Re: [syzbot] KASAN: use-after-free Read in kernfs_get

[Tejun Heo]

On Mon, Mar 14, 2022 at 06:49:19AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    09688c0166e7 Linux 5.17-rc8
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11b42729700000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=6da459dcfde3b8d0
> dashboard link: https://syzkaller.appspot.com/bug?extid=97a16334dbd58916f7fb
> compiler:       Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+97a16334dbd58916f7fb@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> usb 1-1: Direct firmware load for ueagle-atm/adi930.fw failed with error -2
> usb 1-1: Falling back to sysfs fallback for: ueagle-atm/adi930.fw
> ==================================================================
> BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline]
> BUG: KASAN: use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
> BUG: KASAN: use-after-free in kernfs_get+0x1c/0x90 fs/kernfs/dir.c:496
> Read of size 4 at addr ffff88801ded39f8 by task kworker/1:2/2510

Looks like firmware loading and usb hub removal racing? I'm not sure there's
whole lot we can do from the kernfs side. Greg?

Thanks.

-- 
tejun