Re: [PATCH v2 0/2] debugfs: fix UAF and double-free in debugfs_str read/write

[Greg KH]

On Sat, Sep 26, 2026 at 10:47:26AM -0300, Aldo Ariel Panzardo wrote:
> On Sat, Sep 26, 2026 at 08:53:06AM +0200, Greg Kroah-Hartman wrote:
> > Did you forget an Assisted-by: tag here?
> 
> Yes, apologies.  Both patches now carry:
> 
>   Assisted-by: sashiko.dev <sashiko-bot@xxxxxxxxxx>

No LLM was used to generate the patch?

> > And how was this found and tested?
> 
> sashiko.dev flagged that the write path uses rcu_assign_pointer() /
> synchronize_rcu() / kfree() but the read path dereferences the same
> pointer without rcu_read_lock().  I then manually reviewed the write
> path and found the second issue: no mutual exclusion between concurrent
> writers, leading to a double-free of `old`.
> 
> Tested on QEMU/KVM with CONFIG_KASAN=y.  The double-free in the write
> path reproduces immediately (~3900 KASAN reports in a single run with 8
> concurrent writers):
> 
>   BUG: KASAN: double-free in debugfs_write_file_str+0x194/0x200
> 
> Full splat is included in patch 2/2.
> 
> The read-path UAF has a narrower race window (just a couple of
> instructions between pointer load and strlen()) and did not trigger in
> KASAN testing, but it is structurally obvious: the write path calls
> synchronize_rcu() + kfree(old) and the read path does not hold
> rcu_read_lock().
> 
> > And what kernel was tested, debugfs strings were changed a bunch in 7.1,
> > what bug report are you working off of here?
> 
> Verified against torvalds/linux master at v7.3-rc4 (commit
> 6812ce4e4379, 2026-09-26).  Both bugs are present in the current code
> at debugfs_read_file_str() and debugfs_write_file_str() in
> fs/debugfs/file.c.
> 
> This is not from a bug report.  It was found by sashiko.dev reviewing
> an adjacent patch and I verified it independently.

Again, no LLM for all of this?

I'd like to see the userspace test scripts for this...

thanks,

greg k-h