Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in class_register

[Greg KH]

On Sat, Apr 01, 2023 at 01:12:51AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    198925fae644 Add linux-next specific files for 20230329
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=17f9a03ec80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=91e70627549fd509
> dashboard link: https://syzkaller.appspot.com/bug?extid=41d665317c811d4d88aa
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=105d5a2ec80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11ab4895c80000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/53c685bee82f/disk-198925fa.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/45e82baa3bc5/vmlinux-198925fa.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/7c31fbc6acb9/bzImage-198925fa.xz
> 
> The issue was bisected to:
> 
> commit dcfbb67e48a2becfce7990386e985b9c45098ee5
> Author: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Date:   Fri Mar 24 10:01:31 2023 +0000
> 
>     driver core: class: use lock_class_key already present in struct subsys_private
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=173f4ab9c80000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=14bf4ab9c80000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10bf4ab9c80000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+41d665317c811d4d88aa@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: dcfbb67e48a2 ("driver core: class: use lock_class_key already present in struct subsys_private")


Reference: https://syzkaller.appspot.com/bug?extid=41d665317c811d4d88aa

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git/ driver-core-next


diff --git a/drivers/base/class.c b/drivers/base/class.c
index 2991936c80db..ac1808d1a2e8 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -103,6 +103,7 @@ static void class_release(struct kobject *kobj)
 		pr_debug("class '%s' does not have a release() function, "
 			 "be careful\n", class->name);
 
+	lockdep_unregister_key(&cp->lock_key);
 	kfree(cp);
 }