[syzbot] [acpi?] KASAN: slab-use-after-free Read in software_node_notify_remove

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz

The issue was bisected to:

commit 9eb59204d5197b4add63968c8c5b7633631f9a5a
Author: Yi Liu <yi.l...@intel.com>
Date: Fri Mar 21 17:19:37 2025 +0000

iommufd/selftest: Add set_dev_pasid in mock iommu

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=160ec7cf980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=150ec7cf980000
console output: https://syzkaller.appspot.com/x/log.txt?x=110ec7cf980000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")

R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffcce8ad2dc
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
</TASK>
iommufd_mock iommufd_mock0: Adding to iommu group 0
==================================================================
BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
Read of size 1 at addr ffff88807fe41108 by task syz-executor390/5849

CPU: 1 UID: 0 PID: 5849 Comm: syz-executor390 Not tainted 6.14.0-syzkaller-12456-gacc4d5ff0b61 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feea50b36e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcce8ad2c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffcce8ad2e0 RCX: 00007feea50b36e9
RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003
RBP: 0000000000000002 R08: 00007ffcce8ad066 R09: 00000000000000a0
R10: 0000000000000002 R11: 0000000000000246 R12: 00007ffcce8ad2dc
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
</TASK>

Allocated by task 5849:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x236/0x370 mm/slub.c:4362
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
swnode_register+0x5a/0x540 drivers/base/swnode.c:790
fwnode_create_software_node+0x199/0x1f0 drivers/base/swnode.c:949
device_create_managed_software_node+0xd5/0x1f0 drivers/base/swnode.c:1060
mock_dev_create drivers/iommu/iommufd/selftest.c:942 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:989 [inline]
iommufd_test+0x3335/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5849:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2389 [inline]
slab_free mm/slub.c:4646 [inline]
kfree+0x198/0x430 mm/slub.c:4845
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88807fe41000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
freed 512-byte region [ffff88807fe41000, ffff88807fe41200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7fe40
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041c80 0000000000000000 dead000000000001
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041c80 0000000000000000 dead000000000001
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0001ff9001 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5226, tgid 5226 (udevd), ts 58838564258, free_ts 55546510086
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1717
prep_new_page mm/page_alloc.c:1725 [inline]
get_page_from_freelist+0x352b/0x36c0 mm/page_alloc.c:3652
__alloc_frozen_pages_noprof+0x211/0x5b0 mm/page_alloc.c:4934
alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2301
alloc_slab_page mm/slub.c:2459 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2623
new_slab mm/slub.c:2676 [inline]
___slab_alloc+0xc3b/0x1500 mm/slub.c:3862
__slab_alloc+0x58/0xa0 mm/slub.c:3952
__slab_alloc_node mm/slub.c:4027 [inline]
slab_alloc_node mm/slub.c:4188 [inline]
__kmalloc_cache_noprof+0x26a/0x370 mm/slub.c:4357
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
kernfs_fop_open+0x3a3/0xdf0 fs/kernfs/file.c:623
do_dentry_open+0xdec/0x1960 fs/open.c:956
vfs_open+0x3b/0x370 fs/open.c:1086
do_open fs/namei.c:3845 [inline]
path_openat+0x2caf/0x35d0 fs/namei.c:4004
do_filp_open+0x284/0x4e0 fs/namei.c:4031
do_sys_openat2+0x12b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x249/0x2a0 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
page last free pid 5223 tgid 5223 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_frozen_pages+0xde8/0x10a0 mm/page_alloc.c:2680
mm_free_pgd kernel/fork.c:793 [inline]
__mmdrop+0xb9/0x490 kernel/fork.c:939
mmdrop include/linux/sched/mm.h:55 [inline]
mmdrop_sched include/linux/sched/mm.h:83 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
finish_task_switch+0x304/0x870 kernel/sched/core.c:5275
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x1b90/0x5240 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_hrtimeout_range_clock+0x193/0x360 kernel/time/sleep_timeout.c:216
ep_poll fs/eventpoll.c:2107 [inline]
do_epoll_wait+0xe2c/0x1100 fs/eventpoll.c:2523
__do_sys_epoll_wait fs/eventpoll.c:2531 [inline]
__se_sys_epoll_wait fs/eventpoll.c:2526 [inline]
__x64_sys_epoll_wait+0x259/0x2b0 fs/eventpoll.c:2526
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
ffff88807fe41000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807fe41080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88807fe41100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807fe41180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807fe41200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Andy Shevchenko]

On Sun, Apr 06, 2025 at 04:37:28AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz

> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.

