[BUG] KASAN: use-after-free in mutex optimistic spin (owner_on_cpu) via sysfs uevent_show [bna] [syzkaller]

[Yang Zi]

Hi,

While fuzzing v5.15.212 with syzkaller (KASAN), we hit a use-after-free in the mutex
optimistic-spin path. Reading the `uevent` sysfs attribute of a bna NIC device takes 
`device_lock()`; the spin can read the `on_cpu` field of a `task_struct`
that has already been RCU-freed.

Reproducer summary:

    BUG: KASAN: use-after-free in owner_on_cpu include/linux/sched.h [inline]
    BUG: KASAN: use-after-free in mutex_can_spin_on_owner kernel/locking/mutex.c:401 [inline]
    BUG: KASAN: use-after-free in mutex_optimistic_spin+0x102/0x210 kernel/locking/mutex.c:445
    Read of size 4 at addr ffff8880077c34 by task systemd-journal/5284

    Call trace (systemd-journal/5284):
      ksys_read -> vfs_read -> seq_read_iter -> sysfs_kf_seq_show
        dev_attr_show  drivers/base/core.c:2110
        uevent_show    drivers/base/core.c:2408
        device_lock
        __mutex_lock_common  kernel/locking/mutex.c:599
        mutex_optimistic_spin kernel/locking/mutex.c:445
        mutex_can_spin_on_owner kernel/locking/mutex.c:401   <-- UAF Read (4B)

The victim is a `task_struct` (kmem_cache size 6400, offset 52 → `->on_cpu`)
freed via RCU by ksoftirqd (task 11, `rcu_do_batch->kmem_cache_free`) after a
usermodehelper thread exited (`put_task_struct_rcu_user` →
`wait_task_zombie`). `mutex_can_spin_on_owner()` still dereferences the stale
`lock->owner` pointer.

Root cause is identical to the known "mutex optimistic-spin owner lifetime"
issue: the optimistic-spin fast path reads `owner->on_cpu` with no
`get_task_struct()` / RCU-read-lock / `task_lock` protecting the owner pointer.

The crash report attached below:

BUG: KASAN: use-after-free in mutex_can_spin_on_owner kernel/locking/mutex.c:401 [inline]
BUG: KASAN: use-after-free in mutex_optimistic_spin+0x102/0x210 kernel/locking/mutex.c:445
Read of size 4 at addr ffff888007611a34 by task systemd-journal/5284

CPU: 0 PID: 5284 Comm: systemd-journal Tainted: G      D W  O      5.15.212 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xa5/0xf0 lib/dump_stack.c:106
 print_address_description+0x75/0x2b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x106/0x160 mm/kasan/report.c:451
 mutex_can_spin_on_owner kernel/locking/mutex.c:401 [inline]
 mutex_optimistic_spin+0x102/0x210 kernel/locking/mutex.c:445
 __mutex_lock_common+0x11f/0x1220 kernel/locking/mutex.c:599
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 device_lock include/linux/device.h:809 [inline]
 uevent_show+0x103/0x220 drivers/base/core.c:2408
 dev_attr_show+0x38/0xa0 drivers/base/core.c:2110
 sysfs_kf_seq_show+0x1f1/0x310 fs/sysfs/file.c:61
 seq_read_iter+0x2f9/0x910 fs/seq_file.c:230
 call_read_iter include/linux/fs.h:2167 [inline]
 new_sync_read fs/read_write.c:404 [inline]
 vfs_read+0x651/0x780 fs/read_write.c:485
 ksys_read+0xd9/0x190 fs/read_write.c:623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x53/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x6c/0xd6
RIP: 0033:0x7eff9fbdba61
Code: 00 48 8b 15 b9 73 0e 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 40 c4 01 00 f3 0f 1e fa 80 3d e5 f5 0e 00 00 74 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec
RSP: 002b:00007ffd76160d18 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000001008 RCX: 00007eff9fbdba61
RDX: 0000000000001008 RSI: 000055b3db74fdb0 RDI: 0000000000000014
RBP: 00007ffd76160e20 R08: 00007eff9fcc3b20 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000014
R13: 0000000000001008 R14: ffffffffffffffff R15: 000055b3db74fdb0
 </TASK>

