Re: [syzbot] Re: [syzbot] [ext4?] KASAN: slab-use-after-free Read in fsnotify

[syzbot <syzbot+5e3f9b2a67b45f16d4e6@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [ext4?] KASAN: slab-use-after-free Read in fsnotify
Author: hdanton@sina.com

On Thu, 11 Apr 2024 01:11:20 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    6ebf211bb11d Add linux-next specific files for 20240410
> git tree:       linux-next
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1621af9d180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  6ebf211bb11d

--- x/fs/notify/fsnotify.c
+++ y/fs/notify/fsnotify.c
@@ -101,8 +101,8 @@ void fsnotify_sb_delete(struct super_blo
 	wait_var_event(fsnotify_sb_watched_objects(sb),
 		       !atomic_long_read(fsnotify_sb_watched_objects(sb)));
 	WARN_ON(fsnotify_sb_has_priority_watchers(sb, FSNOTIFY_PRIO_CONTENT));
-	WARN_ON(fsnotify_sb_has_priority_watchers(sb,
-						  FSNOTIFY_PRIO_PRE_CONTENT));
+	WARN_ON(fsnotify_sb_has_priority_watchers(sb, FSNOTIFY_PRIO_PRE_CONTENT));
+	synchronize_srcu(&fsnotify_mark_srcu);
 	kfree(sbinfo);
 }
 
@@ -499,7 +499,7 @@ int fsnotify(__u32 mask, const void *dat
 {
 	const struct path *path = fsnotify_data_path(data, data_type);
 	struct super_block *sb = fsnotify_data_sb(data, data_type);
-	struct fsnotify_sb_info *sbinfo = fsnotify_sb_info(sb);
+	struct fsnotify_sb_info *sbinfo;
 	struct fsnotify_iter_info iter_info = {};
 	struct mount *mnt = NULL;
 	struct inode *inode2 = NULL;
@@ -529,6 +529,8 @@ int fsnotify(__u32 mask, const void *dat
 		inode2_type = FSNOTIFY_ITER_TYPE_PARENT;
 	}
 
+	iter_info.srcu_idx = srcu_read_lock(&fsnotify_mark_srcu);
+	sbinfo = fsnotify_sb_info(sb);
 	/*
 	 * Optimization: srcu_read_lock() has a memory barrier which can
 	 * be expensive.  It protects walking the *_fsnotify_marks lists.
@@ -539,8 +541,10 @@ int fsnotify(__u32 mask, const void *dat
 	if ((!sbinfo || !sbinfo->sb_marks) &&
 	    (!mnt || !mnt->mnt_fsnotify_marks) &&
 	    (!inode || !inode->i_fsnotify_marks) &&
-	    (!inode2 || !inode2->i_fsnotify_marks))
-		return 0;
+	    (!inode2 || !inode2->i_fsnotify_marks)) {
+		ret = 0;
+		goto out;
+	}
 
 	marks_mask = sb->s_fsnotify_mask;
 	if (mnt)
@@ -558,10 +562,10 @@ int fsnotify(__u32 mask, const void *dat
 	 * Otherwise, return if none of the marks care about this type of event.
 	 */
 	test_mask = (mask & ALL_FSNOTIFY_EVENTS);
-	if (!(test_mask & marks_mask))
-		return 0;
-
-	iter_info.srcu_idx = srcu_read_lock(&fsnotify_mark_srcu);
+	if (!(test_mask & marks_mask)) {
+		ret = 0;
+		goto out;
+	}
 
 	if (sbinfo) {
 		iter_info.marks[FSNOTIFY_ITER_TYPE_SB] =
--