linux-kernel - Re: "KASAN: slab-use-after-free Write in detach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z5FLTG33XuIQe6A9@slm.duckdns.org>
Date: Wed, 22 Jan 2025 09:47:24 -1000
From: Tejun Heo <tj@...nel.org>
To: cheung wall <zzqq0103.hey@...il.com>
Cc: Lai Jiangshan <jiangshanlai@...il.com>, linux-kernel@...r.kernel.org
Subject: Re: "KASAN: slab-use-after-free Write in detach_worker" in Linux
 Kernel v6.12-rc4

On Wed, Jan 15, 2025 at 10:10:26AM +0800, cheung wall wrote:
> Hello,
> 
> I am writing to report a potential vulnerability identified in the
> Linux Kernel version v6.12-rc4. This vulnerability was discovered
> while I was testing the kernel.
> 
> Linux Kernel Repository Git Commit:
> 42f7652d3eb527d03665b09edac47f85fb600924 (tag: v6.12-rc4)
> 
> Bug Location: detach_worker+0x164/0x180 kernel/workqueue.c:2709
> 
> Attached is the bug log file and report file.
> 
> Thank you for your time and attention.

I don't know how reproducible the problem is but can you please see whether
the followign patch resolves the issue?

Thanks.

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 33a23c7b2274..e1d2f8bf28d7 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3516,22 +3516,22 @@ static int rescuer_thread(void *__rescuer)
 			}
 		}
 
-		/*
-		 * Put the reference grabbed by send_mayday().  @pool won't
-		 * go away while we're still attached to it.
-		 */
-		put_pwq(pwq);
-
 		/*
 		 * Leave this pool. Notify regular workers; otherwise, we end up
 		 * with 0 concurrency and stalling the execution.
 		 */
 		kick_pool(pool);
-
 		raw_spin_unlock_irq(&pool->lock);
-
 		worker_detach_from_pool(rescuer);
 
+		/*
+		 * Put the reference grabbed by send_mayday(). This must come
+		 * after the final access of the pool.
+		 */
+		raw_spin_lock_irq(&pool->lock);
+		put_pwq(pwq);
+		raw_spin_unlock_irq(&pool->lock);
+
 		raw_spin_lock_irq(&wq_mayday_lock);
 	}