Re: [BUG] slab-use-after-free in idempotent() during concurrent finit_module [syzkaller] [ath10k_pci]

[Petr Pavlu]

On 8/8/26 7:00 PM, Yang Zi wrote:
> Hi,
> 
> While fuzzing the kernel with syzkaller (KASAN), we hit a slab
> use-after-free in the module loader's idempotent path. The crash is a
> Read of size 8 in `idempotent()` in kernel/module/main.c while
> concurrently loading modules via `finit_module`, when the load fd is
> `close()`d from another thread.
> 
> Reproducer summary:
> 
>     BUG: KASAN: slab-use-after-free in idempotent kernel/module/main.c:3682 [inline]
>     BUG: KASAN: slab-use-after-free in idempotent_init_module kernel/module/main.c:3788 [inline]
>     BUG: KASAN: slab-use-after-free in __do_sys_finit_module kernel/module/main.c:3815 [inline]
>     Read of size 8 at addr ffff88800d36fe48 by task modprobe/715
> 
>     The buggy address belongs to the object at ffff88800d36f700
>     which belongs to the cache UNIX-STREAM of size 2048
>     The buggy address is located 1864 bytes inside of a freed 2048-byte region
> 
> Allocated by task 634: __sys_socket → unix_create1 → sk_alloc → kmem_cache_alloc (2048 B)
> Freed by task 634:  __x64_sys_close → __fput → sock_close → unix_release_sock → __sk_destruct → sk_prot_free → kmem_cache_free
> 
> `idempotent()` uses `file_inode(f)` as the cookie to compare entries on the
> global `idem_hash` list. `fdget` only holds a reference on the `struct file`,
> not on the inode/socket object. When a concurrent thread `close()`s the
> module-load fd while another `finit_module` is inside `idempotent()`, the
> `UNIX-STREAM` socket object is freed and the inode-cookie is dereferenced on
> the hash list → slab-use-after-free (Read 8 B).
> 
> Root-cause hypothesis: the `file_inode(f)` cookie has no lifetime protection
> across the `hlist_for_each_entry` in `idempotent()`; the concurrent `close`
> can release the object underneath the traversal.

This doesn't quite hold up. 1) idempotent() never dereferences the
file_inode(f) cookie, so it cannot cause a use-after-free.
2) finit_module() calls fdget() on the input file and the file itself
pins its inode.

I'm afraid this looks very much like AI-generated spam. If it is
a genuine report, please provide more information, such as a syzkaller
reproducer and the full boot log.

-- 
Thanks,
Petr