Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance

[Andy Shevchenko]

On Mon, Apr 14, 2025 at 03:08:34PM +0800, Lizhi Xu wrote:
> On Mon, 14 Apr 2025 09:20:30 +0300, Andy Shevchenko wrote:
> > On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> > > syzbot reported a uaf in software_node_notify_remove. [1]
> > >
> > > When any of the two sysfs_create_link() in software_node_notify() fails,
> > > the swnode->kobj reference count will not increase normally, which will
> > > cause swnode to be released incorrectly due to the imbalance of kobj reference
> > > count when executing software_node_notify_remove().
> > >
> > > Increase the reference count of kobj before creating the link to avoid uaf.
> > >
> > > [1]
> > 
> > Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
> > recommends to put backtraces in the commit messages:
> > https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages
> Ok, I will reduce the calltrace, and send V2 patch.
> > 
> > > Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> > > Reported-by: syzbot+2ff22910687ee0dfd48e@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> > 
> > > Tested-by: syzbot+2ff22910687ee0dfd48e@xxxxxxxxxxxxxxxxxxxxxxxxx
> > 
> > Where is the positive result of it? I can't find the respective log.
> > To me this one
> > https://syzkaller.appspot.com/x/report.txt?x=158af070580000
> > doesn't sound as a useful report as I don't know if this patch fixes one
> > regression and introduced another.
> You can see: https://syzkaller.appspot.com/x/log.txt?x=118af07058000
> For tasks related to the reproducing program, there are only FAULT_INJECTION
> related problems in the log, no other problems, and the log record duration
> exceeds 240 seconds, and no uaf occurs, which is enough to prove that the
> problem has been fixed.

I'm not objecting that the original issue is being fixed, what I'm confused on
is that the report has only one line which doesn't make it clear that there are
no new regressions found during the same run.

-- 
With Best Regards,
Andy Shevchenko