* Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 11:37 [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove syzbot
@ 2025-04-06 13:13 ` Andy Shevchenko
2025-04-06 13:31 ` syzbot
2025-04-06 13:24 ` Andy Shevchenko
` (4 subsequent siblings)
5 siblings, 1 reply; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-06 13:13 UTC (permalink / raw)
To: syzbot
Cc: dakr, djrscally, gregkh, heikki.krogerus, jgg, kevin.tian,
linux-acpi, linux-kernel, nicolinc, rafael, sakari.ailus,
syzkaller-bugs, yi.l.liu
On Sun, Apr 06, 2025 at 04:37:28AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
#syz test: git@bitbucket.org:andy-shev/linux.git test-swnode
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 13:13 ` Andy Shevchenko
@ 2025-04-06 13:31 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2025-04-06 13:31 UTC (permalink / raw)
To: andriy.shevchenko, dakr, djrscally, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, nicolinc, rafael,
sakari.ailus, syzkaller-bugs, yi.l.liu
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to checkout kernel repo git@bitbucket.org:andy-shev/linux.git/test-swnode: failed to run ["git" "fetch" "--force" "f7e55974102a831d64e9ca077790e9122f71f6c9" "test-swnode"]: exit status 128
Host key verification failed.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Tested on:
commit: [unknown
git tree: git@bitbucket.org:andy-shev/linux.git test-swnode
kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler:
Note: no patches were applied.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 11:37 [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove syzbot
2025-04-06 13:13 ` Andy Shevchenko
@ 2025-04-06 13:24 ` Andy Shevchenko
2025-04-06 14:09 ` syzbot
2025-04-08 14:54 ` Andy Shevchenko
` (3 subsequent siblings)
5 siblings, 1 reply; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-06 13:24 UTC (permalink / raw)
To: syzbot
Cc: dakr, djrscally, gregkh, heikki.krogerus, jgg, kevin.tian,
linux-acpi, linux-kernel, nicolinc, rafael, sakari.ailus,
syzkaller-bugs, yi.l.liu
On Sun, Apr 06, 2025 at 04:37:28AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz
#syz test: https://bitbucket.org/andy-shev/linux.git test-swnode
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 13:24 ` Andy Shevchenko
@ 2025-04-06 14:09 ` syzbot
0 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2025-04-06 14:09 UTC (permalink / raw)
To: andriy.shevchenko, dakr, djrscally, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, nicolinc, rafael,
sakari.ailus, syzkaller-bugs, yi.l.liu
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_secondary_fwnode
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 0000000000000000 R14: 00007f0934da5fa0 R15: 00007ffe7c9dc778
</TASK>
iommufd_mock iommufd_mock0: Adding to iommu group 0
==================================================================
BUG: KASAN: slab-use-after-free in fwnode_is_primary drivers/base/core.c:5105 [inline]
BUG: KASAN: slab-use-after-free in set_secondary_fwnode+0x89/0xd0 drivers/base/core.c:5167
Read of size 8 at addr ffff8880358f0440 by task syz.0.19/6201
CPU: 0 UID: 0 PID: 6201 Comm: syz.0.19 Not tainted 6.14.0-syzkaller-13525-g22ea69445c54 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
fwnode_is_primary drivers/base/core.c:5105 [inline]
set_secondary_fwnode+0x89/0xd0 drivers/base/core.c:5167
software_node_notify_remove+0x1a8/0x1e0 drivers/base/swnode.c:1112
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0934b8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0935a12038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0934da5fa0 RCX: 00007f0934b8d169
RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003
RBP: 00007f0935a12090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 0000000000000000 R14: 00007f0934da5fa0 R15: 00007ffe7c9dc778
</TASK>
Allocated by task 6201:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x236/0x370 mm/slub.c:4362
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
swnode_register+0x5a/0x540 drivers/base/swnode.c:790
fwnode_create_software_node+0x199/0x1f0 drivers/base/swnode.c:949
