[syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16f9787b180000
kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11655ed8980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e06aabc50597/disk-e33c4963.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ac50f00a131e/vmlinux-e33c4963.xz
kernel image: https://storage.googleapis.com/syzbot-assets/21fd2a443e16/bzImage-e33c4963.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9a3efbc77ff7/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5d34cc...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
Read of size 8 at addr ffff888076eed7c8 by task syz-executor427/5079

CPU: 0 PID: 5079 Comm: syz-executor427 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396
do_dentry_open+0x907/0x15a0 fs/open.c:955
do_open fs/namei.c:3642 [inline]
path_openat+0x2860/0x3240 fs/namei.c:3799
do_filp_open+0x235/0x490 fs/namei.c:3826
do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_openat fs/open.c:1437 [inline]
__se_sys_openat fs/open.c:1432 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1432
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f722cb71329
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff23332778 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f722cb71329
RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c
RBP: 0000000000000000 R08: 00007fff233327b0 R09: 00007fff233327b0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff2333279c
R13: 0000000000000001 R14: 431bde82d7b634db R15: 00007fff233327d0
</TASK>

Allocated by task 5077:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_lru+0x178/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x687/0x3c30 fs/ntfs3/inode.c:1333
ntfs_mknod+0x41/0x60 fs/ntfs3/namei.c:128
vfs_mknod+0x36d/0x3b0 fs/namei.c:4001
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4079 [inline]
__se_sys_mknodat fs/namei.c:4076 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4076
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 0:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kmem_cache_free+0x10b/0x2c0 mm/slub.c:4344
rcu_do_batch kernel/rcu/tree.c:2196 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471
__do_softirq+0x2c6/0x980 kernel/softirq.c:554

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
__call_rcu_common kernel/rcu/tree.c:2734 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:2838
__dentry_kill+0x20d/0x630 fs/dcache.c:603
shrink_kill+0xa9/0x2c0 fs/dcache.c:1048
shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1075
shrink_dcache_parent+0xcb/0x3b0
do_one_tree+0x23/0xe0 fs/dcache.c:1538
shrink_dcache_for_umount+0x7d/0x130 fs/dcache.c:1555
generic_shutdown_super+0x6a/0x2d0 fs/super.c:619
kill_block_super+0x44/0x90 fs/super.c:1675
ntfs3_kill_sb+0x44/0x1b0 fs/ntfs3/super.c:1785
deactivate_locked_super+0xc4/0x130 fs/super.c:472
cleanup_mnt+0x426/0x4c0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
ptrace_notify+0x2d2/0x380 kernel/signal.c:2404
ptrace_report_syscall include/linux/ptrace.h:415 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
syscall_exit_to_user_mode+0x273/0x370 kernel/entry/common.c:218
do_syscall_64+0x102/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888076eed120
which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of
freed 1760-byte region [ffff888076eed120, ffff888076eed800)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76ee8
head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()
raw: 00fff80000000840 ffff888019777dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
head: 00fff80000000840 ffff888019777dc0 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
head: 00fff80000000003 ffffea0001dbba01 dead000000000122 00000000ffffffff
head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 5077, tgid 1360935967 (syz-executor427), ts 5077, free_ts 25749663853
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc_lru+0x253/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xc7/0x3b70 fs/ntfs3/inode.c:525
ntfs_fill_super+0x2f01/0x49c0 fs/ntfs3/super.c:1300
get_tree_bdev+0x3f7/0x570 fs/super.c:1614
vfs_get_tree+0x90/0x2a0 fs/super.c:1779
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x97b/0xaa0 mm/page_alloc.c:2347
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
free_contig_range+0x9e/0x160 mm/page_alloc.c:6572
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1036
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1416
do_one_initcall+0x248/0x880 init/main.c:1245
do_initcall_level+0x157/0x210 init/main.c:1307
do_initcalls+0x3f/0x80 init/main.c:1323
kernel_init_freeable+0x435/0x5d0 init/main.c:1555
kernel_init+0x1d/0x2b0 init/main.c:1444
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
ffff888076eed680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888076eed700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888076eed780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888076eed800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888076eed880: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has bisected this issue to:

commit ef9297007e9904588682699e618c56401f61d1c2
Author: Kari Argillander <kari.arg...@gmail.com>
Date: Thu Sep 2 15:40:49 2021 +0000

fs/ntfs3: Make binary search to search smaller chunks in beginning

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=144f18b0980000
start commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=164f18b0980000
console output: https://syzkaller.appspot.com/x/log.txt?x=124f18b0980000

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11655ed8980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

Reported-by: syzbot+5d34cc...@syzkaller.appspotmail.com
Fixes: ef9297007e99 ("fs/ntfs3: Make binary search to search smaller chunks in beginning")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Hillf Danton]

On Fri, 26 Apr 2024 05:00:21 -0700

> syzbot found the following issue on:
>
> HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53

--- x/fs/namei.c
+++ y/fs/namei.c
@@ -3795,8 +3795,11 @@ static struct file *path_openat(struct n
while (!(error = link_path_walk(s, nd)) &&
(s = open_last_lookups(nd, file, op)) != NULL)
;
- if (!error)
+ if (!error) {
+ path_get(&nd->path);
error = do_open(nd, file, op);
+ path_put(&nd->path);
+ }
terminate_walk(nd);
}
if (likely(!error)) {
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096

==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff888065670e08 by task syz-executor.0/5500

CPU: 1 PID: 5500 Comm: syz-executor.0 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396
do_dentry_open+0x907/0x15a0 fs/open.c:955
do_open fs/namei.c:3642 [inline]

path_openat+0x2915/0x3350 fs/namei.c:3800
do_filp_open+0x235/0x490 fs/namei.c:3829

do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_openat fs/open.c:1437 [inline]
__se_sys_openat fs/open.c:1432 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1432
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f8392c7dea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8393a480c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8392dabf80 RCX: 00007f8392c7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f8392cca4a4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f8392dabf80 R15: 00007ffea989b878
</TASK>

Allocated by task 5490:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_lru+0x178/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x687/0x3c30 fs/ntfs3/inode.c:1333
ntfs_mknod+0x41/0x60 fs/ntfs3/namei.c:128

vfs_mknod+0x36d/0x3b0 fs/namei.c:4004
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4082 [inline]
__se_sys_mknodat fs/namei.c:4079 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4079

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15:

resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x102/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888065670760

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff888065670760, ffff888065670e40)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x65670

head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88802a080d01

flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()

raw: 00fff80000000840 ffff8880197f43c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080110011 00000001ffffffff ffff88802a080d01
head: 00fff80000000840 ffff8880197f43c0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080110011 00000001ffffffff ffff88802a080d01
head: 00fff80000000003 ffffea0001959c01 dead000000000122 00000000ffffffff

head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5489, tgid -418021809 (syz-executor.0), ts 5490, free_ts 17403651762

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc_lru+0x253/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]

new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x687/0x3c30 fs/ntfs3/inode.c:1333

ntfs_atomic_open+0x423/0x570 fs/ntfs3/namei.c:434
atomic_open fs/namei.c:3360 [inline]
lookup_open fs/namei.c:3468 [inline]
open_last_lookups fs/namei.c:3566 [inline]
path_openat+0x10bb/0x3350 fs/namei.c:3796
do_filp_open+0x235/0x490 fs/namei.c:3829
do_sys_openat2+0x13e/0x1d0 fs/open.c:1406

page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x97b/0xaa0 mm/page_alloc.c:2347
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
free_contig_range+0x9e/0x160 mm/page_alloc.c:6572
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1036
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1416
do_one_initcall+0x248/0x880 init/main.c:1245
do_initcall_level+0x157/0x210 init/main.c:1307
do_initcalls+0x3f/0x80 init/main.c:1323
kernel_init_freeable+0x435/0x5d0 init/main.c:1555
kernel_init+0x1d/0x2b0 init/main.c:1444
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff888065670d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888065670d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888065670e00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888065670e80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff888065670f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: e33c4963 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17912d17180000

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=144757d8980000

[Hillf Danton]

On Fri, 26 Apr 2024 05:00:21 -0700

> syzbot found the following issue on:
>
> HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53

