Re: [syzbot] [v9fs?] KASAN: slab-use-after-free Read in p9_fid_destroy

From: Hillf Danton
Date: Sat May 18 2024 - 09:33:01 EST


On Fri, 17 May 2024 04:31:28 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ea5f6ad9ad96 Merge tag 'platform-drivers-x86-v6.10-1' of g..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11df3084980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ea5f6ad9ad96

--- x/net/9p/client.c
+++ y/net/9p/client.c
@@ -703,8 +703,6 @@ p9_client_rpc(struct p9_client *c, int8_

err = c->trans_mod->request(c, req);
if (err < 0) {
- /* write won't happen */
- p9_req_put(c, req);
if (err != -ERESTARTSYS && err != -EFAULT)
c->status = Disconnected;
goto recalc_sigpending;
@@ -879,15 +877,19 @@ static void p9_fid_destroy(struct p9_fid
{
struct p9_client *clnt;
unsigned long flags;
+ bool empty;

p9_debug(P9_DEBUG_FID, "fid %d\n", fid->fid);
trace_9p_fid_ref(fid, P9_FID_REF_DESTROY);
clnt = fid->clnt;
spin_lock_irqsave(&clnt->lock, flags);
idr_remove(&clnt->fids, fid->fid);
+ empty = idr_is_empty(&clnt->fids) && clnt->status == Hung + 1;
spin_unlock_irqrestore(&clnt->lock, flags);
kfree(fid->rdir);
kfree(fid);
+ if (empty)
+ kfree(clnt);
}

/* We also need to export tracepoint symbols for tracepoint_enabled() */
@@ -1057,6 +1059,8 @@ EXPORT_SYMBOL(p9_client_create);
void p9_client_destroy(struct p9_client *clnt)
{
struct p9_fid *fid;
+ unsigned long flags;
+ bool empty;
int id;

p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt);
@@ -1068,13 +1072,18 @@ void p9_client_destroy(struct p9_client

idr_for_each_entry(&clnt->fids, fid, id) {
pr_info("Found fid %d not clunked\n", fid->fid);
- p9_fid_destroy(fid);
}

p9_tag_cleanup(clnt);

kmem_cache_destroy(clnt->fcall_cache);
- kfree(clnt);
+ spin_lock_irqsave(&clnt->lock, flags);
+ clnt->status = Hung + 1;
+ empty = idr_is_empty(&clnt->fids);
+ spin_unlock_irqrestore(&clnt->lock, flags);
+
+ if (empty)
+ kfree(clnt);
}
EXPORT_SYMBOL(p9_client_destroy);

--