device_create_managed_software_node+0xd5/0x1f0 drivers/base/swnode.c:1060
mock_dev_create drivers/iommu/iommufd/selftest.c:942 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:989 [inline]
iommufd_test+0x3335/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6201:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2389 [inline]
slab_free mm/slub.c:4646 [inline]
kfree+0x198/0x430 mm/slub.c:4845
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
software_node_notify_remove+0x18d/0x1e0 drivers/base/swnode.c:1109
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880358f0400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 64 bytes inside of
freed 512-byte region [ffff8880358f0400, ffff8880358f0600)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x358f0
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0000d63c01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5211, tgid 5211 (udevd), ts 44437391568, free_ts 41364354329
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1717
prep_new_page mm/page_alloc.c:1725 [inline]
get_page_from_freelist+0x352b/0x36c0 mm/page_alloc.c:3652
__alloc_frozen_pages_noprof+0x211/0x5b0 mm/page_alloc.c:4934
alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2301
alloc_slab_page mm/slub.c:2459 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2623
new_slab mm/slub.c:2676 [inline]
___slab_alloc+0xc3b/0x1500 mm/slub.c:3862
__slab_alloc+0x58/0xa0 mm/slub.c:3952
__slab_alloc_node mm/slub.c:4027 [inline]
slab_alloc_node mm/slub.c:4188 [inline]
__kmalloc_cache_noprof+0x26a/0x370 mm/slub.c:4357
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
kernfs_fop_open+0x3a3/0xdf0 fs/kernfs/file.c:623
do_dentry_open+0xdec/0x1960 fs/open.c:956
vfs_open+0x3b/0x370 fs/open.c:1086
do_open fs/namei.c:3845 [inline]
path_openat+0x2caf/0x35d0 fs/namei.c:4004
do_filp_open+0x284/0x4e0 fs/namei.c:4031
do_sys_openat2+0x12b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x249/0x2a0 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
page last free pid 5213 tgid 5213 stack trace:
create_dummy_stack mm/page_owner.c:94 [inline]
register_dummy_stack+0x8e/0xe0 mm/page_owner.c:100
init_page_owner+0x3e/0x790 mm/page_owner.c:118
invoke_init_callbacks mm/page_ext.c:148 [inline]
page_ext_init+0x731/0x790 mm/page_ext.c:497
mm_core_init+0x5b/0x70 mm/mm_init.c:2783
Memory state around the buggy address:
ffff8880358f0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880358f0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880358f0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880358f0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880358f0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: 22ea6944 software node: Avoid use-after-free access in..
git tree: https://bitbucket.org/andy-shev/linux.git test-swnode
console output: https://syzkaller.appspot.com/x/log.txt?x=1276f404580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f2054704dd53fb80
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 11:37 [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove syzbot
2025-04-06 13:13 ` Andy Shevchenko
2025-04-06 13:24 ` Andy Shevchenko
@ 2025-04-08 14:54 ` Andy Shevchenko
2025-04-10 0:57 ` [syzbot] " syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-08 14:54 UTC (permalink / raw)
To: syzbot
Cc: dakr, djrscally, gregkh, heikki.krogerus, jgg, kevin.tian,
linux-acpi, linux-kernel, nicolinc, rafael, sakari.ailus,
syzkaller-bugs, yi.l.liu
On Sun, Apr 06, 2025 at 04:37:28AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz
>
> The issue was bisected to:
>
> commit 9eb59204d5197b4add63968c8c5b7633631f9a5a
> Author: Yi Liu <yi.l.liu@intel.com>
Liu, have you looked at the issue? It has a good reproducibility ratio and
definitely something with your patch, but it might be still that it revealed
a lurking bug in software node implementation or driver core, however I don't
see it.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [syzbot] Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 11:37 [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove syzbot
` (2 preceding siblings ...)