#syz test: g...@bitbucket.org:andy-shev/linux.git test-swnode

--
With Best Regards,
Andy Shevchenko

[Andy Shevchenko]

On Sun, Apr 06, 2025 at 04:37:28AM -0700, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz

#syz test: https://bitbucket.org/andy-shev/linux.git test-swnode

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout kernel repo g...@bitbucket.org:andy-shev/linux.git/test-swnode: failed to run ["git" "fetch" "--force" "f7e55974102a831d64e9ca077790e9122f71f6c9" "test-swnode"]: exit status 128
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.



Tested on:

commit: [unknown
git tree: g...@bitbucket.org:andy-shev/linux.git test-swnode

kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler:

Note: no patches were applied.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_secondary_fwnode

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 0000000000000000 R14: 00007f0934da5fa0 R15: 00007ffe7c9dc778

</TASK>
iommufd_mock iommufd_mock0: Adding to iommu group 0
==================================================================

BUG: KASAN: slab-use-after-free in fwnode_is_primary drivers/base/core.c:5105 [inline]
BUG: KASAN: slab-use-after-free in set_secondary_fwnode+0x89/0xd0 drivers/base/core.c:5167
Read of size 8 at addr ffff8880358f0440 by task syz.0.19/6201

CPU: 0 UID: 0 PID: 6201 Comm: syz.0.19 Not tainted 6.14.0-syzkaller-13525-g22ea69445c54 #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634

fwnode_is_primary drivers/base/core.c:5105 [inline]
set_secondary_fwnode+0x89/0xd0 drivers/base/core.c:5167
software_node_notify_remove+0x1a8/0x1e0 drivers/base/swnode.c:1112

device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f0934b8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0935a12038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0934da5fa0 RCX: 00007f0934b8d169

RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003

RBP: 00007f0935a12090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 0000000000000000 R14: 00007f0934da5fa0 R15: 00007ffe7c9dc778
</TASK>

Allocated by task 6201:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x236/0x370 mm/slub.c:4362
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
swnode_register+0x5a/0x540 drivers/base/swnode.c:790
fwnode_create_software_node+0x199/0x1f0 drivers/base/swnode.c:949
device_create_managed_software_node+0xd5/0x1f0 drivers/base/swnode.c:1060
mock_dev_create drivers/iommu/iommufd/selftest.c:942 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:989 [inline]
iommufd_test+0x3335/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6201:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2389 [inline]
slab_free mm/slub.c:4646 [inline]
kfree+0x198/0x430 mm/slub.c:4845
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737

software_node_notify_remove+0x18d/0x1e0 drivers/base/swnode.c:1109

device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880358f0400

which belongs to the cache kmalloc-512 of size 512

The buggy address is located 64 bytes inside of
freed 512-byte region [ffff8880358f0400, ffff8880358f0600)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x358f0

head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)

raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0000d63c01 00000000ffffffff 00000000ffffffff

head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5211, tgid 5211 (udevd), ts 44437391568, free_ts 41364354329

page last free pid 5213 tgid 5213 stack trace:
create_dummy_stack mm/page_owner.c:94 [inline]
register_dummy_stack+0x8e/0xe0 mm/page_owner.c:100
init_page_owner+0x3e/0x790 mm/page_owner.c:118
invoke_init_callbacks mm/page_ext.c:148 [inline]
page_ext_init+0x731/0x790 mm/page_ext.c:497
mm_core_init+0x5b/0x70 mm/mm_init.c:2783

Memory state around the buggy address:

ffff8880358f0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880358f0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880358f0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880358f0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880358f0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: 22ea6944 software node: Avoid use-after-free access in..
git tree: https://bitbucket.org/andy-shev/linux.git test-swnode
console output: https://syzkaller.appspot.com/x/log.txt?x=1276f404580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f2054704dd53fb80

dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

[Andy Shevchenko]

