[syzbot] [jfs?] KASAN: slab-use-after-free Read in jfs_syncpt

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 021533194476 Kconfig: Disable -Wstringop-overflow for GCC ..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1674acffe80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f204e0b6490f4419
dashboard link: https://syzkaller.appspot.com/bug?extid=c244f4a09ca85dd2ebc1
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3c5d4d2f86e3/disk-02153319.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b16ab56fc47a/vmlinux-02153319.xz
kernel image: https://storage.googleapis.com/syzbot-assets/07a8e67be96d/bzImage-02153319.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c244f4...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:197 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:686 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x6bc/0xd70 kernel/locking/mutex.c:752
Read of size 8 at addr ffff88807bc26108 by task jfsCommit/109

CPU: 0 PID: 109 Comm: jfsCommit Not tainted 6.8.0-rc2-syzkaller-00199-g021533194476 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x167/0x540 mm/kasan/report.c:488
kasan_report+0x142/0x180 mm/kasan/report.c:601
__mutex_waiter_is_first kernel/locking/mutex.c:197 [inline]
__mutex_lock_common kernel/locking/mutex.c:686 [inline]
__mutex_lock+0x6bc/0xd70 kernel/locking/mutex.c:752
jfs_syncpt+0x26/0xa0 fs/jfs/jfs_logmgr.c:1039
txEnd+0x30f/0x560 fs/jfs/jfs_txnmgr.c:549
txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
jfs_lazycommit+0x619/0xb70 fs/jfs/jfs_txnmgr.c:2733
kthread+0x2ef/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
</TASK>

Allocated by task 9990:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x1d6/0x360 mm/slub.c:4012
kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]
open_inline_log fs/jfs/jfs_logmgr.c:1159 [inline]
lmLogOpen+0x335/0x1050 fs/jfs/jfs_logmgr.c:1069
jfs_mount_rw+0xf1/0x6a0 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x681/0xc50 fs/jfs/super.c:565
mount_bdev+0x20a/0x2d0 fs/super.c:1663
legacy_get_tree+0xee/0x190 fs/fs_context.c:662
vfs_get_tree+0x90/0x2a0 fs/super.c:1784
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77

Freed by task 9990:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241
__kasan_slab_free+0x34/0x70 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x14a/0x380 mm/slub.c:4409
lmLogClose+0x2a1/0x530
jfs_remount+0x435/0x6b0 fs/jfs/super.c:466
reconfigure_super+0x445/0x880 fs/super.c:1076
do_remount fs/namespace.c:2892 [inline]
path_mount+0xc28/0xfa0 fs/namespace.c:3671
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff88807bc26000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 264 bytes inside of
freed 1024-byte region [ffff88807bc26000, ffff88807bc26400)