2025-04-08 14:54 ` Andy Shevchenko
@ 2025-04-10 0:57 ` syzbot
2025-04-10 14:23 ` syzbot
2025-04-11 0:42 ` [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance Lizhi Xu
5 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2025-04-10 0:57 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
Author: lizhi.xu@windriver.com
no register no remove
#syz test
diff --git a/drivers/base/core.c b/drivers/base/core.c
index d2f9d3a59d6b..a4b9fe99aa28 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2384,7 +2384,8 @@ static void device_platform_notify(struct device *dev)
static void device_platform_notify_remove(struct device *dev)
{
- software_node_notify_remove(dev);
+ if (device_is_registered(dev))
+ software_node_notify_remove(dev);
acpi_device_notify_remove(dev);
}
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [syzbot] Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
2025-04-06 11:37 [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove syzbot
` (3 preceding siblings ...)
2025-04-10 0:57 ` [syzbot] " syzbot
@ 2025-04-10 14:23 ` syzbot
2025-04-11 0:42 ` [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance Lizhi Xu
5 siblings, 0 replies; 20+ messages in thread
From: syzbot @ 2025-04-10 14:23 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove
Author: lizhi.xu@windriver.com
any link create fail will not get kobject
#syz test
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index b1726a3515f6..5c78fa6ae772 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1080,6 +1080,7 @@ void software_node_notify(struct device *dev)
if (!swnode)
return;
+ kobject_get(&swnode->kobj);
ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
if (ret)
return;
@@ -1089,8 +1090,6 @@ void software_node_notify(struct device *dev)
sysfs_remove_link(&dev->kobj, "software_node");
return;
}
-
- kobject_get(&swnode->kobj);
}
void software_node_notify_remove(struct device *dev)
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-06 11:37 [syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove syzbot
` (4 preceding siblings ...)
2025-04-10 14:23 ` syzbot
@ 2025-04-11 0:42 ` Lizhi Xu
2025-04-14 6:20 ` Andy Shevchenko
5 siblings, 1 reply; 20+ messages in thread
From: Lizhi Xu @ 2025-04-11 0:42 UTC (permalink / raw)
To: syzbot+2ff22910687ee0dfd48e
Cc: andriy.shevchenko, dakr, djrscally, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, nicolinc, rafael,
sakari.ailus, syzkaller-bugs, yi.l.liu
syzbot reported a uaf in software_node_notify_remove. [1]
When any of the two sysfs_create_link() in software_node_notify() fails,
the swnode->kobj reference count will not increase normally, which will
cause swnode to be released incorrectly due to the imbalance of kobj reference
count when executing software_node_notify_remove().
Increase the reference count of kobj before creating the link to avoid uaf.
[1]
BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844
CPU: 0 UID: 0 PID: 5844 Comm: syz-executor105 Not tainted 6.14.0-syzkaller-12456-gacc4d5ff0b61 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f14c7b0b6e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff388f87b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fff388f87d0 RCX: 00007f14c7b0b6e9
RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003
RBP: 0000000000000002 R08: 00007fff388f8556 R09: 00000000000000a0
R10: 0000000000000002 R11: 0000000000000246 R12: 00007fff388f87cc
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
</TASK>
Allocated by task 5844:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x236/0x370 mm/slub.c:4362
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
swnode_register+0x5a/0x540 drivers/base/swnode.c:790
fwnode_create_software_node+0x199/0x1f0 drivers/base/swnode.c:949
device_create_managed_software_node+0xd5/0x1f0 drivers/base/swnode.c:1060
mock_dev_create drivers/iommu/iommufd/selftest.c:942 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:989 [inline]
iommufd_test+0x3335/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5844:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2389 [inline]
slab_free mm/slub.c:4646 [inline]
kfree+0x198/0x430 mm/slub.c:4845
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
---
drivers/base/swnode.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index b1726a3515f6..5c78fa6ae772 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1080,6 +1080,7 @@ void software_node_notify(struct device *dev)
if (!swnode)
return;
+ kobject_get(&swnode->kobj);
ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
if (ret)
return;
@@ -1089,8 +1090,6 @@ void software_node_notify(struct device *dev)
sysfs_remove_link(&dev->kobj, "software_node");
return;
}
-
- kobject_get(&swnode->kobj);
}
void software_node_notify_remove(struct device *dev)
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-11 0:42 ` [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance Lizhi Xu
@ 2025-04-14 6:20 ` Andy Shevchenko
2025-04-14 6:27 ` Andy Shevchenko
` (2 more replies)
0 siblings, 3 replies; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-14 6:20 UTC (permalink / raw)
To: Lizhi Xu, Dmitry Vyukov
Cc: syzbot+2ff22910687ee0dfd48e, dakr, djrscally, gregkh,
heikki.krogerus, jgg, kevin.tian, linux-acpi, linux-kernel,
nicolinc, rafael, sakari.ailus, syzkaller-bugs, yi.l.liu
On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> syzbot reported a uaf in software_node_notify_remove. [1]
>
> When any of the two sysfs_create_link() in software_node_notify() fails,
> the swnode->kobj reference count will not increase normally, which will
> cause swnode to be released incorrectly due to the imbalance of kobj reference
> count when executing software_node_notify_remove().