On Sun, Apr 06, 2025 at 04:37:28AM -0700, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e4bfa652b34a/disk-acc4d5ff.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/3d19beb8bb92/vmlinux-acc4d5ff.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e7298ccc6331/bzImage-acc4d5ff.xz
>
> The issue was bisected to:
>
> commit 9eb59204d5197b4add63968c8c5b7633631f9a5a
> Author: Yi Liu <yi.l...@intel.com>

Liu, have you looked at the issue? It has a good reproducibility ratio and
definitely something with your patch, but it might be still that it revealed
a lurking bug in software node implementation or driver core, however I don't
see it.

[Lizhi Xu]

no register no remove

#syz test

diff --git a/drivers/base/core.c b/drivers/base/core.c
index d2f9d3a59d6b..a4b9fe99aa28 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2384,7 +2384,8 @@ static void device_platform_notify(struct device *dev)

static void device_platform_notify_remove(struct device *dev)
{
- software_node_notify_remove(dev);
+ if (device_is_registered(dev))
+ software_node_notify_remove(dev);

acpi_device_notify_remove(dev);
}

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in software_node_notify_remove

RBP: 00007f4f5e989090 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002

R13: 0000000000000000 R14: 00007f4f5dda5fa0 R15: 00007fffe901ed38

</TASK>
iommufd_mock iommufd_mock0: Adding to iommu group 0
==================================================================

BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108

Read of size 1 at addr ffff888071ba7108 by task syz.0.18/6145

CPU: 1 UID: 0 PID: 6145 Comm: syz.0.18 Not tainted 6.15.0-rc1-syzkaller-g3b07108ada81-dirty #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634

software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
device_platform_notify_remove drivers/base/core.c:2388 [inline]
device_del+0x5d6/0xa10 drivers/base/core.c:3859
device_unregister+0x20/0xc0 drivers/base/core.c:3897

mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f4f5db8d169

Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f4f5e989038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f4f5dda5fa0 RCX: 00007f4f5db8d169

RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003

RBP: 00007f4f5e989090 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002

R13: 0000000000000000 R14: 00007f4f5dda5fa0 R15: 00007fffe901ed38
</TASK>

Allocated by task 6145:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x236/0x370 mm/slub.c:4362
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
swnode_register+0x5a/0x540 drivers/base/swnode.c:790
fwnode_create_software_node+0x199/0x1f0 drivers/base/swnode.c:949
device_create_managed_software_node+0xd5/0x1f0 drivers/base/swnode.c:1060
mock_dev_create drivers/iommu/iommufd/selftest.c:942 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:989 [inline]
iommufd_test+0x3335/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6145:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2389 [inline]
slab_free mm/slub.c:4646 [inline]
kfree+0x198/0x430 mm/slub.c:4845
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737

software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
device_platform_notify_remove drivers/base/core.c:2388 [inline]
device_del+0x5d6/0xa10 drivers/base/core.c:3859
device_unregister+0x20/0xc0 drivers/base/core.c:3897

mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888071ba7000

which belongs to the cache kmalloc-512 of size 512

The buggy address is located 264 bytes inside of
freed 512-byte region [ffff888071ba7000, ffff888071ba7200)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x71ba4

head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122

raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000

head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122

head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000

head: 00fff00000000002 ffffea0001c6e901 00000000ffffffff 00000000ffffffff

head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5885, tgid 5885 (syz-executor), ts 87258936943, free_ts 87221957323

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1717
prep_new_page mm/page_alloc.c:1725 [inline]
get_page_from_freelist+0x352b/0x36c0 mm/page_alloc.c:3652
__alloc_frozen_pages_noprof+0x211/0x5b0 mm/page_alloc.c:4934
alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2301
alloc_slab_page mm/slub.c:2459 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2623
new_slab mm/slub.c:2676 [inline]
___slab_alloc+0xc3b/0x1500 mm/slub.c:3862
__slab_alloc+0x58/0xa0 mm/slub.c:3952
__slab_alloc_node mm/slub.c:4027 [inline]
slab_alloc_node mm/slub.c:4188 [inline]
__kmalloc_cache_noprof+0x26a/0x370 mm/slub.c:4357
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]