The buggy address belongs to the physical page:
page:ffffea0001ef0800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bc20
head:ffffea0001ef0800 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c41dc0 ffffea0001e53000 dead000000000003
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5137, tgid 5137 (kworker/0:5), ts 122851474325, free_ts 122848490685
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x255/0x680 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2190
allocate_slab mm/slub.c:2354 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2407
___slab_alloc+0xd17/0x13e0 mm/slub.c:3540
__slab_alloc mm/slub.c:3625 [inline]
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc_node_track_caller+0x2d1/0x4e0 mm/slub.c:4001
kmalloc_reserve+0xf3/0x260 net/core/skbuff.c:582
__alloc_skb+0x1b1/0x420 net/core/skbuff.c:651
alloc_skb include/linux/skbuff.h:1296 [inline]
nlmsg_new include/net/netlink.h:1010 [inline]
inet6_rt_notify+0xdf/0x290 net/ipv6/route.c:6171
fib6_add_rt2node net/ipv6/ip6_fib.c:1251 [inline]
fib6_add+0x1dc4/0x3d50 net/ipv6/ip6_fib.c:1477
__ip6_ins_rt net/ipv6/route.c:1303 [inline]
ip6_route_add+0x88/0x120 net/ipv6/route.c:3847
addrconf_add_mroute net/ipv6/addrconf.c:2501 [inline]
addrconf_add_dev+0x35b/0x540 net/ipv6/addrconf.c:2519
addrconf_dev_config net/ipv6/addrconf.c:3423 [inline]
addrconf_init_auto_addrs+0x85f/0xeb0 net/ipv6/addrconf.c:3510
addrconf_notify+0xaff/0x1020 net/ipv6/addrconf.c:3683
notifier_call_chain+0x18f/0x3b0 kernel/notifier.c:93
page last free pid 5138 tgid 5138 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
discard_slab mm/slub.c:2453 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2922
put_cpu_partial+0x17b/0x250 mm/slub.c:2997
__slab_free+0x302/0x410 mm/slub.c:4166
qlink_free mm/kasan/quarantine.c:160 [inline]
qlist_free_all+0x6d/0xd0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:324
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3813 [inline]
slab_alloc_node mm/slub.c:3860 [inline]
kmem_cache_alloc_node+0x18f/0x380 mm/slub.c:3903
__alloc_skb+0x181/0x420 net/core/skbuff.c:641
alloc_skb include/linux/skbuff.h:1296 [inline]
alloc_skb_with_frags+0xc3/0x780 net/core/skbuff.c:6394
sock_alloc_send_pskb+0x919/0xa60 net/core/sock.c:2784
sock_alloc_send_skb include/net/sock.h:1855 [inline]
mld_newpack+0x1c3/0xa90 net/ipv6/mcast.c:1746
add_grhead net/ipv6/mcast.c:1849 [inline]
add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1987
mld_send_initial_cr+0xed/0x240 net/ipv6/mcast.c:2233
mld_dad_work+0x45/0x270 net/ipv6/mcast.c:2259

Memory state around the buggy address:
ffff88807bc26000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807bc26080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807bc26100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807bc26180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807bc26200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: ced590523156 Merge tag 'driver-core-6.8-rc5' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15ee1872180000
kernel config: https://syzkaller.appspot.com/x/.config?x=64757d4899f04e1b
dashboard link: https://syzkaller.appspot.com/bug?extid=c244f4a09ca85dd2ebc1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=118f3658180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119df694180000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-ced59052.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/268f9dfca97a/vmlinux-ced59052.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d95591974e31/bzImage-ced59052.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c890e5e09b22/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c244f4...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:197 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:686 [inline]

BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f4/0x9d0 kernel/locking/mutex.c:752
Read of size 8 at addr ffff8880272d2908 by task jfsCommit/131

CPU: 3 PID: 131 Comm: jfsCommit Not tainted 6.8.0-rc4-syzkaller-00388-gced590523156 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:488
kasan_report+0xda/0x110 mm/kasan/report.c:601

__mutex_waiter_is_first kernel/locking/mutex.c:197 [inline]
__mutex_lock_common kernel/locking/mutex.c:686 [inline]

__mutex_lock+0x8f4/0x9d0 kernel/locking/mutex.c:752
jfs_syncpt+0x2a/0xa0 fs/jfs/jfs_logmgr.c:1039
txEnd+0x30d/0x5a0 fs/jfs/jfs_txnmgr.c:549
txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
jfs_lazycommit+0x77d/0xb20 fs/jfs/jfs_txnmgr.c:2733
kthread+0x2c6/0x3b0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
</TASK>

Allocated by task 5178:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:389

kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]
open_inline_log fs/jfs/jfs_logmgr.c:1159 [inline]

lmLogOpen+0x571/0x1410 fs/jfs/jfs_logmgr.c:1069
jfs_mount_rw+0x2ea/0x700 fs/jfs/jfs_mount.c:257
jfs_fill_super+0x9d6/0xd20 fs/jfs/super.c:565
mount_bdev+0x1e3/0x2d0 fs/super.c:1663
legacy_get_tree+0x109/0x220 fs/fs_context.c:662
vfs_get_tree+0x8f/0x380 fs/super.c:1784
do_new_mount fs/namespace.c:3352 [inline]
path_mount+0x14ea/0x1f20 fs/namespace.c:3679

do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]

