[BUG] KASAN: slab-use-after-free Read in irq_migrate_all_off_this_cpu

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/164-kasan-slab-use-after-free-read-in-irq-migrate-all-off-this-cpu/

  BUG: KASAN: slab-use-after-free in irq_can_move_pcntxt
kernel/irq/internals.h:305 [inline]
  BUG: KASAN: slab-use-after-free in migrate_one_irq
kernel/irq/cpuhotplug.c:57 [inline]
  BUG: KASAN: slab-use-after-free in
irq_migrate_all_off_this_cpu+0xdf/0xc80 kernel/irq/cpuhotplug.c:181
  Call Trace:
   irq_can_move_pcntxt kernel/irq/internals.h:305 [inline]
   migrate_one_irq kernel/irq/cpuhotplug.c:57 [inline]
   irq_migrate_all_off_this_cpu+0xdf/0xc80 kernel/irq/cpuhotplug.c:181
   fixup_irqs+0x18/0x1e0 arch/x86/kernel/irq.c:527
   cpu_disable_common+0xb27/0xd90 arch/x86/kernel/smpboot.c:1354
   native_cpu_disable+0x2f/0x40 arch/x86/kernel/smpboot.c:1366
   take_cpu_down+0xca/0x330 kernel/cpu.c:1282
   multi_cpu_stop+0x227/0x420 kernel/stop_machine.c:238
   cpu_stopper_thread+0x259/0x3e0 kernel/stop_machine.c:512

  BUG: KASAN: slab-out-of-bounds in
irq_migrate_all_off_this_cpu+0xdf/0xc80 kernel/irq/cpuhotplug.c:181

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,