mca_alloc net/ipv6/mcast.c:884 [inline]
__ipv6_dev_mc_inc+0x431/0xac0 net/ipv6/mcast.c:975
ipv6_add_dev+0xe7a/0x1430 net/ipv6/addrconf.c:473
addrconf_notify+0x6a7/0x1020 net/ipv6/addrconf.c:3650
notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2221 [inline]
call_netdevice_notifiers net/core/dev.c:2235 [inline]
register_netdevice+0x16c0/0x1b80 net/core/dev.c:11054
veth_newlink+0x4c3/0xb80 drivers/net/veth.c:1818
rtnl_newlink_create+0x39b/0xcb0 net/core/rtnetlink.c:3833
__rtnl_newlink net/core/rtnetlink.c:3950 [inline]
rtnl_newlink+0x18b0/0x1fe0 net/core/rtnetlink.c:4065
page last free pid 5885 tgid 5885 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_frozen_pages+0xde8/0x10a0 mm/page_alloc.c:2680

discard_slab mm/slub.c:2720 [inline]
__put_partials+0x160/0x1c0 mm/slub.c:3189
put_cpu_partial+0x17e/0x250 mm/slub.c:3264
__slab_free+0x294/0x390 mm/slub.c:4516
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4151 [inline]
slab_alloc_node mm/slub.c:4200 [inline]
__kmalloc_cache_noprof+0x1c8/0x370 mm/slub.c:4357

kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]

ref_tracker_alloc+0x159/0x4c0 lib/ref_tracker.c:203
__netdev_tracker_alloc include/linux/netdevice.h:4331 [inline]
netdev_hold include/linux/netdevice.h:4360 [inline]
netdev_queue_add_kobject net/core/net-sysfs.c:1973 [inline]
netdev_queue_update_kobjects+0x1df/0x740 net/core/net-sysfs.c:2035
register_queue_kobjects net/core/net-sysfs.c:2098 [inline]
netdev_register_kobject+0x234/0x2f0 net/core/net-sysfs.c:2340
register_netdevice+0x12b0/0x1b80 net/core/dev.c:11016
veth_newlink+0x4c3/0xb80 drivers/net/veth.c:1818
rtnl_newlink_create+0x39b/0xcb0 net/core/rtnetlink.c:3833
__rtnl_newlink net/core/rtnetlink.c:3950 [inline]
rtnl_newlink+0x18b0/0x1fe0 net/core/rtnetlink.c:4065
rtnetlink_rcv_msg+0x80f/0xd70 net/core/rtnetlink.c:6955

Memory state around the buggy address:

ffff888071ba7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888071ba7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888071ba7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888071ba7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888071ba7200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


Tested on:

commit: 3b07108a Merge tag 'linux_kselftest-fixes-6.15-rc2' of..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ae723f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=eecd7902e39d7933

dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=113e074c580000

[Hillf Danton]

On Sun, 06 Apr 2025 04:37:28 -0700

> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000

#syz test

--- x/drivers/base/swnode.c
+++ y/drivers/base/swnode.c
@@ -1103,12 +1103,11 @@ void software_node_notify_remove(struct

sysfs_remove_link(&swnode->kobj, dev_name(dev));
sysfs_remove_link(&dev->kobj, "software_node");
- kobject_put(&swnode->kobj);

if (swnode->managed) {
set_secondary_fwnode(dev, NULL);
- kobject_put(&swnode->kobj);
}
+ kobject_put(&swnode->kobj);
}

static int __init software_node_init(void)
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

unregister_netdevice: waiting for DEV to become free

unregister_netdevice: waiting for batadv0 to become free. Usage count = 3

Tested on:

commit: 3b07108a Merge tag 'linux_kselftest-fixes-6.15-rc2' of..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=12786c04580000
kernel config: https://syzkaller.appspot.com/x/.config?x=eecd7902e39d7933

dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=12a337e4580000

[Lizhi Xu]

any link create fail will not get kobject

#syz test

diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index b1726a3515f6..5c78fa6ae772 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1080,6 +1080,7 @@ void software_node_notify(struct device *dev)
if (!swnode)
return;

