From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj2-f1.google.com (mail-pj2-f1.google.com [74.125.227.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C1C9481FA5 for ; Wed, 1 Jul 2026 13:17:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.129 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782911831; cv=none; b=UEiHqo8yYl1DrcYyxxOhPWFoEq4tfbVlQ9Whr7jKdMoNu4G9T7EcczaIya92SiKBB0haZOi8HqM9E5YNJrg8uw3eX8PuDlTmPUisW+/hVdvNIb6DQgPV1hfWWlezYl3RVcigpLTdFEZ3I923AH6vbOUroI1IVdS7yd5zzbtK7RM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782911831; c=relaxed/simple; bh=zPE7UMZ3qKtKwpd/VqKMkqn0PqhkyEss7hmcUFm5+As=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bYMM4zcRJcNKlXyYWMDx8p59DfzMiNH9i70qpbLP+xAo4lgyh/Tn/qrNrrqw1dgrfOmvPgd6sK+rqfnONsTKqScfK5AIWjc4X7t0zbIoM9O/4wKBv88ST9bzByS7rWED4+2tqsmDb+zcKW7ZRUvLFk1QqdC5xeHQ8Zmxf9u3bR4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XB9Cy1gU; arc=none smtp.client-ip=74.125.227.129 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XB9Cy1gU" Received: by mail-pj2-f1.google.com with SMTP id d9443c01a7336-2c92ee66a21so1678055ad.0 for ; Wed, 01 Jul 2026 06:17:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782911829; x=1783516629; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=EhdKovstj5wOL0OrmNNoLk6CAFA0IOcvZ3J/XZB8tu0=; b=XB9Cy1gUFrUGq+6uM0xBbPWMJKX7rcK8ofGdTBGb3A/kHlyhHTpzPGPHZtNhcKzjwi OjAlk8ATJrHA17wqvoAuzxjhNG1ZNtIecxBn/7622ZpYVaYVWJeOUCOoAjVlCSDRzB/w lrtXF6HYgeIKsjLld0YlQslaVhoMl6vJHrE+Eo17EryDXqj0TaKwE8Wtf4Hv96Rplry8 DVzzwTxeih6z7W6+Y5RFT24G6hu4P+JyaC/MVIn4JIuhIBYaFYqxUhjAIBfPusIQgbbA Rm2Xbh1UbU0W0z9smhBybMnwcaf7axAV4UwM+T1EPcDhK6FF3tClgcIESczoVjIGq+0f ndjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782911829; x=1783516629; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=EhdKovstj5wOL0OrmNNoLk6CAFA0IOcvZ3J/XZB8tu0=; b=jChHq1xXCyM2yx3sVKUeRhU1aTDCyP5JGyLhIERj6NUT2v9ORNuAby6ptD3Jq1niwj jI0ya4YmL1u36OruwuiJfkIUJYytInauzeTGXZe9hifc2jyrRVfh4EBnT4PoOeTvdN1G XT31QG+qhkzULwlP8jD8Yadbqz4mTxcUh35R+5yGF8MmIhP7YUhJU33eBWeO3MsLFCAD HrGtB30UyaYZHs+6xbfAKE2bHMj4cnTsdmaoFavcxNbtASEM1iE21y1/OfGJVSdgnWvC 19IkHCQnJ6UEwem00et4F58xy15CTnUFJ2fS7dJGW+ESOhjgJEg9I+OoDA4OEwI34YPg tdDA== X-Forwarded-Encrypted: i=1; AHgh+RpPQcwekkuh7Jj21k7jguuMkiZUVL8Wy7Y/mB2UnuQMW53eVUJXPSxOyhdiOw7N5r+2wunDDgzMCv8NWUI=@vger.kernel.org X-Gm-Message-State: AOJu0YyqZYmPezXUHxoVP6L3MXIxticfV2l3QHO9oCEh+DjXJhILWKDe yLLZfVEnjwyJGzB9AfcEPEhgA2ivn9NayQb6WQz/x7+pZ9HDoiadfG2Q8GMjOQP+aDLJjA== X-Gm-Gg: AfdE7cmfOIrOxE4Prl5chLl8SiV7DNTVxBPhftvEeNEMTpf/MTKEyPrl1RrKgQDSd3s +UWlxxipmJTb5ZuQQ0HqF6bdXm7Iu1NyDJidg65NbSJYMB+bCXIFSHkFTBB0av601q72ApwXBdm B7iu8y/2NsGHFJb5kCTDlhALRH23Vk33zym7IJ5pHwU3QKGxMrlkaECK0rp8m1NHXSFOSQE+8x6 AjcwKZ+L4m6/Qk6kopTcW1GV07Nbb3OOBR/b3Dpor1wUS963X+P49lQbb0A3ZOf999tbMfTdt+A dKwlZ1QH7z09GCgLGG7+u2aGxWjbdz2d5oyqVXTkw7Wc4o6mTNQTvBNfILr1FJujyhZ344RK6DS dkDKZp2L27cU5DpZ2JPjGVvMK41ug1PBEa13TXaj5arkxUlE386EuBwPbbPpsliS5DLyAeYHiTU BH/mEdKD8T8p3GCjqT0A+6lw== X-Received: by 2002:a17:902:fc8d:b0:2c9:97a7:b1e9 with SMTP id d9443c01a7336-2ca7e91bd60mr18739275ad.40.1782911829328; Wed, 01 Jul 2026 06:17:09 -0700 (PDT) Received: from LAPTOP-1HUHJV8R.lan ([122.230.221.89]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ca3828b0f2sm33012545ad.54.2026.07.01.06.17.