Re: [syzbot] KASAN: use-after-free Read in filp_close

From: Al Viro
Date: Sun Jun 05 2022 - 12:16:20 EST


On Sun, Jun 05, 2022 at 07:04:10AM -0700, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit 6319194ec57b0452dcda4589d24c4e7db299c5bf
> Author: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> Date: Thu May 12 21:08:03 2022 +0000
>
> Unify the primitives for file descriptor closing
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=134cbe4ff00000
> start commit: 952923ddc011 Merge tag 'pull-18-rc1-work.namei' of git://g..
> git tree: upstream
> final oops: https://syzkaller.appspot.com/x/report.txt?x=10ccbe4ff00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=174cbe4ff00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3096247591885bfa
> dashboard link: https://syzkaller.appspot.com/bug?extid=47dd250f527cb7bebf24
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114f7bcdf00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1659a94ff00000
>
> Reported-by: syzbot+47dd250f527cb7bebf24@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 6319194ec57b ("Unify the primitives for file descriptor closing")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Argh... I see what's going on. Check if the following fixes the problem,
please.

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 27c9b004823a..73beea5dc18c 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1857,6 +1857,8 @@ static void binder_deferred_fd_close(int fd)
init_task_work(&twcb->twork, binder_do_fd_close);
twcb->file = close_fd_get_file(fd);
if (twcb->file) {
+ // pin it until binder_do_fd_close(); see comments there
+ get_file(twcb->file);
filp_close(twcb->file, current->files);
task_work_add(current, &twcb->twork, TWA_RESUME);
} else {
diff --git a/fs/file.c b/fs/file.c
index dd6692048f4f..3bcc1ecc314a 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -800,8 +800,7 @@ struct file *__close_fd_get_file(unsigned int fd)

/*
* variant of close_fd that gets a ref on the file for later fput.
- * The caller must ensure that filp_close() called on the file, and then
- * an fput().
+ * The caller must ensure that filp_close() called on the file.
*/
struct file *close_fd_get_file(unsigned int fd)
{
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 7257b0870353..33da5116cc38 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5110,7 +5110,7 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
struct files_struct *files = current->files;
struct io_close *close = &req->close;
struct fdtable *fdt;
- struct file *file = NULL;
+ struct file *file;
int ret = -EBADF;

if (req->close.file_slot) {
@@ -5127,7 +5127,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
file = fdt->fd[close->fd];
if (!file || file->f_op == &io_uring_fops) {
spin_unlock(&files->file_lock);
- file = NULL;
goto err;
}

@@ -5147,8 +5146,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
err:
if (ret < 0)
req_set_fail(req);
- if (file)
- fput(file);
__io_req_complete(req, issue_flags, ret, 0);
return 0;
}