--- x/fs/open.c
+++ y/fs/open.c
@@ -952,7 +952,9 @@ static int do_dentry_open(struct file *f
if (!open)
open = f->f_op->open;
if (open) {
+ ihold(inode);
error = open(inode, f);
+ iput(inode);
if (error)
goto cleanup_all;
}
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff88806dd4e688 by task syz-executor.0/5508

CPU: 0 PID: 5508 Comm: syz-executor.0 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396

do_dentry_open+0x90f/0x15b0 fs/open.c:956

do_open fs/namei.c:3642 [inline]
path_openat+0x2860/0x3240 fs/namei.c:3799
do_filp_open+0x235/0x490 fs/namei.c:3826

do_sys_openat2+0x13e/0x1d0 fs/open.c:1408
do_sys_open fs/open.c:1423 [inline]
__do_sys_openat fs/open.c:1439 [inline]
__se_sys_openat fs/open.c:1434 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1434

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f8548c7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f85499fd0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8548dabf80 RCX: 00007f8548c7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f8548cca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f8548dabf80 R15: 00007fff70180958
</TASK>

Allocated by task 5494:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_lru+0x178/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x687/0x3c30 fs/ntfs3/inode.c:1333
ntfs_mknod+0x41/0x60 fs/ntfs3/namei.c:128

vfs_mknod+0x36d/0x3b0 fs/namei.c:4001
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4079 [inline]
__se_sys_mknodat fs/namei.c:4076 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4076

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5504:

The buggy address belongs to the object at ffff88806dd4dfe0

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff88806dd4dfe0, ffff88806dd4e6c0)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6dd48

head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888029458b01

flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()

raw: 00fff80000000840 ffff888019733b40 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080110011 00000001ffffffff ffff888029458b01
head: 00fff80000000840 ffff888019733b40 dead000000000122 0000000000000000
head: 0000000000000000 0000000080110011 00000001ffffffff ffff888029458b01
head: 00fff80000000003 ffffea0001b75201 dead000000000122 00000000ffffffff

head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5493, tgid 401221234 (syz-executor.0), ts 5494, free_ts 64399791889

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc_lru+0x253/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]

iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xc7/0x3b70 fs/ntfs3/inode.c:525

ntfs_fill_super+0x25dc/0x49c0 fs/ntfs3/super.c:1206

get_tree_bdev+0x3f7/0x570 fs/super.c:1614
vfs_get_tree+0x90/0x2a0 fs/super.c:1779
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83

page last free pid 5059 tgid 5059 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x97b/0xaa0 mm/page_alloc.c:2347

free_unref_folios+0x185/0xb30 mm/page_alloc.c:2536
folios_put_refs+0x8eb/0xa10 mm/swap.c:1034
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:329
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
zap_pte_range mm/memory.c:1683 [inline]
zap_pmd_range mm/memory.c:1722 [inline]
zap_pud_range mm/memory.c:1751 [inline]
zap_p4d_range mm/memory.c:1772 [inline]
unmap_page_range+0x3e36/0x4820 mm/memory.c:1793
unmap_vmas+0x3cc/0x5f0 mm/memory.c:1883
exit_mmap+0x2cb/0xd60 mm/mmap.c:3267
__mmput+0x115/0x3c0 kernel/fork.c:1346
exit_mm+0x220/0x310 kernel/exit.c:569
do_exit+0x99e/0x27e0 kernel/exit.c:865
do_group_exit+0x207/0x2c0 kernel/exit.c:1027
get_signal+0x16a1/0x1740 kernel/signal.c:2911
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]

exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]

syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
do_syscall_64+0x102/0x240 arch/x86/entry/common.c:89

Memory state around the buggy address:

ffff88806dd4e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88806dd4e600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806dd4e680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88806dd4e700: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff88806dd4e780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: e33c4963 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=109b0028980000

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=12632380980000

[Hillf Danton]

On Fri, 26 Apr 2024 05:00:21 -0700

> syzbot found the following issue on:
>
> HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53

--- x/fs/char_dev.c
+++ y/fs/char_dev.c
@@ -387,6 +387,8 @@ static int chrdev_open(struct inode *ino
if (!kobj)
return -ENXIO;
new = container_of(kobj, struct cdev, kobj);
+ if (!cdev_get(new))
+ return -ENXIO;
spin_lock(&cdev_lock);
/* Check i_cdev again in case somebody beat us to it while
we dropped the lock. */
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff888054dc32e8 by task syz-executor.0/5507

CPU: 1 PID: 5507 Comm: syz-executor.0 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]

chrdev_open+0x429/0x680 fs/char_dev.c:398
do_dentry_open+0x907/0x15a0 fs/open.c:955

do_open fs/namei.c:3642 [inline]
path_openat+0x2860/0x3240 fs/namei.c:3799
do_filp_open+0x235/0x490 fs/namei.c:3826

do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_openat fs/open.c:1437 [inline]
__se_sys_openat fs/open.c:1432 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1432

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f8a3ae7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f8a3bb910c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8a3afabf80 RCX: 00007f8a3ae7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f8a3aeca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f8a3afabf80 R15: 00007ffd8c82a438

Freed by task 782:

The buggy address belongs to the object at ffff888054dc2c40

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff888054dc2c40, ffff888054dc3320)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x54dc0

head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888029883001

flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()

raw: 00fff80000000840 ffff8880193ed000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffffff ffff888029883001
head: 00fff80000000840 ffff8880193ed000 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffffff ffff888029883001
head: 00fff80000000003 ffffea0001537001 dead000000000122 00000000ffffffff

head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5493, tgid -24364326 (syz-executor.0), ts 5494, free_ts 85127425274

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc_lru+0x253/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xc7/0x3b70 fs/ntfs3/inode.c:525

ntfs_extend_init+0x11f/0x530 fs/ntfs3/fsntfs.c:224
ntfs_fill_super+0x430a/0x49c0 fs/ntfs3/super.c:1531

get_tree_bdev+0x3f7/0x570 fs/super.c:1614
vfs_get_tree+0x90/0x2a0 fs/super.c:1779
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875

page last free pid 4525 tgid 4525 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x97b/0xaa0 mm/page_alloc.c:2347

free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
discard_slab mm/slub.c:2437 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2906
put_cpu_partial+0x17c/0x250 mm/slub.c:2981
__slab_free+0x2ea/0x3d0 mm/slub.c:4151
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x5e/0xc0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322

kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]

kmem_cache_alloc+0x174/0x340 mm/slub.c:3852
getname_flags+0xbd/0x4f0 fs/namei.c:139
vfs_fstatat+0x11c/0x190 fs/stat.c:303
__do_sys_newfstatat fs/stat.c:468 [inline]
__se_sys_newfstatat fs/stat.c:462 [inline]
__x64_sys_newfstatat+0x117/0x190 fs/stat.c:462

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff888054dc3180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888054dc3200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888054dc3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888054dc3300: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888054dc3380: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: e33c4963 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=15eed908980000

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=139f8f0f180000

[Hillf Danton]

On Fri, 26 Apr 2024 05:00:21 -0700

> syzbot found the following issue on:
>
> HEAD commit: e33c4963bf53 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12499380980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53

--- x/fs/char_dev.c
+++ y/fs/char_dev.c

@@ -377,6 +377,9 @@ static int chrdev_open(struct inode *ino
struct cdev *new = NULL;
int ret = 0;

+ if (!igrab(inode))
+ return -ENXIO;
+
spin_lock(&cdev_lock);
p = inode->i_cdev;
if (!p) {
@@ -384,8 +387,10 @@ static int chrdev_open(struct inode *ino
int idx;
spin_unlock(&cdev_lock);
kobj = kobj_lookup(cdev_map, inode->i_rdev, &idx);
- if (!kobj)
+ if (!kobj) {
+ iput(inode);
return -ENXIO;
+ }

new = container_of(kobj, struct cdev, kobj);

spin_lock(&cdev_lock);
/* Check i_cdev again in case somebody beat us to it while

@@ -401,8 +406,10 @@ static int chrdev_open(struct inode *ino
ret = -ENXIO;
spin_unlock(&cdev_lock);
cdev_put(new);
- if (ret)
+ if (ret) {
+ iput(inode);
return ret;
+ }

ret = -ENXIO;
fops = fops_get(p->ops);
@@ -416,10 +423,12 @@ static int chrdev_open(struct inode *ino
goto out_cdev_put;
}

