[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251004100604.8082-1-hdanton@sina.com>
Date: Sat, 4 Oct 2025 18:06:02 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+ae8ad52680705c162471@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [afs?] KASAN: slab-use-after-free Read in afs_dynroot_readdir (2)
> Date: Fri, 03 Oct 2025 22:30:28 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 9b0d551bcc05 Merge tag 'pull-misc' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=144e8304580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3affc19c35df22d7
> dashboard link: https://syzkaller.appspot.com/bug?extid=ae8ad52680705c162471
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17856a7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a05214580000
#syz test
--- x/fs/afs/dynroot.c
+++ y/fs/afs/dynroot.c
@@ -290,15 +290,21 @@ static int afs_dynroot_readdir_cells(str
for (;;) {
unsigned int ix = ctx->pos >> 1;
+ rcu_read_lock();
cell = idr_get_next(&net->cells_dyn_ino, &ix);
- if (!cell)
+ if (!cell) {
+ rcu_read_unlock();
return 0;
+ }
if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
- READ_ONCE(cell->state) == AFS_CELL_DEAD) {
+ READ_ONCE(cell->state) == AFS_CELL_DEAD ||
+ !refcount_inc_not_zero(&cell->ref)) {
+ rcu_read_unlock();
ctx->pos += 2;
ctx->pos &= ~1;
continue;
}
+ rcu_read_unlock();
newpos = ix << 1;
if (newpos > ctx->pos)
@@ -308,16 +314,21 @@ static int afs_dynroot_readdir_cells(str
if ((ctx->pos & 1) == 0) {
if (!dir_emit(ctx, cell->name, cell->name_len,
- cell->dynroot_ino, DT_DIR))
+ cell->dynroot_ino, DT_DIR)) {
+ afs_put_cell(cell, afs_cell_trace_put_atcell);
return 0;
+ }
ctx->pos++;
}
if ((ctx->pos & 1) == 1) {
if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
- cell->dynroot_ino + 1, DT_DIR))
+ cell->dynroot_ino + 1, DT_DIR)) {
+ afs_put_cell(cell, afs_cell_trace_put_atcell);
return 0;
+ }
ctx->pos++;
}
+ afs_put_cell(cell, afs_cell_trace_put_atcell);
}
return 0;
}
--
Powered by blists - more mailing lists