>
> Increase the reference count of kobj before creating the link to avoid uaf.
>
> [1]
Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
recommends to put backtraces in the commit messages:
https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages
> Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
Where is the positive result of it? I can't find the respective log.
To me this one
https://syzkaller.appspot.com/x/report.txt?x=158af070580000
doesn't sound as a useful report as I don't know if this patch fixes one
regression and introduced another.
Dmitry?
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-14 6:20 ` Andy Shevchenko
@ 2025-04-14 6:27 ` Andy Shevchenko
2025-04-14 7:08 ` Lizhi Xu
2025-04-14 7:11 ` [PATCH V2] " Lizhi Xu
2 siblings, 0 replies; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-14 6:27 UTC (permalink / raw)
To: Lizhi Xu, Dmitry Vyukov
Cc: syzbot+2ff22910687ee0dfd48e, dakr, djrscally, gregkh,
heikki.krogerus, jgg, kevin.tian, linux-acpi, linux-kernel,
nicolinc, rafael, sakari.ailus, syzkaller-bugs, yi.l.liu
On Mon, Apr 14, 2025 at 09:20:30AM +0300, Andy Shevchenko wrote:
> On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> > syzbot reported a uaf in software_node_notify_remove. [1]
> >
> > When any of the two sysfs_create_link() in software_node_notify() fails,
> > the swnode->kobj reference count will not increase normally, which will
> > cause swnode to be released incorrectly due to the imbalance of kobj reference
> > count when executing software_node_notify_remove().
> >
> > Increase the reference count of kobj before creating the link to avoid uaf.
> >
> > [1]
>
> Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
> recommends to put backtraces in the commit messages:
> https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages
>
> > Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> > Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
>
> > Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
>
> Where is the positive result of it? I can't find the respective log.
> To me this one
> https://syzkaller.appspot.com/x/report.txt?x=158af070580000
> doesn't sound as a useful report as I don't know if this patch fixes one
> regression and introduced another.
>
> Dmitry?
Code wise makes sense to me. We do the put in asymmetrical order.
Thanks for looking into it.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-14 6:20 ` Andy Shevchenko
2025-04-14 6:27 ` Andy Shevchenko
@ 2025-04-14 7:08 ` Lizhi Xu
2025-04-14 7:16 ` Andy Shevchenko
2025-04-14 7:11 ` [PATCH V2] " Lizhi Xu
2 siblings, 1 reply; 20+ messages in thread
From: Lizhi Xu @ 2025-04-14 7:08 UTC (permalink / raw)
To: andriy.shevchenko
Cc: dakr, djrscally, dvyukov, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, lizhi.xu, nicolinc, rafael,
sakari.ailus, syzbot+2ff22910687ee0dfd48e, syzkaller-bugs,
yi.l.liu
On Mon, 14 Apr 2025 09:20:30 +0300, Andy Shevchenko wrote:
> On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> > syzbot reported a uaf in software_node_notify_remove. [1]
> >
> > When any of the two sysfs_create_link() in software_node_notify() fails,
> > the swnode->kobj reference count will not increase normally, which will
> > cause swnode to be released incorrectly due to the imbalance of kobj reference
> > count when executing software_node_notify_remove().
> >
> > Increase the reference count of kobj before creating the link to avoid uaf.
