linux-kernel - Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250414070834.1224154-1-lizhi.xu@windriver.com>
Date: Mon, 14 Apr 2025 15:08:34 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <andriy.shevchenko@...ux.intel.com>
CC: <dakr@...nel.org>, <djrscally@...il.com>, <dvyukov@...gle.com>,
        <gregkh@...uxfoundation.org>, <heikki.krogerus@...ux.intel.com>,
        <jgg@...dia.com>, <kevin.tian@...el.com>, <linux-acpi@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <lizhi.xu@...driver.com>,
        <nicolinc@...dia.com>, <rafael@...nel.org>,
        <sakari.ailus@...ux.intel.com>,
        <syzbot+2ff22910687ee0dfd48e@...kaller.appspotmail.com>,
        <syzkaller-bugs@...glegroups.com>, <yi.l.liu@...el.com>
Subject: Re: [PATCH] software node: Prevent link creation failure from causing kobj reference count imbalance

On Mon, 14 Apr 2025 09:20:30 +0300, Andy Shevchenko wrote:
> On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> > syzbot reported a uaf in software_node_notify_remove. [1]
> >
> > When any of the two sysfs_create_link() in software_node_notify() fails,
> > the swnode->kobj reference count will not increase normally, which will
> > cause swnode to be released incorrectly due to the imbalance of kobj reference
> > count when executing software_node_notify_remove().
> >
> > Increase the reference count of kobj before creating the link to avoid uaf.
> >
> > [1]
> 
> Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
> recommends to put backtraces in the commit messages:
> https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages
Ok, I will reduce the calltrace, and send V2 patch.
> 
> > Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> > Reported-by: syzbot+2ff22910687ee0dfd48e@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> 
> > Tested-by: syzbot+2ff22910687ee0dfd48e@...kaller.appspotmail.com
> 
> Where is the positive result of it? I can't find the respective log.
> To me this one
> https://syzkaller.appspot.com/x/report.txt?x=158af070580000
> doesn't sound as a useful report as I don't know if this patch fixes one
> regression and introduced another.
You can see: https://syzkaller.appspot.com/x/log.txt?x=118af07058000
For tasks related to the reproducing program, there are only FAULT_INJECTION
related problems in the log, no other problems, and the log record duration
exceeds 240 seconds, and no uaf occurs, which is enough to prove that the
problem has been fixed.

BR,
Lizhi