+ iput(inode);
return 0;

out_cdev_put:
cdev_put(p);
+ iput(inode);
return ret;
}

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff8880699bc908 by task syz-executor.0/5501

CPU: 1 PID: 5501 Comm: syz-executor.0 Not tainted 6.9.0-rc5-syzkaller-00053-ge33c4963bf53-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]

chrdev_open+0x2de/0x680 fs/char_dev.c:401

do_dentry_open+0x907/0x15a0 fs/open.c:955
do_open fs/namei.c:3642 [inline]
path_openat+0x2860/0x3240 fs/namei.c:3799
do_filp_open+0x235/0x490 fs/namei.c:3826
do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_openat fs/open.c:1437 [inline]
__se_sys_openat fs/open.c:1432 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1432
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f7dd5a7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f7dd67280c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f7dd5babf80 RCX: 00007f7dd5a7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f7dd5aca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f7dd5babf80 R15: 00007ffd9078e268
</TASK>

Allocated by task 5488:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_lru+0x178/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x687/0x3c30 fs/ntfs3/inode.c:1333
ntfs_mknod+0x41/0x60 fs/ntfs3/namei.c:128
vfs_mknod+0x36d/0x3b0 fs/namei.c:4001
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4079 [inline]
__se_sys_mknodat fs/namei.c:4076 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4076
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5496:

The buggy address belongs to the object at ffff8880699bc260

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff8880699bc260, ffff8880699bc940)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x699b8

head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88802aa7de01

flags: 0xfff80000000840(slab|head|node=0|zone=1|lastcpupid=0xfff)
page_type: 0xffffffff()

raw: 00fff80000000840 ffff888017be5c80 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffffff ffff88802aa7de01
head: 00fff80000000840 ffff888017be5c80 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffffff ffff88802aa7de01
head: 00fff80000000003 ffffea0001a66e01 dead000000000122 00000000ffffffff

head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5487, tgid -241896813 (syz-executor.0), ts 5488, free_ts 64557978708

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc_lru+0x253/0x350 mm/slub.c:3864
alloc_inode_sb include/linux/fs.h:3091 [inline]
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:557
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xc7/0x3b70 fs/ntfs3/inode.c:525

ntfs_fill_super+0x34f4/0x49c0 fs/ntfs3/super.c:1368

get_tree_bdev+0x3f7/0x570 fs/super.c:1614
vfs_get_tree+0x90/0x2a0 fs/super.c:1779
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83

page last free pid 5066 tgid 5060 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1141 [inline]
free_unref_page_prepare+0x97b/0xaa0 mm/page_alloc.c:2347

free_unref_folios+0x185/0xb30 mm/page_alloc.c:2536
folios_put_refs+0x8eb/0xa10 mm/swap.c:1034
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:329
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
zap_pte_range mm/memory.c:1683 [inline]
zap_pmd_range mm/memory.c:1722 [inline]
zap_pud_range mm/memory.c:1751 [inline]
zap_p4d_range mm/memory.c:1772 [inline]
unmap_page_range+0x3e36/0x4820 mm/memory.c:1793
unmap_vmas+0x3cc/0x5f0 mm/memory.c:1883
exit_mmap+0x2cb/0xd60 mm/mmap.c:3267
__mmput+0x115/0x3c0 kernel/fork.c:1346
exit_mm+0x220/0x310 kernel/exit.c:569
do_exit+0x99e/0x27e0 kernel/exit.c:865
do_group_exit+0x207/0x2c0 kernel/exit.c:1027
get_signal+0x16a1/0x1740 kernel/signal.c:2911
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310

exit_to_user_mode_loop kernel/entry/common.c:111 [inline]

exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]

syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
do_syscall_64+0x102/0x240 arch/x86/entry/common.c:89

Memory state around the buggy address:

ffff8880699bc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880699bc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880699bc900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff8880699bc980: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff8880699bca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: e33c4963 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1507f237180000

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=137728a7180000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: slab-use-after-free Read in chrdev_open
Author: almaz.ale...@paragon-software.com

#syz test

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

--- x/fs/open.c
+++ y/fs/open.c
@@ -907,6 +907,7 @@ static int do_dentry_open(struct file *f
static const struct file_operations empty_fops = {};
struct inode *inode = f->f_path.dentry->d_inode;
int error;
+ struct super_block *sb = inode->i_sb;

path_get(&f->f_path);
f->f_inode = inode;
@@ -929,6 +930,7 @@ static int do_dentry_open(struct file *f
f->f_mode |= FMODE_WRITER;
}

+ down_read(&sb->s_umount);
/* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
f->f_mode |= FMODE_ATOMIC_POS;
@@ -956,6 +958,7 @@ static int do_dentry_open(struct file *f
if (error)
goto cleanup_all;
}
+ up_read(&sb->s_umount);
f->f_mode |= FMODE_OPENED;
if ((f->f_mode & FMODE_READ) &&
likely(f->f_op->read || f->f_op->read_iter))
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff88804234fca8 by task syz-executor.0/5468

CPU: 1 PID: 5468 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-g2bfcfd584ff5-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]

chrdev_open+0x2a9/0x630 fs/char_dev.c:396
do_dentry_open+0x977/0x1710 fs/open.c:957
do_open fs/namei.c:3650 [inline]
path_openat+0x289f/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834

do_sys_openat2+0x13e/0x1d0 fs/open.c:1408
do_sys_open fs/open.c:1423 [inline]
__do_sys_openat fs/open.c:1439 [inline]
__se_sys_openat fs/open.c:1434 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1434
do_syscall_x64 arch/x86/entry/common.c:52 [inline]

do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f84f6c7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f84f79a50c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f84f6dabf80 RCX: 00007f84f6c7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f84f6cca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f84f6dabf80 R15: 00007fff737c4cc8
</TASK>

Allocated by task 5457:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]

slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4000 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4019
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563

alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688

ntfs_create_inode+0x5f1/0x3680 fs/ntfs3/inode.c:1347
ntfs_mknod+0x3c/0x50 fs/ntfs3/namei.c:122
vfs_mknod+0x36d/0x3b0 fs/namei.c:4009
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4087 [inline]
__se_sys_mknodat fs/namei.c:4084 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4084
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 24:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579

poison_slab_object+0xe0/0x150 mm/kasan/common.c:240

__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]

slab_free_hook mm/slub.c:2195 [inline]
slab_free mm/slub.c:4436 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4511
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
run_ksoftirqd+0xca/0x130 kernel/softirq.c:928
smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
kthread+0x2f0/0x390 kernel/kthread.c:389

ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541

__call_rcu_common kernel/rcu/tree.c:3072 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176

__dentry_kill+0x20d/0x630 fs/dcache.c:603
shrink_kill+0xa9/0x2c0 fs/dcache.c:1048
shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1075
shrink_dcache_parent+0xcb/0x3b0
do_one_tree+0x23/0xe0 fs/dcache.c:1538
shrink_dcache_for_umount+0x7d/0x130 fs/dcache.c:1555

generic_shutdown_super+0x6a/0x2d0 fs/super.c:620
kill_block_super+0x44/0x90 fs/super.c:1676
ntfs3_kill_sb+0x44/0x1b0 fs/ntfs3/super.c:1798
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267

task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218

do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88804234f600

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff88804234f600, ffff88804234fce0)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42348
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880291a8701
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff8880197c9780 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffefff ffff8880291a8701
head: 00fff00000000040 ffff8880197c9780 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffefff ffff8880291a8701
head: 00fff00000000003 ffffea000108d201 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5457, tgid 5456 (syz-executor.0), ts 74089740327, free_ts 15747466342
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2264
allocate_slab+0x5a/0x2e0 mm/slub.c:2427
new_slab mm/slub.c:2480 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3666
__slab_alloc+0x58/0xa0 mm/slub.c:3756
__slab_alloc_node mm/slub.c:3809 [inline]
slab_alloc_node mm/slub.c:3988 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4019
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563

alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235

ntfs_iget5+0xd5/0x3b10 fs/ntfs3/inode.c:532
ntfs_fill_super+0x2619/0x4a20 fs/ntfs3/super.c:1212
get_tree_bdev+0x3f7/0x570 fs/super.c:1615
vfs_get_tree+0x90/0x2a0 fs/super.c:1780

do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875

page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565
free_contig_range+0x9e/0x160 mm/page_alloc.c:6619
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1038
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1418
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467

ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff88804234fb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804234fc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804234fc80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff88804234fd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88804234fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


Tested on:

commit: 2bfcfd58 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=115b7e3c980000
kernel config: https://syzkaller.appspot.com/x/.config?x=47d282ddffae809f

dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16488eec980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

--- x/fs/open.c
+++ y/fs/open.c

@@ -952,7 +952,13 @@ static int do_dentry_open(struct file *f

if (!open)
open = f->f_op->open;
if (open) {

+ struct super_block *sb = inode->i_sb;

+
+ error = -ENODEV;
+ if (!super_trylock_shared(sb))
+ goto cleanup_all;
error = open(inode, f);
+ up_read(&sb->s_umount);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff8880113cfca8 by task syz-executor.0/5461

CPU: 1 PID: 5461 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396

do_dentry_open+0x98b/0x1760 fs/open.c:960

do_open fs/namei.c:3650 [inline]
path_openat+0x289f/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834

do_sys_openat2+0x13e/0x1d0 fs/open.c:1411
do_sys_open fs/open.c:1426 [inline]
__do_sys_openat fs/open.c:1442 [inline]
__se_sys_openat fs/open.c:1437 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1437

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f01dec7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f01df9c60c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f01dedabf80 RCX: 00007f01dec7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f01decca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f01dedabf80 R15: 00007ffd90197338
</TASK>

Allocated by task 5450:

The buggy address belongs to the object at ffff8880113cf600

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff8880113cf600, ffff8880113cfce0)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113c8

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888017aa0101

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff888017fd8500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffefff ffff888017aa0101
head: 00fff00000000040 ffff888017fd8500 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffefff ffff888017aa0101
head: 00fff00000000003 ffffea000044f201 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5450, tgid 5449 (syz-executor.0), ts 82132262701, free_ts 15999397112

free_reserved_page include/linux/mm.h:3187 [inline]
free_reserved_area+0x198/0x240 mm/page_alloc.c:5776
free_init_pages arch/x86/mm/init.c:927 [inline]
free_kernel_image_pages arch/x86/mm/init.c:943 [inline]
free_initmem+0x9a/0x110 arch/x86/mm/init.c:970
kernel_init+0x31/0x2b0 init/main.c:1476

ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff8880113cfb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880113cfc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880113cfc80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff8880113cfd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880113cfd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 2bfcfd58 Merge tag 'pmdomain-v6.10-rc1' of git://git.k..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=13b82344980000

kernel config: https://syzkaller.appspot.com/x/.config?x=47d282ddffae809f
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=15bd39ec980000

[Hillf Danton]

--- x/fs/super.c
+++ y/fs/super.c
@@ -503,6 +503,7 @@ void deactivate_super(struct super_block
{
if (!atomic_add_unless(&s->s_active, -1, 1)) {
__super_lock_excl(s);
+ s->s_flags |= SB_DYING;
deactivate_locked_super(s);
}
}
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff888077a232e8 by task syz-executor.0/5460

CPU: 0 PID: 5460 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279-dirty #0

RIP: 0033:0x7fc31de7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fc31ec9f0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fc31dfabf80 RCX: 00007fc31de7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007fc31deca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007fc31dfabf80 R15: 00007ffe9eccbdd8
</TASK>

Allocated by task 5449:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4000 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4019
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x5f1/0x3680 fs/ntfs3/inode.c:1347
ntfs_mknod+0x3c/0x50 fs/ntfs3/namei.c:122
vfs_mknod+0x36d/0x3b0 fs/namei.c:4009
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4087 [inline]
__se_sys_mknodat fs/namei.c:4084 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4084
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 8:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2195 [inline]
slab_free mm/slub.c:4436 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4511
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554

do_softirq+0x11b/0x1e0 kernel/softirq.c:455
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
ipv6_get_lladdr+0x295/0x3d0 net/ipv6/addrconf.c:1935
mld_newpack+0x338/0xa90 net/ipv6/mcast.c:1754
add_grhead net/ipv6/mcast.c:1849 [inline]
add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1987
mld_send_cr net/ipv6/mcast.c:2113 [inline]
mld_ifc_work+0x68e/0xd90 net/ipv6/mcast.c:2650
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
__call_rcu_common kernel/rcu/tree.c:3072 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176
__dentry_kill+0x20d/0x630 fs/dcache.c:603
shrink_kill+0xa9/0x2c0 fs/dcache.c:1048
shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1075
shrink_dcache_parent+0xcb/0x3b0
do_one_tree+0x23/0xe0 fs/dcache.c:1538
shrink_dcache_for_umount+0x7d/0x130 fs/dcache.c:1555

generic_shutdown_super+0x6a/0x2d0 fs/super.c:621
kill_block_super+0x44/0x90 fs/super.c:1677

ntfs3_kill_sb+0x44/0x1b0 fs/ntfs3/super.c:1798
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888077a22c40

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff888077a22c40, ffff888077a23320)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77a20

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888029d33a01

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff88801a3928c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080110011 00000001ffffefff ffff888029d33a01
head: 00fff00000000040 ffff88801a3928c0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080110011 00000001ffffefff ffff888029d33a01
head: 00fff00000000003 ffffea0001de8801 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5449, tgid 5448 (syz-executor.0), ts 81273391795, free_ts 81190252679

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2264
allocate_slab+0x5a/0x2e0 mm/slub.c:2427
new_slab mm/slub.c:2480 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3666
__slab_alloc+0x58/0xa0 mm/slub.c:3756
__slab_alloc_node mm/slub.c:3809 [inline]
slab_alloc_node mm/slub.c:3988 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4019
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xd5/0x3b10 fs/ntfs3/inode.c:532
ntfs_fill_super+0x2619/0x4a20 fs/ntfs3/super.c:1212

get_tree_bdev+0x3f7/0x570 fs/super.c:1616
vfs_get_tree+0x90/0x2a0 fs/super.c:1781

do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875

page last free pid 45 tgid 45 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565

discard_slab mm/slub.c:2526 [inline]
__put_partials+0xeb/0x130 mm/slub.c:2994
put_cpu_partial+0x17c/0x250 mm/slub.c:3069
__slab_free+0x2ea/0x3d0 mm/slub.c:4306
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179

kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322

kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4000 [inline]

__do_kmalloc_node mm/slub.c:4120 [inline]
kmalloc_node_track_caller_noprof+0x1cd/0x440 mm/slub.c:4141
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:597
__alloc_skb+0x1f3/0x440 net/core/skbuff.c:666
alloc_skb include/linux/skbuff.h:1308 [inline]
alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6504
sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2794
sock_alloc_send_skb include/net/sock.h:1773 [inline]
mld_newpack+0x1c3/0xa90 net/ipv6/mcast.c:1746
add_grhead net/ipv6/mcast.c:1849 [inline]
add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1987
mld_send_cr net/ipv6/mcast.c:2113 [inline]
mld_ifc_work+0x68e/0xd90 net/ipv6/mcast.c:2650
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312

Memory state around the buggy address:

ffff888077a23180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888077a23200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888077a23280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888077a23300: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888077a23380: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: e0cce98f Merge tag 'tpmdd-next-6.10-rc2' of git://git...