> >
> > [1]
>
> Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
> recommends to put backtraces in the commit messages:
> https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages
Ok, I will reduce the calltrace, and send V2 patch.
>
> > Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> > Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
>
> > Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
>
> Where is the positive result of it? I can't find the respective log.
> To me this one
> https://syzkaller.appspot.com/x/report.txt?x=158af070580000
> doesn't sound as a useful report as I don't know if this patch fixes one
> regression and introduced another.
You can see: https://syzkaller.appspot.com/x/log.txt?x=118af07058000
For tasks related to the reproducing program, there are only FAULT_INJECTION
related problems in the log, no other problems, and the log record duration
exceeds 240 seconds, and no uaf occurs, which is enough to prove that the
problem has been fixed.
BR,
Lizhi
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-14 7:08 ` Lizhi Xu
@ 2025-04-14 7:16 ` Andy Shevchenko
0 siblings, 0 replies; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-14 7:16 UTC (permalink / raw)
To: Lizhi Xu
Cc: dakr, djrscally, dvyukov, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, nicolinc, rafael,
sakari.ailus, syzbot+2ff22910687ee0dfd48e, syzkaller-bugs,
yi.l.liu
On Mon, Apr 14, 2025 at 03:08:34PM +0800, Lizhi Xu wrote:
> On Mon, 14 Apr 2025 09:20:30 +0300, Andy Shevchenko wrote:
> > On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> > > syzbot reported a uaf in software_node_notify_remove. [1]
> > >
> > > When any of the two sysfs_create_link() in software_node_notify() fails,
> > > the swnode->kobj reference count will not increase normally, which will
> > > cause swnode to be released incorrectly due to the imbalance of kobj reference
> > > count when executing software_node_notify_remove().
> > >
> > > Increase the reference count of kobj before creating the link to avoid uaf.
> > >
> > > [1]
> >
> > Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
> > recommends to put backtraces in the commit messages:
> > https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages
> Ok, I will reduce the calltrace, and send V2 patch.
> >
> > > Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> > > Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> >
> > > Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> >
> > Where is the positive result of it? I can't find the respective log.
> > To me this one
> > https://syzkaller.appspot.com/x/report.txt?x=158af070580000
> > doesn't sound as a useful report as I don't know if this patch fixes one
> > regression and introduced another.
> You can see: https://syzkaller.appspot.com/x/log.txt?x=118af07058000
> For tasks related to the reproducing program, there are only FAULT_INJECTION
> related problems in the log, no other problems, and the log record duration
> exceeds 240 seconds, and no uaf occurs, which is enough to prove that the
> problem has been fixed.
I'm not objecting that the original issue is being fixed, what I'm confused on
is that the report has only one line which doesn't make it clear that there are
no new regressions found during the same run.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH V2] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-14 6:20 ` Andy Shevchenko
2025-04-14 6:27 ` Andy Shevchenko
2025-04-14 7:08 ` Lizhi Xu
@ 2025-04-14 7:11 ` Lizhi Xu
2025-04-14 7:22 ` Andy Shevchenko
2025-04-14 8:41 ` Sakari Ailus
2 siblings, 2 replies; 20+ messages in thread
From: Lizhi Xu @ 2025-04-14 7:11 UTC (permalink / raw)
To: andriy.shevchenko
Cc: dakr, djrscally, dvyukov, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, lizhi.xu, nicolinc, rafael,
sakari.ailus, syzbot+2ff22910687ee0dfd48e, syzkaller-bugs,
yi.l.liu
syzbot reported a uaf in software_node_notify_remove. [1]
When any of the two sysfs_create_link() in software_node_notify() fails,
the swnode->kobj reference count will not increase normally, which will
cause swnode to be released incorrectly due to the imbalance of kobj reference
count when executing software_node_notify_remove().
Increase the reference count of kobj before creating the link to avoid uaf.