__se_sys_mount fs/namespace.c:3875 [inline]
__x64_sys_mount+0x297/0x320 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77

Freed by task 5177:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
poison_slab_object mm/kasan/common.c:241 [inline]
__kasan_slab_free+0x121/0x1c0 mm/kasan/common.c:257

kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]

kfree+0x124/0x370 mm/slub.c:4409
lmLogClose+0x585/0x710 fs/jfs/jfs_logmgr.c:1461
jfs_umount+0x2f0/0x440 fs/jfs/jfs_umount.c:114
jfs_put_super+0x88/0x1d0 fs/jfs/super.c:194
generic_shutdown_super+0x159/0x3d0 fs/super.c:646
kill_block_super+0x3b/0x90 fs/super.c:1680
deactivate_locked_super+0xbe/0x1a0 fs/super.c:477
deactivate_super+0xde/0x100 fs/super.c:510
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14f/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:108 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
syscall_exit_to_user_mode+0x281/0x2b0 kernel/entry/common.c:212
do_syscall_64+0xe5/0x270 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff8880272d2800

which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 264 bytes inside of

freed 1024-byte region [ffff8880272d2800, ffff8880272d2c00)

The buggy address belongs to the physical page:

page:ffffea00009cb400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x272d0
head:ffffea00009cb400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0

flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()

raw: 00fff00000000840 ffff888014c42dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4910, tgid 4910 (dhcpcd-run-hook), ts 31763109865, free_ts 31737584223
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
__alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567

__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]

alloc_slab_page mm/slub.c:2190 [inline]
allocate_slab mm/slub.c:2354 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2407
___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3625

__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]

__kmalloc+0x3b8/0x440 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
load_elf_phdrs+0x103/0x210 fs/binfmt_elf.c:526
load_elf_binary+0x14dc/0x4e40 fs/binfmt_elf.c:955
search_binary_handler fs/exec.c:1783 [inline]
exec_binprm fs/exec.c:1825 [inline]
bprm_execve fs/exec.c:1877 [inline]
bprm_execve+0x70a/0x1980 fs/exec.c:1853
do_execveat_common.isra.0+0x5cf/0x750 fs/exec.c:1984
do_execve fs/exec.c:2058 [inline]
__do_sys_execve fs/exec.c:2134 [inline]
__se_sys_execve fs/exec.c:2129 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2129
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77
page last free pid 4909 tgid 4909 stack trace:

reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]

free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
qlink_free mm/kasan/quarantine.c:160 [inline]
qlist_free_all+0x58/0x150 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:324

kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3813 [inline]
slab_alloc_node mm/slub.c:3860 [inline]

kmem_cache_alloc+0x136/0x320 mm/slub.c:3867
getname_flags.part.0+0x50/0x4f0 fs/namei.c:140
getname_flags include/linux/audit.h:322 [inline]
getname+0x90/0xe0 fs/namei.c:219
do_sys_openat2+0x104/0x1e0 fs/open.c:1398
do_sys_open fs/open.c:1419 [inline]
__do_sys_openat fs/open.c:1435 [inline]
__se_sys_openat fs/open.c:1430 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1430
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77

Memory state around the buggy address:

ffff8880272d2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880272d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880272d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880272d2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880272d2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Edward Adam Davis]

please test uaf in jfs_syncpt

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index dd4264aa9bed..15955dd86bfd 100644
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -197,6 +197,7 @@ struct jfs_sb_info {
kgid_t gid; /* gid to override on-disk gid */
uint umask; /* umask to override on-disk umask */
uint minblks_trim; /* minimum blocks, for online trim */
+ struct mutex log_mutex;
};

