linux-kernel - Re: [syzbot] [afs?] KASAN: slab-use-after-free Read in afs_dynroot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251004225256.8119-1-hdanton@sina.com>
Date: Sun,  5 Oct 2025 06:52:55 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+ae8ad52680705c162471@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [afs?] KASAN: slab-use-after-free Read in afs_dynroot_readdir (2)

> Date: Fri, 03 Oct 2025 22:30:28 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    9b0d551bcc05 Merge tag 'pull-misc' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=144e8304580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3affc19c35df22d7
> dashboard link: https://syzkaller.appspot.com/bug?extid=ae8ad52680705c162471
> compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17856a7c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15a05214580000

#syz test

--- x/fs/afs/dynroot.c
+++ y/fs/afs/dynroot.c
@@ -290,15 +290,21 @@ static int afs_dynroot_readdir_cells(str
 	for (;;) {
 		unsigned int ix = ctx->pos >> 1;
 
+		rcu_read_lock();
 		cell = idr_get_next(&net->cells_dyn_ino, &ix);
-		if (!cell)
+		if (!cell) {
+			rcu_read_unlock();
 			return 0;
+		}
 		if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
-		    READ_ONCE(cell->state) == AFS_CELL_DEAD) {
+		    READ_ONCE(cell->state) == AFS_CELL_DEAD ||
+		    !refcount_inc_not_zero(&cell->ref)) {
+			rcu_read_unlock();
 			ctx->pos += 2;
 			ctx->pos &= ~1;
 			continue;
 		}
+		rcu_read_unlock();
 
 		newpos = ix << 1;
 		if (newpos > ctx->pos)
@@ -308,16 +314,21 @@ static int afs_dynroot_readdir_cells(str
 
 		if ((ctx->pos & 1) == 0) {
 			if (!dir_emit(ctx, cell->name, cell->name_len,
-				      cell->dynroot_ino, DT_DIR))
+				      cell->dynroot_ino, DT_DIR)) {
+				afs_put_cell(cell, afs_cell_trace_put_atcell);
 				return 0;
+			}
 			ctx->pos++;
 		}
 		if ((ctx->pos & 1) == 1) {
 			if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
-				      cell->dynroot_ino + 1, DT_DIR))
+				      cell->dynroot_ino + 1, DT_DIR)) {
+				afs_put_cell(cell, afs_cell_trace_put_atcell);
 				return 0;
+			}
 			ctx->pos++;
 		}
+		afs_put_cell(cell, afs_cell_trace_put_atcell);
 	}
 	return 0;
 }
--- x/fs/afs/cell.c
+++ y/fs/afs/cell.c
@@ -520,7 +520,6 @@ static void afs_cell_destroy(struct rcu_
 	afs_put_vlserverlist(net, rcu_access_pointer(cell->vl_servers));
 	afs_unuse_cell(cell->alias_of, afs_cell_trace_unuse_alias);
 	key_put(cell->anonymous_key);
-	idr_remove(&net->cells_dyn_ino, cell->dynroot_ino);
 	kfree(cell->name - 1);
 	kfree(cell);
 
@@ -565,6 +564,9 @@ void afs_put_cell(struct afs_cell *cell,
 		zero = __refcount_dec_and_test(&cell->ref, &r);
 		trace_afs_cell(debug_id, r - 1, a, reason);
 		if (zero) {
+			struct afs_net *net = cell->net;
+
+			idr_remove(&net->cells_dyn_ino, cell->dynroot_ino);
 			a = atomic_read(&cell->active);
 			WARN(a != 0, "Cell active count %u > 0\n", a);
 			WARN_ON(!queue_work(afs_wq, &cell->destroyer));
--