[1]
BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844
Freed by task 5844:
software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
device_platform_notify_remove drivers/base/core.c:2387 [inline]
Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
---
V1 -> V2: reduce calltrace
drivers/base/swnode.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index b1726a3515f6..5c78fa6ae772 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1080,6 +1080,7 @@ void software_node_notify(struct device *dev)
if (!swnode)
return;
+ kobject_get(&swnode->kobj);
ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
if (ret)
return;
@@ -1089,8 +1090,6 @@ void software_node_notify(struct device *dev)
sysfs_remove_link(&dev->kobj, "software_node");
return;
}
-
- kobject_get(&swnode->kobj);
}
void software_node_notify_remove(struct device *dev)
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [PATCH V2] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-14 7:11 ` [PATCH V2] " Lizhi Xu
@ 2025-04-14 7:22 ` Andy Shevchenko
2025-04-14 8:41 ` Sakari Ailus
1 sibling, 0 replies; 20+ messages in thread
From: Andy Shevchenko @ 2025-04-14 7:22 UTC (permalink / raw)
To: Lizhi Xu
Cc: dakr, djrscally, dvyukov, gregkh, heikki.krogerus, jgg,
kevin.tian, linux-acpi, linux-kernel, nicolinc, rafael,
sakari.ailus, syzbot+2ff22910687ee0dfd48e, syzkaller-bugs,
yi.l.liu
On Mon, Apr 14, 2025 at 03:11:23PM +0800, Lizhi Xu wrote:
> syzbot reported a uaf in software_node_notify_remove. [1]
>
> When any of the two sysfs_create_link() in software_node_notify() fails,
> the swnode->kobj reference count will not increase normally, which will
> cause swnode to be released incorrectly due to the imbalance of kobj reference
> count when executing software_node_notify_remove().
>
> Increase the reference count of kobj before creating the link to avoid uaf.
>
> [1]
> BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
> Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844
> Freed by task 5844:
> software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
> device_platform_notify_remove drivers/base/core.c:2387 [inline]
The fix looks correct to me,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH V2] software node: Prevent link creation failure from causing kobj reference count imbalance
2025-04-14 7:11 ` [PATCH V2] " Lizhi Xu
2025-04-14 7:22 ` Andy Shevchenko
@ 2025-04-14 8:41 ` Sakari Ailus
1 sibling, 0 replies; 20+ messages in thread
From: Sakari Ailus @ 2025-04-14 8:41 UTC (permalink / raw)
To: Lizhi Xu
Cc: andriy.shevchenko, dakr, djrscally, dvyukov, gregkh,
heikki.krogerus, jgg, kevin.tian, linux-acpi, linux-kernel,
nicolinc, rafael, syzbot+2ff22910687ee0dfd48e, syzkaller-bugs,
yi.l.liu
On Mon, Apr 14, 2025 at 03:11:23PM +0800, Lizhi Xu wrote:
> syzbot reported a uaf in software_node_notify_remove. [1]
>
> When any of the two sysfs_create_link() in software_node_notify() fails,
> the swnode->kobj reference count will not increase normally, which will
> cause swnode to be released incorrectly due to the imbalance of kobj reference
> count when executing software_node_notify_remove().
>
> Increase the reference count of kobj before creating the link to avoid uaf.
>
> [1]
> BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
> Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844
> Freed by task 5844:
> software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
> device_platform_notify_remove drivers/base/core.c:2387 [inline]
>
> Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> Reported-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> Tested-by: syzbot+2ff22910687ee0dfd48e@syzkaller.appspotmail.com
> Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> ---
> V1 -> V2: reduce calltrace
>
> drivers/base/swnode.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
> index b1726a3515f6..5c78fa6ae772 100644
> --- a/drivers/base/swnode.c
> +++ b/drivers/base/swnode.c
> @@ -1080,6 +1080,7 @@ void software_node_notify(struct device *dev)
> if (!swnode)
> return;
>
> + kobject_get(&swnode->kobj);
> ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
> if (ret)
> return;
> @@ -1089,8 +1090,6 @@ void software_node_notify(struct device *dev)
> sysfs_remove_link(&dev->kobj, "software_node");
> return;
> }
> -
> - kobject_get(&swnode->kobj);
> }
>
> void software_node_notify_remove(struct device *dev)
> --
> 2.43.0
>
--
Sakari Ailus
^ permalink raw reply [flat|nested] 20+ messages in thread