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=101ea864980000

kernel config: https://syzkaller.appspot.com/x/.config?x=47d282ddffae809f
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10cba53c980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

--- x/fs/open.c
+++ y/fs/open.c

@@ -906,9 +906,13 @@ static int do_dentry_open(struct file *f
{

static const struct file_operations empty_fops = {};
struct inode *inode = f->f_path.dentry->d_inode;

+ struct dentry *d = f->f_path.dentry;
int error;

+ if (!lockref_get_not_zero(&d->d_lockref))
+ return -ENODEV;
path_get(&f->f_path);
+ dput(d);
f->f_inode = inode;
f->f_mapping = inode->i_mapping;
f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff888063833a48 by task syz-executor.0/5470

CPU: 1 PID: 5470 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396

do_dentry_open+0x96d/0x1700 fs/open.c:959

do_open fs/namei.c:3650 [inline]
path_openat+0x289f/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834

do_sys_openat2+0x13e/0x1d0 fs/open.c:1409
do_sys_open fs/open.c:1424 [inline]
__do_sys_openat fs/open.c:1440 [inline]
__se_sys_openat fs/open.c:1435 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1435

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f94f7c7dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f94f89bf0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f94f7dabf80 RCX: 00007f94f7c7dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f94f7cca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f94f7dabf80 R15: 00007ffda7828a58
</TASK>

Allocated by task 5456:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4000 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4019
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x5f1/0x3680 fs/ntfs3/inode.c:1347
ntfs_mknod+0x3c/0x50 fs/ntfs3/namei.c:122
vfs_mknod+0x36d/0x3b0 fs/namei.c:4009
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4087 [inline]
__se_sys_mknodat fs/namei.c:4084 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4084
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5389:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2195 [inline]
slab_free mm/slub.c:4436 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4511
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554

__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
__call_rcu_common kernel/rcu/tree.c:3072 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176
__dentry_kill+0x20d/0x630 fs/dcache.c:603
shrink_kill+0xa9/0x2c0 fs/dcache.c:1048
shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1075
shrink_dcache_parent+0xcb/0x3b0
do_one_tree+0x23/0xe0 fs/dcache.c:1538
shrink_dcache_for_umount+0x7d/0x130 fs/dcache.c:1555

generic_shutdown_super+0x6a/0x2d0 fs/super.c:620
kill_block_super+0x44/0x90 fs/super.c:1676

ntfs3_kill_sb+0x44/0x1b0 fs/ntfs3/super.c:1798
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880638333a0

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff8880638333a0, ffff888063833a80)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x63830

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88801f2d5c01

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff888016f46500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffefff ffff88801f2d5c01
head: 00fff00000000040 ffff888016f46500 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffefff ffff88801f2d5c01
head: 00fff00000000003 ffffea00018e0c01 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5456, tgid 5455 (syz-executor.0), ts 83649077084, free_ts 15607625487

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e2d/0x2ee0 mm/page_alloc.c:3402
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4660
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2264
allocate_slab+0x5a/0x2e0 mm/slub.c:2427
new_slab mm/slub.c:2480 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3666
__slab_alloc+0x58/0xa0 mm/slub.c:3756
__slab_alloc_node mm/slub.c:3809 [inline]
slab_alloc_node mm/slub.c:3988 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4019
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xd5/0x3b10 fs/ntfs3/inode.c:532

ntfs_security_init+0x110/0xcc0 fs/ntfs3/fsntfs.c:1882
ntfs_fill_super+0x4329/0x4a20 fs/ntfs3/super.c:1530

get_tree_bdev+0x3f7/0x570 fs/super.c:1615
vfs_get_tree+0x90/0x2a0 fs/super.c:1780
do_new_mount+0x2be/0xb40 fs/namespace.c:3352

page last free pid 1 tgid 1 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2565

free_contig_range+0x9e/0x160 mm/page_alloc.c:6619
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1038
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1418
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467

ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff888063833900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888063833980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888063833a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888063833a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888063833b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: e0cce98f Merge tag 'tpmdd-next-6.10-rc2' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=10edb0f2980000

kernel config: https://syzkaller.appspot.com/x/.config?x=47d282ddffae809f
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=12fbe90c980000

[Edward Adam Davis]

please test uaf chrdev_open

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e33c4963bf53

diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
index 084d19d78397..293c37171d97 100644
--- a/fs/ntfs3/namei.c
+++ b/fs/ntfs3/namei.c
@@ -93,7 +93,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
* If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL.
* This causes null pointer dereference in d_splice_alias().
*/
- if (!IS_ERR_OR_NULL(inode) && !inode->i_op) {
+ if (IS_ERR_OR_NULL(inode) || !inode->i_op) {
iput(inode);
inode = ERR_PTR(-EINVAL);
}

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+5d34cc...@syzkaller.appspotmail.com

Tested on:

commit: e33c4963 Merge tag 'nfsd-6.9-5' of git://git.kernel.or..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=16456bc2980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc

dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1670df2c980000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

If hdr_find_e() fails to find an entry in the index buffer, dir_search_u() maybe
return NULL.
Therefore, it is necessary to add relevant judgment conditions in ntfs_lookup().

Reported-and-tested-by: syzbot+5d34cc...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
fs/ntfs3/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
index 084d19d78397..293c37171d97 100644
--- a/fs/ntfs3/namei.c
+++ b/fs/ntfs3/namei.c
@@ -93,7 +93,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
* If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL.
* This causes null pointer dereference in d_splice_alias().
*/
- if (!IS_ERR_OR_NULL(inode) && !inode->i_op) {
+ if (IS_ERR_OR_NULL(inode) || !inode->i_op) {
iput(inode);
inode = ERR_PTR(-EINVAL);
}

--
2.43.0

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

--- x/fs/open.c
+++ y/fs/open.c
@@ -952,7 +952,18 @@ static int do_dentry_open(struct file *f

if (!open)
open = f->f_op->open;
if (open) {
+ struct super_block *sb = inode->i_sb;
+

+ error = -EINVAL;
+ for (;;) {
+ int a = atomic_read(&sb->s_active);
+ if (a < 2)
+ goto cleanup_all;
+ if (a == atomic_cmpxchg(&sb->s_active, a a+1))
+ break;
+ }
error = open(inode, f);
+ deactivate_super(sb);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/open.c:962:45: error: expected ')'


Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16b61e46980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

--- x/fs/open.c
+++ y/fs/open.c
@@ -952,7 +952,18 @@ static int do_dentry_open(struct file *f
if (!open)
open = f->f_op->open;
if (open) {
+ struct super_block *sb = inode->i_sb;
+
+ error = -EINVAL;
+ for (;;) {
+ int a = atomic_read(&sb->s_active);
+ if (a < 2)
+ goto cleanup_all;

+ if (a == atomic_cmpxchg(&sb->s_active, a, a+1))

