lkml.org 
[lkml]   [2024]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] [v9fs?] KASAN: slab-use-after-free Read in p9_fid_destroy
Date
On Fri, 17 May 2024 04:31:28 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ea5f6ad9ad96 Merge tag 'platform-drivers-x86-v6.10-1' of g..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11df3084980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ea5f6ad9ad96

--- x/net/9p/client.c
+++ y/net/9p/client.c
@@ -879,15 +879,19 @@ static void p9_fid_destroy(struct p9_fid
{
struct p9_client *clnt;
unsigned long flags;
+ bool empty;

p9_debug(P9_DEBUG_FID, "fid %d\n", fid->fid);
trace_9p_fid_ref(fid, P9_FID_REF_DESTROY);
clnt = fid->clnt;
spin_lock_irqsave(&clnt->lock, flags);
idr_remove(&clnt->fids, fid->fid);
+ empty = idr_is_empty(&clnt->fids) && clnt->status == Hung + 1;
spin_unlock_irqrestore(&clnt->lock, flags);
kfree(fid->rdir);
kfree(fid);
+ if (empty)
+ kfree(clnt);
}

/* We also need to export tracepoint symbols for tracepoint_enabled() */
@@ -1057,6 +1061,8 @@ EXPORT_SYMBOL(p9_client_create);
void p9_client_destroy(struct p9_client *clnt)
{
struct p9_fid *fid;
+ unsigned long flags;
+ bool empty;
int id;

p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt);
@@ -1068,13 +1074,18 @@ void p9_client_destroy(struct p9_client

idr_for_each_entry(&clnt->fids, fid, id) {
pr_info("Found fid %d not clunked\n", fid->fid);
- p9_fid_destroy(fid);
}

p9_tag_cleanup(clnt);

kmem_cache_destroy(clnt->fcall_cache);
- kfree(clnt);
+ spin_lock_irqsave(&clnt->lock, flags);
+ clnt->status = Hung + 1;
+ empty = idr_is_empty(&clnt->fids);
+ spin_unlock_irqrestore(&clnt->lock, flags);
+
+ if (empty)
+ kfree(clnt);
}
EXPORT_SYMBOL(p9_client_destroy);

--
\
 
 \ /
  Last update: 2024-05-18 13:41    [W:0.083 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site