/* jfs_sb_info commit_state */
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index be17e3c43582..bd30b93e435c 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -2665,6 +2665,9 @@ static void txLazyCommit(struct tblock * tblk)

log = (struct jfs_log *) JFS_SBI(tblk->sb)->log;

+ if (!log)
+ return;
+
spin_lock_irq(&log->gclock); // LOGGC_LOCK

tblk->flag |= tblkGC_COMMITTED;
@@ -2730,7 +2733,9 @@ int jfs_lazycommit(void *arg)
list_del(&tblk->cqueue);

LAZY_UNLOCK(flags);
+ mutex_lock(&sbi->log_mutex);
txLazyCommit(tblk);
+ mutex_unlock(&sbi->log_mutex);
LAZY_LOCK(flags);

sbi->commit_state &= ~IN_LAZYCOMMIT;
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index 8ec43f53f686..04788cf3a471 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -51,6 +51,7 @@ int jfs_umount(struct super_block *sb)
*
* if mounted read-write and log based recovery was enabled
*/
+ mutex_lock(&sbi->log_mutex);
if ((log = sbi->log))
/*
* Wait for outstanding transactions to be written to log:
@@ -113,6 +114,7 @@ int jfs_umount(struct super_block *sb)
*/
rc = lmLogClose(sb);
}
+ mutex_unlock(&sbi->log_mutex);
jfs_info("UnMount JFS Complete: rc = %d", rc);
return rc;
}
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 8d8e556bd610..cf291bdd094f 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -504,6 +504,7 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)
sbi->uid = INVALID_UID;
sbi->gid = INVALID_GID;
sbi->umask = -1;
+ mutex_init(&sbi->log_mutex);

/* initialize the mount flag and determine the default error handler */
flag = JFS_ERR_REMOUNT_RO;

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in jfs_lazycommit

==================================================================
BUG: KASAN: slab-use-after-free in jfs_lazycommit+0xa54/0xb60 fs/jfs/jfs_txnmgr.c:2741
Read of size 4 at addr ffff888043198894 by task jfsCommit/132

CPU: 2 PID: 132 Comm: jfsCommit Not tainted 6.8.0-rc5-syzkaller-gb401b621758e-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:488
kasan_report+0xda/0x110 mm/kasan/report.c:601

jfs_lazycommit+0xa54/0xb60 fs/jfs/jfs_txnmgr.c:2741

kthread+0x2c6/0x3b0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
</TASK>

Allocated by task 5671:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:389
kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]

jfs_fill_super+0xe5/0xd40 fs/jfs/super.c:495

mount_bdev+0x1e3/0x2d0 fs/super.c:1663
legacy_get_tree+0x109/0x220 fs/fs_context.c:662
vfs_get_tree+0x8f/0x380 fs/super.c:1784
do_new_mount fs/namespace.c:3352 [inline]
path_mount+0x14ea/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount fs/namespace.c:3875 [inline]
__x64_sys_mount+0x297/0x320 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77

Freed by task 5422:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
poison_slab_object mm/kasan/common.c:241 [inline]
__kasan_slab_free+0x121/0x1c0 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x124/0x370 mm/slub.c:4409

generic_shutdown_super+0x159/0x3d0 fs/super.c:646
kill_block_super+0x3b/0x90 fs/super.c:1680
deactivate_locked_super+0xbe/0x1a0 fs/super.c:477
deactivate_super+0xde/0x100 fs/super.c:510
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14f/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:108 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
syscall_exit_to_user_mode+0x281/0x2b0 kernel/entry/common.c:212
do_syscall_64+0xe5/0x270 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff888043198800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 148 bytes inside of
freed 512-byte region [ffff888043198800, ffff888043198a00)