+ kobject_get(&swnode->kobj);
ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
if (ret)
return;
@@ -1089,8 +1090,6 @@ void software_node_notify(struct device *dev)
sysfs_remove_link(&dev->kobj, "software_node");
return;
}
-
- kobject_get(&swnode->kobj);
}

void software_node_notify_remove(struct device *dev)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free

unregister_netdevice: waiting for batadv0 to become free. Usage count = 3


Tested on:

commit: ab59a860 Merge tag 'net-6.15-rc2' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=118af070580000

kernel config: https://syzkaller.appspot.com/x/.config?x=eecd7902e39d7933
dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16ea874c580000

[Lizhi Xu]

syzbot reported a uaf in software_node_notify_remove. [1]

When any of the two sysfs_create_link() in software_node_notify() fails,
the swnode->kobj reference count will not increase normally, which will
cause swnode to be released incorrectly due to the imbalance of kobj reference
count when executing software_node_notify_remove().

Increase the reference count of kobj before creating the link to avoid uaf.

[1]

BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108

Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844

CPU: 0 UID: 0 PID: 5844 Comm: syz-executor105 Not tainted 6.14.0-syzkaller-12456-gacc4d5ff0b61 #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
device_platform_notify_remove drivers/base/core.c:2387 [inline]
device_del+0x594/0x9b0 drivers/base/core.c:3858
device_unregister+0x20/0xc0 drivers/base/core.c:3896
mock_dev_destroy drivers/iommu/iommufd/selftest.c:960 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1022 [inline]
iommufd_test+0x3715/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f14c7b0b6e9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fff388f87b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fff388f87d0 RCX: 00007f14c7b0b6e9

RDX: 0000200000000200 RSI: 0000000000003ba0 RDI: 0000000000000003

RBP: 0000000000000002 R08: 00007fff388f8556 R09: 00000000000000a0
R10: 0000000000000002 R11: 0000000000000246 R12: 00007fff388f87cc

R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
</TASK>

Allocated by task 5844:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x236/0x370 mm/slub.c:4362
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
swnode_register+0x5a/0x540 drivers/base/swnode.c:790
fwnode_create_software_node+0x199/0x1f0 drivers/base/swnode.c:949
device_create_managed_software_node+0xd5/0x1f0 drivers/base/swnode.c:1060
mock_dev_create drivers/iommu/iommufd/selftest.c:942 [inline]
iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:989 [inline]
iommufd_test+0x3335/0x56a0 drivers/iommu/iommufd/selftest.c:1866
iommufd_fops_ioctl+0x4fc/0x610 drivers/iommu/iommufd/main.c:419
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5844:

Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")

Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
Tested-by: syzbot+2ff229...@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizh...@windriver.com>
---
drivers/base/swnode.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

--
2.43.0

[Andy Shevchenko]

On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> syzbot reported a uaf in software_node_notify_remove. [1]
>
> When any of the two sysfs_create_link() in software_node_notify() fails,
> the swnode->kobj reference count will not increase normally, which will
> cause swnode to be released incorrectly due to the imbalance of kobj reference
> count when executing software_node_notify_remove().
>
> Increase the reference count of kobj before creating the link to avoid uaf.
>
> [1]

Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
recommends to put backtraces in the commit messages:
https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages

> Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e

> Tested-by: syzbot+2ff229...@syzkaller.appspotmail.com

Where is the positive result of it? I can't find the respective log.
To me this one
https://syzkaller.appspot.com/x/report.txt?x=158af070580000
doesn't sound as a useful report as I don't know if this patch fixes one
regression and introduced another.

Dmitry?

[Andy Shevchenko]

Code wise makes sense to me. We do the put in asymmetrical order.
Thanks for looking into it.

