] KASAN: slab-use-after-free in pci_endpoint_test_ioctl

["Krzysztof Wilczyński" <kwilczynski@kernel.org>]

Hello,

> I hit the following report while testing current upstream kernel:
> 
> KASAN: slab-use-after-free in pci_endpoint_test_ioctl
> 
> I reproduced this on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
> 
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/1e03464adfefbb75fb5d8112691e38b3

The proof-of-concept you have there can be distilled down to:

#include <fcntl.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define BDF "0000:XX:YY.Z"

int main(void)
{
	int fd = open("/dev/pci-endpoint-test.0", O_RDWR);
	int u = open("/sys/bus/pci/drivers/pci-endpoint-test/unbind", O_WRONLY);

	if (write(u, BDF, strlen(BDF)) < 0)
		return 1;

	ioctl(fd, 0);
	return 0;
}

Only required steps would be to update the BDF definition with the
relevant device address, and then bind the right device prior to
running the proof-of-concept binary:

  $ echo "1234 0987" > /sys/bus/pci/drivers/pci-endpoint-test/new_id

> [  222.372449][ T8376] Call Trace:
> [  222.372455][ T8376]  <TASK>
> [  222.372460][ T8376]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> [  222.372476][ T8376]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> [  222.372531][ T8376]  kasan_report (mm/kasan/report.c:595)
> [  222.372558][ T8376]  pci_endpoint_test_ioctl (drivers/misc/pci_endpoint_test.c:1145)
> [  222.372604][ T8376]  __se_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:597 fs/ioctl.c:583)
> [  222.372615][ T8376]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> [  222.372647][ T8376]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> [  222.372658][ T8376] RIP: 0033:0x7fd68c893237
> [  222.372668][ T8376] Code: 00 00 00 48 8b 05 59 cc 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 29 cc 0d 00 f7 d8 64 89 01 48
> [  222.372678][ T8376] RSP: 002b:00007ffc1aa73f18 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
> [  222.372693][ T8376] RAX: ffffffffffffffda RBX: 00007fd68c9774c0 RCX: 00007fd68c893237
> [  222.372701][ T8376] RDX: 0000000000000000 RSI: 0000000000005009 RDI: 0000000000000003
> [  222.372707][ T8376] RBP: 0000560e1af360c3 R08: 0000000000000000 R09: 00007ffc1aa73e27
> [  222.372714][ T8376] R10: fffffffffffff64d R11: 0000000000000206 R12: 0000000000000003
> [  222.372719][ T8376] R13: 0000000000005009 R14: 0000000000000000 R15: 00007ffc1aa73f80
> [  222.372731][ T8376]  </TASK>
> [  222.372735][ T8376]
> [  222.392098][ T8376] Freed by task 8376 on cpu 0 at 222.263660s:
> [  222.392729][ T8376]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
> [  222.393215][ T8376]  kasan_save_free_info (mm/kasan/generic.c:584)
> [  222.393743][ T8376]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
> [  222.394242][ T8376]  kfree (include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
> [  222.394657][ T8376]  devres_release_all (drivers/base/devres.c:50 drivers/base/devres.c:547 drivers/base/devres.c:576)
> [  222.395176][ T8376]  device_release_driver_internal (drivers/base/dd.c:598 drivers/base/dd.c:1357 drivers/base/dd.c:1375)
> [  222.395807][ T8376]  unbind_store (drivers/base/bus.c:244)
> [  222.396280][ T8376]  kernfs_fop_write_iter (fs/kernfs/file.c:352)
> [  222.396832][ T8376]  vfs_write (fs/read_write.c:595 fs/read_write.c:688)
> [  222.397273][ T8376]  ksys_write (fs/read_write.c:740)
> [  222.397725][ T8376]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> [  222.398207][ T8376]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> [  222.398823][ T8376]
> [  222.399073][ T8376] The buggy address belongs to the object at ffff88811be68400
> [  222.399073][ T8376]  which belongs to the cache kmalloc-512 of size 512
> [  222.400509][ T8376] The buggy address is located 56 bytes inside of
> [  222.400509][ T8376]  freed 512-byte region [ffff88811be68400, ffff88811be68600)

At first glance, it looks like the file descriptor outlives the driver
binding.  An open file descriptor doesn't block unbind via sysfs, and
misc_deregister() doesn't revoke currently open file descriptors either.

The struct pci_endpoint_test has to stay alive until both the driver is
unbound and the last open file descriptor is closed - whichever happens
last, whereas devres frees it as soon as the driver is unbound, regardless
of any file descriptor that is still open.  Hence the dangling reference
and the use-after-free.

Thank you!

	Krzysztof