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

5][ T1] usbcore: registered new interface driver snd_usb_variax
[ 11.302247][ T1] drop_monitor: Initializing network drop monitor service
[ 11.311701][ T1] NET: Registered PF_LLC protocol family
[ 11.318195][ T1] GACT probability on
[ 11.322363][ T1] Mirror/redirect action on
[ 11.327179][ T1] Simple TC action Loaded
[ 11.335693][ T1] netem: version 1.3
[ 11.339922][ T1] u32 classifier
[ 11.343467][ T1] Performance counters on
[ 11.348165][ T1] input device check on
[ 11.352648][ T1] Actions configured
[ 11.359550][ T1] nf_conntrack_irc: failed to register helpers
[ 11.365771][ T1] nf_conntrack_sane: failed to register helpers
[ 11.490881][ T1] nf_conntrack_sip: failed to register helpers
[ 11.503091][ T1] xt_time: kernel timezone is -0000
[ 11.508580][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 11.515567][ T1] IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
[ 11.524749][ T1] IPVS: ipvs loaded.
[ 11.528782][ T1] IPVS: [rr] scheduler registered.
[ 11.533974][ T1] IPVS: [wrr] scheduler registered.
[ 11.539276][ T1] IPVS: [lc] scheduler registered.
[ 11.544387][ T1] IPVS: [wlc] scheduler registered.
[ 11.549657][ T1] IPVS: [fo] scheduler registered.
[ 11.555055][ T1] IPVS: [ovf] scheduler registered.
[ 11.560394][ T1] IPVS: [lblc] scheduler registered.
[ 11.565729][ T1] IPVS: [lblcr] scheduler registered.
[ 11.571680][ T1] IPVS: [dh] scheduler registered.
[ 11.576873][ T1] IPVS: [sh] scheduler registered.
[ 11.582006][ T1] IPVS: [mh] scheduler registered.
[ 11.587293][ T1] IPVS: [sed] scheduler registered.
[ 11.592590][ T1] IPVS: [nq] scheduler registered.
[ 11.597745][ T1] IPVS: [twos] scheduler registered.
[ 11.603473][ T1] IPVS: [sip] pe registered.
[ 11.608323][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 11.618256][ T1] gre: GRE over IPv4 demultiplexor driver
[ 11.623995][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 11.639361][ T1] IPv4 over IPsec tunneling driver
[ 11.649203][ T1] Initializing XFRM netlink socket
[ 11.654611][ T1] IPsec XFRM device driver
[ 11.660348][ T1] NET: Registered PF_INET6 protocol family
[ 11.680421][ T1] Segment Routing with IPv6
[ 11.685024][ T1] RPL Segment Routing with IPv6
[ 11.690127][ T1] In-situ OAM (IOAM) with IPv6
[ 11.695399][ T1] mip6: Mobile IPv6
[ 11.703700][ T1] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 11.718600][ T1] ip6_gre: GRE over IPv6 tunneling driver
[ 11.729457][ T1] NET: Registered PF_PACKET protocol family
[ 11.735537][ T1] NET: Registered PF_KEY protocol family
[ 11.741796][ T1] Bridge firewalling registered
[ 11.747696][ T1] NET: Registered PF_X25 protocol family
[ 11.753479][ T1] X25: Linux Version 0.2
[ 11.802773][ T1] NET: Registered PF_NETROM protocol family
[ 11.854444][ T1] NET: Registered PF_ROSE protocol family
[ 11.864814][ T1] NET: Registered PF_AX25 protocol family
[ 11.871376][ T1] can: controller area network core
[ 11.876845][ T1] NET: Registered PF_CAN protocol family
[ 11.883711][ T1] can: raw protocol
[ 11.887830][ T1] can: broadcast manager protocol
[ 11.892941][ T1] can: netlink gateway - max_hops=1
[ 11.898365][ T1] can: SAE J1939
[ 11.901940][ T1] can: isotp protocol (max_pdu_size 8300)
[ 11.909408][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 11.915286][ T1] Bluetooth: RFCOMM socket layer initialized
[ 11.921464][ T1] Bluetooth: RFCOMM ver 1.11
[ 11.926785][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 11.933066][ T1] Bluetooth: BNEP filters: protocol multicast
[ 11.939343][ T1] Bluetooth: BNEP socket layer initialized
[ 11.945147][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 11.951046][ T1] Bluetooth: CMTP socket layer initialized
[ 11.956926][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 11.963861][ T1] Bluetooth: HIDP socket layer initialized
[ 11.973494][ T1] NET: Registered PF_RXRPC protocol family
[ 11.979356][ T1] Key type rxrpc registered
[ 11.983844][ T1] Key type rxrpc_s registered
[ 11.989486][ T1] NET: Registered PF_KCM protocol family
[ 11.996107][ T1] lec:lane_module_init: lec.c: initialized
[ 12.002004][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 12.007965][ T1] l2tp_core: L2TP core driver, V2.0
[ 12.013196][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 12.018865][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 12.025374][ T1] l2tp_netlink: L2TP netlink interface
[ 12.030971][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 12.037743][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 12.045361][ T1] NET: Registered PF_PHONET protocol family
[ 12.051559][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 12.071027][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 12.076392][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 12.083533][ T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 12.094738][ T1] sctp: Hash tables configured (bind 32/56)
[ 12.102401][ T1] NET: Registered PF_RDS protocol family
[ 12.108965][ T1] Registered RDS/infiniband transport
[ 12.115714][ T1] Registered RDS/tcp transport
[ 12.120748][ T1] tipc: Activated (version 2.0.0)
[ 12.126839][ T1] NET: Registered PF_TIPC protocol family
[ 12.133861][ T1] tipc: Started in single node mode
[ 12.140276][ T1] NET: Registered PF_SMC protocol family
[ 12.146254][ T1] 9pnet: Installing 9P2000 support
[ 12.152095][ T1] NET: Registered PF_CAIF protocol family
[ 12.161729][ T1] NET: Registered PF_IEEE802154 protocol family
[ 12.168694][ T1] Key type dns_resolver registered
[ 12.173882][ T1] Key type ceph registered
[ 12.179243][ T1] libceph: loaded (mon/osd proto 15/24)
[ 12.186045][ T1] batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
[ 12.195724][ T1] openvswitch: Open vSwitch switching datapath
[ 12.205601][ T1] NET: Registered PF_VSOCK protocol family
[ 12.211871][ T1] mpls_gso: MPLS GSO support
[ 12.233028][ T1] IPI shorthand broadcast: enabled
[ 12.238605][ T1] AVX2 version of gcm_enc/dec engaged.
[ 12.244489][ T1] AES CTR mode by8 optimization enabled
[ 13.698699][ T1] sched_clock: Marking stable (13660026255, 37434632)->(13707290408, -9829521)
[ 13.709929][ T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[ 13.720289][ T1] registered taskstats version 1
[ 13.740168][ T1] Loading compiled-in X.509 certificates
[ 13.750995][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 63e2efea038bb0653de0db43cf50bc47660eba33'
[ 14.070144][ T1] zswap: loaded using pool lzo/zsmalloc
[ 14.078019][ T1] Demotion targets for Node 0: null
[ 14.083317][ T1] Demotion targets for Node 1: null
[ 14.090223][ T1] debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
[ 16.421449][ T1] Key type .fscrypt registered
[ 16.426326][ T1] Key type fscrypt-provisioning registered
[ 16.439567][ T1] kAFS: Red Hat AFS client v0.1 registering.
[ 16.463960][ T1] Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
[ 16.472822][ T1] Key type big_key registered
[ 16.487177][ T1] Key type encrypted registered
[ 16.492433][ T1] ima: No TPM chip found, activating TPM-bypass!
[ 16.498975][ T1] Loading compiled-in module X.509 certificates
[ 16.508509][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: 63e2efea038bb0653de0db43cf50bc47660eba33'
[ 16.519514][ T1] ima: Allocated hash algorithm: sha256
[ 16.525779][ T1] ima: No architecture policies found
[ 16.531809][ T1] evm: Initialising EVM extended attributes:
[ 16.538118][ T1] evm: security.selinux (disabled)
[ 16.543309][ T1] evm: security.SMACK64
[ 16.547518][ T1] evm: security.SMACK64EXEC
[ 16.552013][ T1] evm: security.SMACK64TRANSMUTE
[ 16.557098][ T1] evm: security.SMACK64MMAP
[ 16.562382][ T1] evm: security.apparmor (disabled)
[ 16.567636][ T1] evm: security.ima
[ 16.571521][ T1] evm: security.capability
[ 16.575929][ T1] evm: HMAC attrs: 0x1
[ 16.582546][ T1] PM: Magic number: 12:706:508
[ 16.587780][ T1] usb usb40-port6: hash matches
[ 16.593014][ T1] bdi 252:0: hash matches
[ 16.597651][ T1] pci 0000:00:01.0: hash matches
[ 16.603169][ T1] printk: legacy console [netcon0] enabled
[ 16.609033][ T1] netconsole: network logging started
[ 16.615160][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 16.623286][ T1] rdma_rxe: loaded
[ 16.628079][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 16.639538][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 16.647354][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 16.657611][ T1] clk: Disabling unused clocks
[ 16.659517][ T45] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 16.662680][ T1] ALSA device list:
[ 16.672518][ T45] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 16.676035][ T1] #0: Dummy 1
[ 16.688620][ T1] #1: Loopback 1
[ 16.692338][ T1] #2: Virtual MIDI Card 1
[ 16.700761][ T1] md: Waiting for all devices to be available before autodetect
[ 16.708457][ T1] md: If you don't use raid, use raid=noautodetect
[ 16.714984][ T1] md: Autodetecting RAID arrays.
[ 16.720066][ T1] md: autorun ...
[ 16.723703][ T1] md: ... autorun DONE.
[ 16.822096][ T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[ 16.835388][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 16.866395][ T1] devtmpfs: mounted
[ 16.954288][ T1] Freeing unused kernel image (initmem) memory: 25900K
[ 16.965105][ T1] Write protecting the kernel read-only data: 212992k
[ 16.982735][ T1] Freeing unused kernel image (rodata/data gap) memory: 752K
[ 17.095445][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 17.103701][ T1] x86/mm: Checking user space page tables
[ 17.200694][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 17.210306][ T1] Error -EINVAL opening proc file to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1'
[ 17.221335][ T1] Error -EINVAL opening proc file to set sysctl parameter 'vm.nr_hugepages=4'
[ 17.230737][ T1] Error -EINVAL opening proc file to set sysctl parameter 'vm.nr_overcommit_hugepages=4'
[ 17.240776][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 17.250456][ T1] Error -EINVAL opening proc file to set sysctl parameter 'net.core.netdev_unregister_timeout_secs=140'
[ 17.262827][ T1] Run /sbin/init as init process
[ 17.319704][ T1] Starting init: /sbin/init exists but couldn't execute it (error -22)
[ 17.328131][ T1] Run /etc/init as init process
[ 17.352410][ T1] Run /bin/init as init process
[ 17.358988][ T1] Run /bin/sh as init process
[ 17.364086][ T1] Starting init: /bin/sh exists but couldn't execute it (error -22)
[ 17.372157][ T1] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[ 17.387558][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3-syzkaller-dirty #0
[ 17.396159][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 17.406298][ T1] Call Trace:
[ 17.409570][ T1] <TASK>
[ 17.412494][ T1] dump_stack_lvl+0x241/0x360
[ 17.417178][ T1] ? __pfx_dump_stack_lvl+0x10/0x10
[ 17.422356][ T1] ? __pfx__printk+0x10/0x10
[ 17.426971][ T1] ? vscnprintf+0x5d/0x90
[ 17.431283][ T1] panic+0x349/0x860
[ 17.435244][ T1] ? __wake_up_klogd+0xcc/0x110
[ 17.440250][ T1] ? __pfx_panic+0x10/0x10
[ 17.444652][ T1] ? kernel_init+0x18f/0x2b0
[ 17.449228][ T1] ? kernel_execve+0x8f8/0xa10
[ 17.453988][ T1] ? pti_clone_pgtable+0x380/0x3c0
[ 17.459085][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.464022][ T1] kernel_init+0x25e/0x2b0
[ 17.468424][ T1] ret_from_fork+0x4b/0x80
[ 17.472821][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.477743][ T1] ret_from_fork_asm+0x1a/0x30
[ 17.482498][ T1] </TASK>
[ 17.485802][ T1] Kernel Offset: disabled
[ 17.490168][ T1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2391660754=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 8bdc0f2206
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=8bdc0f220628c9347b3581fead4c026272439799 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240424-152314'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=8bdc0f220628c9347b3581fead4c026272439799 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240424-152314'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=8bdc0f220628c9347b3581fead4c026272439799 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240424-152314'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"8bdc0f220628c9347b3581fead4c026272439799\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15dd7646980000

Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=c79815c08cc14227

dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=13d111de980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

--- x/fs/open.c
+++ y/fs/open.c
@@ -952,7 +952,18 @@ static int do_dentry_open(struct file *f
if (!open)
open = f->f_op->open;
if (open) {
+ struct super_block *sb = inode->i_sb;
+
+ error = -EINVAL;
+ for (;;) {
+ int a = atomic_read(&sb->s_active);

+ if (a < 1)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff888063a27ca8 by task syz-executor.0/5468

CPU: 0 PID: 5468 Comm: syz-executor.0 Not tainted 6.10.0-rc3-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396

do_dentry_open+0x9f9/0x1760 fs/open.c:965

do_open fs/namei.c:3650 [inline]
path_openat+0x289f/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834

do_sys_openat2+0x13e/0x1d0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1442

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f8bc307dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f8bc2bff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8bc31abf80 RCX: 00007f8bc307dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f8bc30ca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f8bc31abf80 R15: 00007ffe28199b08
</TASK>

Allocated by task 5455:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]

slab_post_alloc_hook mm/slub.c:3941 [inline]
slab_alloc_node mm/slub.c:4001 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4020

ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x5f1/0x3680 fs/ntfs3/inode.c:1347
ntfs_mknod+0x3c/0x50 fs/ntfs3/namei.c:122
vfs_mknod+0x36d/0x3b0 fs/namei.c:4009
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4087 [inline]
__se_sys_mknodat fs/namei.c:4084 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4084
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 0:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]

slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4437 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4512

The buggy address belongs to the object at ffff888063a27600

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff888063a27600, ffff888063a27ce0)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x63a20

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff8880247d1f01

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff88801aae6500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffefff ffff8880247d1f01
head: 00fff00000000040 ffff88801aae6500 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffefff ffff8880247d1f01
head: 00fff00000000003 ffffea00018e8801 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5455, tgid 5454 (syz-executor.0), ts 83365626429, free_ts 16584706916

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]

get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678

__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]

alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3989 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4020

ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xd5/0x3b10 fs/ntfs3/inode.c:532

ntfs_fill_super+0x2619/0x4a20 fs/ntfs3/super.c:1212

get_tree_bdev+0x3f7/0x570 fs/super.c:1615
vfs_get_tree+0x90/0x2a0 fs/super.c:1780
do_new_mount+0x2be/0xb40 fs/namespace.c:3352

do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875

page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]

free_unref_page+0xd19/0xea0 mm/page_alloc.c:2583
free_contig_range+0x9e/0x160 mm/page_alloc.c:6637

destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1038
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1418
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff888063a27b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888063a27c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888063a27c80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888063a27d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888063a27d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=15f7d146980000

kernel config: https://syzkaller.appspot.com/x/.config?x=c79815c08cc14227
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=111dc1de980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

--- x/fs/open.c
+++ y/fs/open.c

@@ -952,7 +952,11 @@ static int do_dentry_open(struct file *f

if (!open)
open = f->f_op->open;
if (open) {

+ error = -ENODEV;
+ if (!atomic_inc_not_zero(&inode->i_count))
+ goto cleanup_all;
error = open(inode, f);
+ iput(inode);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff88807f5bdf28 by task syz-executor.0/5466

CPU: 0 PID: 5466 Comm: syz-executor.0 Not tainted 6.10.0-rc3-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396

do_dentry_open+0x9d4/0x17c0 fs/open.c:958

do_open fs/namei.c:3650 [inline]
path_openat+0x289f/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834

do_sys_openat2+0x13e/0x1d0 fs/open.c:1409
do_sys_open fs/open.c:1424 [inline]
__do_sys_openat fs/open.c:1440 [inline]
__se_sys_openat fs/open.c:1435 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1435

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f01fd27dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f01fdf3c0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f01fd3abf80 RCX: 00007f01fd27dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f01fd2ca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f01fd3abf80 R15: 00007ffd46f16418
</TASK>

Allocated by task 5454:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3941 [inline]
slab_alloc_node mm/slub.c:4001 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4020
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x5f1/0x3680 fs/ntfs3/inode.c:1347
ntfs_mknod+0x3c/0x50 fs/ntfs3/namei.c:122
vfs_mknod+0x36d/0x3b0 fs/namei.c:4009
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4087 [inline]
__se_sys_mknodat fs/namei.c:4084 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4084
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 24:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4437 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4512
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554

run_ksoftirqd+0xca/0x130 kernel/softirq.c:928
smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
kthread+0x2f0/0x390 kernel/kthread.c:389

ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
__call_rcu_common kernel/rcu/tree.c:3072 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176
__dentry_kill+0x20d/0x630 fs/dcache.c:603
shrink_kill+0xa9/0x2c0 fs/dcache.c:1048
shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1075
shrink_dcache_parent+0xcb/0x3b0
do_one_tree+0x23/0xe0 fs/dcache.c:1538
shrink_dcache_for_umount+0x7d/0x130 fs/dcache.c:1555
generic_shutdown_super+0x6a/0x2d0 fs/super.c:620
kill_block_super+0x44/0x90 fs/super.c:1676
ntfs3_kill_sb+0x44/0x1b0 fs/ntfs3/super.c:1798
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88807f5bd880

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff88807f5bd880, ffff88807f5bdf60)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f5b8

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888028ee5401

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff888019bc93c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffefff ffff888028ee5401
head: 00fff00000000040 ffff888019bc93c0 dead000000000122 0000000000000000
head: 0000000000000000 0000000000110011 00000001ffffefff ffff888028ee5401
head: 00fff00000000003 ffffea0001fd6e01 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5454, tgid 5452 (syz-executor.0), ts 82376449831, free_ts 15931322947

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3989 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4020
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xd5/0x3b10 fs/ntfs3/inode.c:532

ntfs_fill_super+0x2f4c/0x4a20 fs/ntfs3/super.c:1306

get_tree_bdev+0x3f7/0x570 fs/super.c:1615
vfs_get_tree+0x90/0x2a0 fs/super.c:1780
do_new_mount+0x2be/0xb40 fs/namespace.c:3352
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2583
free_contig_range+0x9e/0x160 mm/page_alloc.c:6637
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1038
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1418
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff88807f5bde00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807f5bde80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807f5bdf00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff88807f5bdf80: fc fc fc fc fc fc fc fc fc fc fc fc fa fb fb fb
ffff88807f5be000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=152aebca980000

kernel config: https://syzkaller.appspot.com/x/.config?x=c79815c08cc14227
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=15595541980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