The buggy address belongs to the physical page:

page:ffffea00010c6600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43198
head:ffffea00010c6600 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0

flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()

raw: 00fff00000000840 ffff888014c42c80 dead000000000100 dead000000000122

raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5416, tgid 5416 (syz-executor.2), ts 82216613876, free_ts 60094503130

set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
__alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2190 [inline]
allocate_slab mm/slub.c:2354 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2407
___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3625
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc+0x3b8/0x440 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]

kzalloc include/linux/slab.h:711 [inline]
fib6_info_alloc+0x40/0x100 net/ipv6/ip6_fib.c:155
ip6_route_info_create+0x337/0x1b70 net/ipv6/route.c:3749
ip6_route_add+0x26/0x150 net/ipv6/route.c:3843
addrconf_add_mroute+0x1de/0x350 net/ipv6/addrconf.c:2501
addrconf_add_dev+0x14e/0x1c0 net/ipv6/addrconf.c:2519
inet6_addr_add+0x1a8/0xbe0 net/ipv6/addrconf.c:2965
inet6_rtm_newaddr+0x11de/0x1ab0 net/ipv6/addrconf.c:4976
rtnetlink_rcv_msg+0x3c7/0xe10 net/core/rtnetlink.c:6618
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2543
page last free pid 5173 tgid 5168 stack trace:

reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486

release_pages+0x51f/0x14f0 mm/swap.c:1008
tlb_batch_pages_flush+0x9a/0x190 mm/mmu_gather.c:98
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu mm/mmu_gather.c:300 [inline]
tlb_finish_mmu+0x14b/0x700 mm/mmu_gather.c:392
exit_mmap+0x3da/0xb50 mm/mmap.c:3292
__mmput+0x12a/0x4d0 kernel/fork.c:1343
mmput+0x62/0x70 kernel/fork.c:1365
exit_mm kernel/exit.c:569 [inline]
do_exit+0x9a5/0x2ad0 kernel/exit.c:858
do_group_exit+0xd4/0x2a0 kernel/exit.c:1020
get_signal+0x23b9/0x2790 kernel/signal.c:2893
arch_do_signal_or_restart+0x90/0x7f0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:105 [inline]

exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]

syscall_exit_to_user_mode+0x156/0x2b0 kernel/entry/common.c:212
do_syscall_64+0xe5/0x270 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6f/0x77

Memory state around the buggy address:

ffff888043198780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888043198800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888043198880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888043198900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888043198980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: b401b621 Linux 6.8-rc5
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=16850158180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6a2287897dfeb9a

dashboard link: https://syzkaller.appspot.com/bug?extid=c244f4a09ca85dd2ebc1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1699e1d0180000

[Edward Adam Davis]

please test uaf in jfs_syncpt

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index dd4264aa9bed..15955dd86bfd 100644
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -197,6 +197,7 @@ struct jfs_sb_info {
kgid_t gid; /* gid to override on-disk gid */
uint umask; /* umask to override on-disk umask */
uint minblks_trim; /* minimum blocks, for online trim */
+ struct mutex log_mutex;
};

/* jfs_sb_info commit_state */
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c

index be17e3c43582..eb60862dc61b 100644

--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -2665,6 +2665,9 @@ static void txLazyCommit(struct tblock * tblk)

log = (struct jfs_log *) JFS_SBI(tblk->sb)->log;

+ if (!log)
+ return;
+
spin_lock_irq(&log->gclock); // LOGGC_LOCK

tblk->flag |= tblkGC_COMMITTED;

@@ -2730,10 +2733,12 @@ int jfs_lazycommit(void *arg)

list_del(&tblk->cqueue);

LAZY_UNLOCK(flags);
+ mutex_lock(&sbi->log_mutex);
txLazyCommit(tblk);

+ sbi->commit_state &= ~IN_LAZYCOMMIT;
+ mutex_unlock(&sbi->log_mutex);
LAZY_LOCK(flags);

- sbi->commit_state &= ~IN_LAZYCOMMIT;
/*
* Don't continue in the for loop. (We can't
* anyway, it's unsafe!) We want to go back to

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+c244f4...@syzkaller.appspotmail.com

Tested on:

commit: b401b621 Linux 6.8-rc5
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=10b4278a180000

kernel config: https://syzkaller.appspot.com/x/.config?x=c6a2287897dfeb9a
dashboard link: https://syzkaller.appspot.com/bug?extid=c244f4a09ca85dd2ebc1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16796c64180000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

During the execution of the jfs lazy commit, the jfs file system was unmounted,
causing the sbi and jfs log objects to be released, triggering this issue.
The solution is to add mutex to synchronize jfs lazy commit and jfs unmount
operations.

