Message-ID:
 <SY8P300MB0421C6B1FD42BA488F04B797A1AF2@SY8P300MB0421.AUSP300.PROD.OUTLOOK.COM>
Date: Wed, 2 Apr 2025 16:15:56 +0000
From: YAN KANG <kangyan91@...look.com>
To: Allison Henderson <allison.henderson@...cle.com>, "David S. Miller"
	<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
	<kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman
	<horms@...nel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
	"rds-devel@....oracle.com" <rds-devel@....oracle.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: BUG: KASAN: slab-use-after-free in rds_inc_put 

Dear maintainers,

My fuzzing tool found a new kernel bug titiled "BUG: KASAN: slab-use-after-free in rds_inc_put ".  I tested it on the Linux upstream version (6.14.0-rc6) . 
Because the target object is freed  in kernel workqueue kthread , I have no repro for this bug. But the crash log is sufficient to describe the cause of the bug.

RootCause Analysis:
in /net/rds/recv.c 
void rds_inc_put(struct rds_incoming *inc)
{
	rdsdebug("put inc %p ref %d\n", inc, refcount_read(&inc->i_refcount));
	if (refcount_dec_and_test(&inc->i_refcount)) {
		BUG_ON(!list_empty(&inc->i_item));

		inc->i_conn->c_trans->inc_free(inc);  // crash, because inc->i_conn is dangling pointer.
	}
}
struct rds_connection object is alloced in rds_sendmsg function and added to loop_conns  list.

Then there are two structures hold the reference of struct rds_connection object .
1. struct rds_sock has field ( struct rds_connection	*rs_conn) , rs->rs_conn is initalized in rds_sendmsg function.
2. global list : loop_conns's item (struct rds_loop_connection * type) has a field (struct rds_connection *conn) . In function __rds_conn_create, conn is alloced and add to global list .

In workqueue : cleanup_net calls rds_loop_kill_conns and free all connections. But in another thread, rds_sock still hold the dangling pointer.

Fix suggestion:
I think there needs to be some synchronization mechanism for rds_connection's lifecycle.

If you fix this issue, please add the following tag to the commit:
Reported-by: yan kang <kangyan91@...look.com>
Reported-by: yue sun <samsun1006219@...il.com>


I hope it helps.
Best regards
yan kang


Kernel crash log is below.
==================================================================
==================================================================
BUG: KASAN: slab-use-after-free in rds_inc_put+0x210/0x220 net/rds/recv.c:83
Read of size 8 at addr ffff88803d111048 by task syz.0.615/15412

CPU: 0 UID: 0 PID: 15412 Comm: syz.0.615 Not tainted 6.14.0-rc6-00006-g7122647c49bb-dirty #112
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xc0/0x5e0 mm/kasan/report.c:489
 kasan_report+0xbd/0xf0 mm/kasan/report.c:602
 rds_inc_put+0x210/0x220 net/rds/recv.c:83
 rds_clear_recv_queue+0x3e6/0x610 net/rds/recv.c:778
 rds_release+0xdb/0x460 net/rds/af_rds.c:73
 __sock_release+0xb0/0x270 net/socket.c:640
 sock_close+0x1c/0x30 net/socket.c:1408
 __fput+0x3f8/0xb40 fs/file_table.c:450
 task_work_run+0x169/0x260 kernel/task_work.c:239
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0xacc/0x2ce0 kernel/exit.c:938
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x222c/0x2500 kernel/signal.c:3017
 arch_do_signal_or_restart+0x81/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xd8/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff6239e6d48
Code: Unable to access opcode bytes at 0x7ff6239e6d1e.
RSP: 002b:00007ff6214f5e90 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 00007ff623bb5f01 RCX: 00007ff6239e6d48
RDX: 00007ff6214f5f20 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ff623a39f8e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007ff6214f5f20
R13: 0000000000000000 R14: 0000000000000000 R15: 00007ff6214d6000
 </TASK>

Allocated by task 16518:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4119 [inline]
 slab_alloc_node mm/slub.c:4168 [inline]
 kmem_cache_alloc_noprof+0x167/0x3e0 mm/slub.c:4175
 __rds_conn_create+0x83c/0x2330 net/rds/connection.c:193
 rds_conn_create_outgoing+0x44/0x60 net/rds/connection.c:363
 rds_sendmsg+0x11b2/0x3160 net/rds/send.c:1294
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg net/socket.c:726 [inline]
 __sys_sendto+0x4fc/0x570 net/socket.c:2197
 __do_sys_sendto net/socket.c:2204 [inline]
 __se_sys_sendto net/socket.c:2200 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2200
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 9656:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x54/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4613 [inline]
 kmem_cache_free+0x145/0x4b0 mm/slub.c:4715
 rds_conn_destroy+0x61f/0x850 net/rds/connection.c:513
 rds_loop_kill_conns net/rds/loop.c:213 [inline]
 rds_loop_exit_net+0x2cd/0x410 net/rds/loop.c:219
 ops_exit_list+0xb0/0x180 net/core/net_namespace.c:172
 cleanup_net+0x5b3/0xd90 net/core/net_namespace.c:648
 process_one_work+0x966/0x1b90 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x66e/0xe80 kernel/workqueue.c:3398
 kthread+0x2c7/0x3b0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88803d111000
 which belongs to the cache rds_connection of size 240
The buggy address is located 72 bytes inside of
 freed 240-byte region [ffff88803d111000, ffff88803d1110f0)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88803d111000 pfn:0x3d111
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88802aefb500 dead000000000122 0000000000000000
raw: ffff88803d111000 00000000800d000c 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 16518, tgid 16516 (syz.2.792), ts 132666258205, free_ts 129603681735
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2e7/0x350 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0xe4e/0x2b20 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x219/0x2190 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x2b6/0x600 mm/mempolicy.c:2269
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2589 [inline]
 new_slab+0x2d5/0x420 mm/slub.c:2642
 ___slab_alloc+0xbb7/0x1850 mm/slub.c:3830
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920
 __slab_alloc_node mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4156 [inline]
 kmem_cache_alloc_noprof+0x264/0x3e0 mm/slub.c:4175
 __rds_conn_create+0x83c/0x2330 net/rds/connection.c:193
 rds_conn_create_outgoing+0x44/0x60 net/rds/connection.c:363
 rds_sendmsg+0x11b2/0x3160 net/rds/send.c:1294
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg net/socket.c:726 [inline]
 __sys_sendto+0x4fc/0x570 net/socket.c:2197
 __do_sys_sendto net/socket.c:2204 [inline]
 __se_sys_sendto net/socket.c:2200 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2200
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 49 tgid 49 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0x700/0x10a0 mm/page_alloc.c:2659
 vfree+0x172/0x940 mm/vmalloc.c:3383
 delayed_vfree_work+0x57/0x70 mm/vmalloc.c:3303
 process_one_work+0x966/0x1b90 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x66e/0xe80 kernel/workqueue.c:3398
 kthread+0x2c7/0x3b0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
 ffff88803d110f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88803d110f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88803d111000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88803d111080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff88803d111100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Powered by blists - more mailing lists