Allocated by task 3073:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x92/0xd0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x50/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 kmem_cache_alloc_node+0x140/0x260 mm/slub.c:3261
 alloc_task_struct_node kernel/fork.c:173 [inline]
 dup_task_struct+0x60/0x470 kernel/fork.c:896
 copy_process+0x3e0/0x2250 kernel/fork.c:2122
 kernel_clone+0x168/0x640 kernel/fork.c:2681
 kernel_thread+0x66/0x90 kernel/fork.c:2733
 call_usermodehelper_exec_sync kernel/umh.c:135 [inline]
 call_usermodehelper_exec_work+0x7a/0x170 kernel/umh.c:166
 process_one_work+0x5f6/0x980 kernel/workqueue.c:2310
 worker_thread+0x54f/0xa30 kernel/workqueue.c:2457
 kthread+0x295/0x2d0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Freed by task 11:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xfd/0x140 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1710 [inline]
 slab_free_freelist_hook+0xf3/0x180 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kmem_cache_free+0xab/0x210 mm/slub.c:3520
 rcu_do_batch kernel/rcu/tree.c:2523 [inline]
 rcu_core+0x5a1/0xc00 kernel/rcu/tree.c:2763
 handle_softirqs+0x2b2/0x520 kernel/softirq.c:576
 run_ksoftirqd+0x45/0x90 kernel/softirq.c:943
 smpboot_thread_fn+0x2d9/0x410 kernel/smpboot.c:164
 kthread+0x295/0x2d0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Last potentially related work creation:
 kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xb2/0xe0 mm/kasan/generic.c:348
 __call_rcu kernel/rcu/tree.c:3011 [inline]
 call_rcu+0x7d/0x650 kernel/rcu/tree.c:3091
 wait_task_zombie kernel/exit.c:1183 [inline]
 wait_consider_task+0x1071/0x1ad0 kernel/exit.c:1410
 do_wait_pid kernel/exit.c:1541 [inline]
 do_wait+0x432/0x6e0 kernel/exit.c:1583
 kernel_wait+0x4e/0xc0 kernel/exit.c:1770
 call_usermodehelper_exec_sync kernel/umh.c:139 [inline]
 call_usermodehelper_exec_work+0x9c/0x170 kernel/umh.c:166
 process_one_work+0x5f6/0x980 kernel/workqueue.c:2310
 worker_thread+0x54f/0xa30 kernel/workqueue.c:2457
 kthread+0x295/0x2d0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Second to last potentially related work creation:
 kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xb2/0xe0 mm/kasan/generic.c:348
 __call_rcu kernel/rcu/tree.c:3011 [inline]
 call_rcu+0x7d/0x650 kernel/rcu/tree.c:3091
 wait_task_zombie kernel/exit.c:1183 [inline]
 wait_consider_task+0x1071/0x1ad0 kernel/exit.c:1410
 do_wait_pid kernel/exit.c:1541 [inline]
 do_wait+0x432/0x6e0 kernel/exit.c:1583
 kernel_wait+0x4e/0xc0 kernel/exit.c:1770
 call_usermodehelper_exec_sync kernel/umh.c:139 [inline]
 call_usermodehelper_exec_work+0x9c/0x170 kernel/umh.c:166
 process_one_work+0x5f6/0x980 kernel/workqueue.c:2310
 worker_thread+0x54f/0xa30 kernel/workqueue.c:2457
 kthread+0x295/0x2d0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

The buggy address belongs to the object at ffff888007611a00
 which belongs to the cache task_struct of size 6400
The buggy address is located 52 bytes inside of
 6400-byte region [ffff888007611a00, ffff888007613300)
The buggy address belongs to the page:
page:0000000025818919 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7610
head:0000000025818919 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88800d92ef81
flags: 0x100000000010200(slab|head|node=0|zone=1)
raw: 0100000000010200 dead000000000100 dead000000000122 ffff888006c00500
raw: 0000000000000000 0000000000040004 00000001ffffffff ffff88800d92ef81
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888007611900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888007611980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888007611a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff888007611a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888007611b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Regards,
Yang Zi