--- x/fs/open.c
+++ y/fs/open.c

@@ -952,6 +952,12 @@ static int do_dentry_open(struct file *f

if (!open)
open = f->f_op->open;
if (open) {

+ struct mount *mnt = real_mount(f->f_path.mnt);
+ error = -ENODEV;
+ if (mnt->mnt.mnt_flags & MNT_DOOMED)
+ goto cleanup_all;
+ if (mnt_get_count(mnt) < 2)

+ goto cleanup_all;
error = open(inode, f);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/open.c:955:23: error: call to undeclared function 'real_mount'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
fs/open.c:955:17: error: incompatible integer to pointer conversion initializing 'struct mount *' with an expression of type 'int' [-Wint-conversion]
fs/open.c:957:10: error: incomplete definition of type 'struct mount'
fs/open.c:959:7: error: call to undeclared function 'mnt_get_count'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]

Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc

dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14863bca980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

--- x/fs/open.c
+++ y/fs/open.c

@@ -35,6 +35,8 @@
#include <linux/filelock.h>

#include "internal.h"
+#include "mount.h"
+#include "pnode.h"

int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry,
loff_t length, unsigned int time_attrs, struct file *filp)
@@ -952,6 +954,12 @@ static int do_dentry_open(struct file *f

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

./include/linux/fs_pin.h:4:8: error: redefinition of 'fs_pin'
./include/linux/fs_pin.h:14:20: error: redefinition of 'init_fs_pin'
fs/mount.h:8:8: error: redefinition of 'mnt_namespace'
fs/mount.h:21:8: error: redefinition of 'mnt_pcp'
fs/mount.h:26:8: error: redefinition of 'mountpoint'
fs/mount.h:33:8: error: redefinition of 'mount'
fs/mount.h:82:29: error: redefinition of 'real_mount'
fs/mount.h:87:19: error: redefinition of 'mnt_has_parent'
fs/mount.h:92:19: error: redefinition of 'is_mounted'
fs/mount.h:102:20: error: redefinition of '__path_is_mountpoint'
fs/mount.h:110:20: error: redefinition of 'detach_mounts'
fs/mount.h:117:20: error: redefinition of 'get_mnt_ns'
fs/mount.h:124:8: error: redefinition of 'proc_mounts'
fs/mount.h:133:20: error: redefinition of 'is_local_mountpoint'
fs/mount.h:141:20: error: redefinition of 'is_anon_ns'
fs/mount.h:146:20: error: redefinition of 'move_from_ns'

Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=5a05c230e142f2bc
dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1606492e980000

[Hillf Danton]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b

diff -pur b/fs/namespace.c a/fs/namespace.c
--- b/fs/namespace.c 2024-06-17 18:24:14.364221500 +0800
+++ a/fs/namespace.c 2024-06-17 18:19:58.988799600 +0800
@@ -672,6 +672,14 @@ static bool legitimize_mnt(struct vfsmou
return false;
}

+bool mnt_doomed(struct vfsmount *mnt)
+{
+ if (mnt->mnt_flags & MNT_DOOMED)
+ return true;
+
+ return 2 > mnt_get_count(real_mount(mnt));
+}
+
/**
* __lookup_mnt - find first child mount
* @mnt: parent mount
diff -pur b/fs/open.c a/fs/open.c
--- b/fs/open.c 2024-06-17 18:23:56.967279000 +0800
+++ a/fs/open.c 2024-06-17 18:22:11.065932700 +0800
@@ -952,6 +952,9 @@ static int do_dentry_open(struct file *f

if (!open)
open = f->f_op->open;
if (open) {

+ error = -ENODEV;
+ if (mnt_doomed(f->f_path.mnt))

+ goto cleanup_all;
error = open(inode, f);
if (error)
goto cleanup_all;

diff -pur b/include/linux/mount.h a/include/linux/mount.h
--- b/include/linux/mount.h 2024-06-17 18:25:07.750059900 +0800
+++ a/include/linux/mount.h 2024-06-17 18:17:35.669341200 +0800
@@ -93,6 +93,7 @@ extern bool mnt_may_suid(struct vfsmount
extern struct vfsmount *clone_private_mount(const struct path *path);
int mnt_get_write_access(struct vfsmount *mnt);
void mnt_put_write_access(struct vfsmount *mnt);
+bool mnt_doomed(struct vfsmount *mnt);

extern struct vfsmount *fc_mount(struct fs_context *fc);
extern struct vfsmount *vfs_create_mount(struct fs_context *fc);
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in chrdev_open

loop0: detected capacity change from 0 to 4096
==================================================================
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29

Read of size 8 at addr ffff8880433aba48 by task syz-executor.0/5464

CPU: 1 PID: 5464 Comm: syz-executor.0 Not tainted 6.10.0-rc3-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__list_add_valid_or_report+0x4c/0xf0 lib/list_debug.c:29
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
chrdev_open+0x2a9/0x630 fs/char_dev.c:396

do_dentry_open+0x98f/0x1750 fs/open.c:958

do_open fs/namei.c:3650 [inline]
path_openat+0x289f/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834

do_sys_openat2+0x13e/0x1d0 fs/open.c:1408
do_sys_open fs/open.c:1423 [inline]
__do_sys_openat fs/open.c:1439 [inline]
__se_sys_openat fs/open.c:1434 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1434

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f6f9567dea9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f6f963b60c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6f957abf80 RCX: 00007f6f9567dea9

RDX: 0000000000000000 RSI: 0000000020002140 RDI: ffffffffffffff9c

RBP: 00007f6f956ca4a4 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 000000000000000b R14: 00007f6f957abf80 R15: 00007fffeeba0e38
</TASK>

Allocated by task 5451:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3941 [inline]
slab_alloc_node mm/slub.c:4001 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4020
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
new_inode_pseudo+0x69/0x1e0 fs/inode.c:1007
new_inode+0x22/0x1d0 fs/inode.c:1033
ntfs_new_inode+0x45/0x100 fs/ntfs3/fsntfs.c:1688
ntfs_create_inode+0x5f1/0x3680 fs/ntfs3/inode.c:1347
ntfs_mknod+0x3c/0x50 fs/ntfs3/namei.c:122
vfs_mknod+0x36d/0x3b0 fs/namei.c:4009
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4087 [inline]
__se_sys_mknodat fs/namei.c:4084 [inline]
__x64_sys_mknodat+0xa9/0xc0 fs/namei.c:4084
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 16:

cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1275

task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880433ab3a0

which belongs to the cache ntfs_inode_cache of size 1760
The buggy address is located 1704 bytes inside of

freed 1760-byte region [ffff8880433ab3a0, ffff8880433aba80)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x433a8

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88802367d401

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff88801a37bc80 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080110011 00000001ffffefff ffff88802367d401
head: 00fff00000000040 ffff88801a37bc80 dead000000000122 0000000000000000
head: 0000000000000000 0000000080110011 00000001ffffefff ffff88802367d401
head: 00fff00000000003 ffffea00010cea01 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5451, tgid 5450 (syz-executor.0), ts 85231803751, free_ts 15194610819

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3989 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4020
ntfs_alloc_inode+0x28/0x80 fs/ntfs3/super.c:563
alloc_inode fs/inode.c:261 [inline]
iget5_locked+0xa4/0x280 fs/inode.c:1235
ntfs_iget5+0xd5/0x3b10 fs/ntfs3/inode.c:532

ntfs_security_init+0x110/0xcc0 fs/ntfs3/fsntfs.c:1882
ntfs_fill_super+0x4329/0x4a20 fs/ntfs3/super.c:1530

get_tree_bdev+0x3f7/0x570 fs/super.c:1615
vfs_get_tree+0x90/0x2a0 fs/super.c:1780

do_new_mount+0x2be/0xb40 fs/namespace.c:3360

page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0xd19/0xea0 mm/page_alloc.c:2583
free_contig_range+0x9e/0x160 mm/page_alloc.c:6637
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1038
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1418
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff8880433ab900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880433ab980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880433aba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880433aba80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880433abb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Tested on:

commit: 83a7eefe Linux 6.10-rc3
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=14c92012980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c79815c08cc14227

dashboard link: https://syzkaller.appspot.com/bug?extid=5d34cc6474499a5ff516
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=17df5446980000