Reported-and-tested-by: syzbot+c244f4...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
fs/jfs/jfs_incore.h | 1 +
fs/jfs/jfs_txnmgr.c | 7 ++++++-
fs/jfs/jfs_umount.c | 2 ++
fs/jfs/super.c | 1 +
4 files changed, 10 insertions(+), 1 deletion(-)

--
2.43.0

[Matthew Wilcox]

On Tue, Feb 20, 2024 at 11:55:18AM +0800, Edward Adam Davis wrote:
> During the execution of the jfs lazy commit, the jfs file system was unmounted,
> causing the sbi and jfs log objects to be released, triggering this issue.
> The solution is to add mutex to synchronize jfs lazy commit and jfs unmount
> operations.

Why is that the solution? LAZY_LOCK with IN_LAZYCOMMIT is supposed to
cover this. Please be more verbose in your commit messages. Describe
what is going wrong and why; that will allow people to understand why
this is the correct solution to the problem.

[Edward Adam Davis]

On Tue, 20 Feb 2024 04:07:09 +0000, Matthew Wilcox wrote:
> > During the execution of the jfs lazy commit, the jfs file system was unmounted,
> > causing the sbi and jfs log objects to be released, triggering this issue.
> > The solution is to add mutex to synchronize jfs lazy commit and jfs unmount
> > operations.
>
> Why is that the solution? LAZY_LOCK with IN_LAZYCOMMIT is supposed to

LAZY_LOCK not cover jfs umount.

> cover this. Please be more verbose in your commit messages. Describe
> what is going wrong and why; that will allow people to understand why
> this is the correct solution to the problem.

[Syz reported]

BUG: KASAN: slab-use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:197 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:686 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f4/0x9d0 kernel/locking/mutex.c:752
Read of size 8 at addr ffff8880272d2908 by task jfsCommit/131

CPU: 3 PID: 131 Comm: jfsCommit Not tainted 6.8.0-rc4-syzkaller-00388-gced590523156 #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:488
kasan_report+0xda/0x110 mm/kasan/report.c:601

__mutex_waiter_is_first kernel/locking/mutex.c:197 [inline]
__mutex_lock_common kernel/locking/mutex.c:686 [inline]
__mutex_lock+0x8f4/0x9d0 kernel/locking/mutex.c:752
jfs_syncpt+0x2a/0xa0 fs/jfs/jfs_logmgr.c:1039
txEnd+0x30d/0x5a0 fs/jfs/jfs_txnmgr.c:549
txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline]
jfs_lazycommit+0x77d/0xb20 fs/jfs/jfs_txnmgr.c:2733

kthread+0x2c6/0x3b0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

Freed by task 5177:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
poison_slab_object mm/kasan/common.c:241 [inline]
__kasan_slab_free+0x121/0x1c0 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x124/0x370 mm/slub.c:4409

lmLogClose+0x585/0x710 fs/jfs/jfs_logmgr.c:1461
jfs_umount+0x2f0/0x440 fs/jfs/jfs_umount.c:114
jfs_put_super+0x88/0x1d0 fs/jfs/super.c:194

[Analyze]
This issue occurs due to task 131 executing jfs lazy commit and task 5177 executing
jfs put super (which will release objects such as sbi and jfs log).

The solution is to use mutex to sort the two tasks and determine whether the log
and sbi objects are valid before using them.
This way, regardless of who executes the two tasks first, the latter can determine
whether the log and sbi objects are valid or invalid, thus avoiding the current problem.