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 06:17:08 -0700 (PDT) From: l1za0.sec@gmail.com To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH] sysfs: fix use-after-free in sysfs_create_dir_ns Date: Wed, 1 Jul 2026 21:16:58 +0800 Message-ID: <20260701131658.11369-1-l1za0.sec@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Haocheng Yu A KASAN: slab-use-after-free Read in kernfs_next_descendant_post is reported by a modified Syzkaller-based kernel fuzzing tool we developed. This problem is caused by a race condition between sysfs directory creation for a child kobject and removal of the parent kobject. In this case, the ueagle-atm driver starts an async firmware request for a pre-firmware USB device. The firmware work falls back to the sysfs firmware loader and tries to add a firmware class device under the USB device while usb_disconnect() is removing the USB device from sysfs. sysfs_create_dir_ns() reads kobj->parent->sd without taking a reference to the parent kernfs_node. sysfs_remove_dir() may concurrently detach the same parent from sysfs and drop the last kernfs reference. The following kernfs_create_dir_ns() then uses a freed parent kernfs_node and kernfs_activate() can dereference it, triggering a use-after-free. To fix this vulnerability, take a kernfs reference to the parent while holding sysfs_symlink_target_lock, the same lock that serializes sysfs_remove_dir() against kobj->sd detachment. If the parent has already been detached, fail the creation with -ENOENT. Drop the temporary reference after the child directory creation attempt completes. Signed-off-by: Haocheng Yu --- fs/sysfs/dir.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c index ffdcd4153c58..1883a4380250 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c @@ -46,10 +46,16 @@ int sysfs_create_dir_ns(struct kobject *kobj, const struct ns_common *ns) if (WARN_ON(!kobj)) return -EINVAL; - if (kobj->parent) + if (kobj->parent) { + spin_lock(&sysfs_symlink_target_lock); parent = kobj->parent->sd; - else + if (parent) + kernfs_get(parent); + spin_unlock(&sysfs_symlink_target_lock); + } else { parent = sysfs_root_kn; + kernfs_get(parent); + } if (!parent) return -ENOENT; @@ -61,10 +67,12 @@ int sysfs_create_dir_ns(struct kobject *kobj, const struct ns_common *ns) if (IS_ERR(kn)) { if (PTR_ERR(kn) == -EEXIST) sysfs_warn_dup(parent, kobject_name(kobj)); + kernfs_put(parent); return PTR_ERR(kn); } kobj->sd = kn; + kernfs_put(parent); return 0; } base-commit: 665159e246749578d4e4bfe106ee3b74edcdab18 -- 2.51.0