[Lizhi Xu]

On Mon, 14 Apr 2025 09:20:30 +0300, Andy Shevchenko wrote:
> On Fri, Apr 11, 2025 at 08:42:02AM +0800, Lizhi Xu wrote:
> > syzbot reported a uaf in software_node_notify_remove. [1]
> >
> > When any of the two sysfs_create_link() in software_node_notify() fails,
> > the swnode->kobj reference count will not increase normally, which will
> > cause swnode to be released incorrectly due to the imbalance of kobj reference
> > count when executing software_node_notify_remove().
> >
> > Increase the reference count of kobj before creating the link to avoid uaf.
> >
> > [1]
>
> Please, reduce this to ~5-7 lines only. This is how Submitting Patches document
> recommends to put backtraces in the commit messages:
> https://www.kernel.org/doc/html/latest/process/submitting-patches.html#backtraces-in-commit-messages

Ok, I will reduce the calltrace, and send V2 patch.

>
> > Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> > Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
>
> > Tested-by: syzbot+2ff229...@syzkaller.appspotmail.com
>
> Where is the positive result of it? I can't find the respective log.
> To me this one
> https://syzkaller.appspot.com/x/report.txt?x=158af070580000
> doesn't sound as a useful report as I don't know if this patch fixes one
> regression and introduced another.

You can see: https://syzkaller.appspot.com/x/log.txt?x=118af07058000
For tasks related to the reproducing program, there are only FAULT_INJECTION
related problems in the log, no other problems, and the log record duration
exceeds 240 seconds, and no uaf occurs, which is enough to prove that the
problem has been fixed.

BR,
Lizhi

[Lizhi Xu]

syzbot reported a uaf in software_node_notify_remove. [1]

When any of the two sysfs_create_link() in software_node_notify() fails,
the swnode->kobj reference count will not increase normally, which will
cause swnode to be released incorrectly due to the imbalance of kobj reference
count when executing software_node_notify_remove().

Increase the reference count of kobj before creating the link to avoid uaf.

[1]

BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844

Freed by task 5844:

software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
device_platform_notify_remove drivers/base/core.c:2387 [inline]

Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
Tested-by: syzbot+2ff229...@syzkaller.appspotmail.com

Signed-off-by: Lizhi Xu <lizh...@windriver.com>
---

V1 -> V2: reduce calltrace

[Andy Shevchenko]

I'm not objecting that the original issue is being fixed, what I'm confused on
is that the report has only one line which doesn't make it clear that there are
no new regressions found during the same run.

[Andy Shevchenko]

On Mon, Apr 14, 2025 at 03:11:23PM +0800, Lizhi Xu wrote:
> syzbot reported a uaf in software_node_notify_remove. [1]
>
> When any of the two sysfs_create_link() in software_node_notify() fails,
> the swnode->kobj reference count will not increase normally, which will
> cause swnode to be released incorrectly due to the imbalance of kobj reference
> count when executing software_node_notify_remove().
>
> Increase the reference count of kobj before creating the link to avoid uaf.
>
> [1]
> BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
> Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844
> Freed by task 5844:
> software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
> device_platform_notify_remove drivers/base/core.c:2387 [inline]

The fix looks correct to me,
Reviewed-by: Andy Shevchenko <andriy.s...@linux.intel.com>

[Sakari Ailus]

On Mon, Apr 14, 2025 at 03:11:23PM +0800, Lizhi Xu wrote:

> syzbot reported a uaf in software_node_notify_remove. [1]
>
> When any of the two sysfs_create_link() in software_node_notify() fails,
> the swnode->kobj reference count will not increase normally, which will
> cause swnode to be released incorrectly due to the imbalance of kobj reference
> count when executing software_node_notify_remove().
>
> Increase the reference count of kobj before creating the link to avoid uaf.
>
> [1]
> BUG: KASAN: slab-use-after-free in software_node_notify_remove+0x1bc/0x1c0 drivers/base/swnode.c:1108
> Read of size 1 at addr ffff888033c08908 by task syz-executor105/5844
> Freed by task 5844:
> software_node_notify_remove+0x159/0x1c0 drivers/base/swnode.c:1106
> device_platform_notify_remove drivers/base/core.c:2387 [inline]
>
> Fixes: 9eb59204d519 ("iommufd/selftest: Add set_dev_pasid in mock iommu")
> Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> Tested-by: syzbot+2ff229...@syzkaller.appspotmail.com
> Signed-off-by: Lizhi Xu <lizh...@windriver.com>

Reviewed-by: Sakari Ailus <sakari...@linux.intel.com>

> ---
> V1 -> V2: reduce calltrace
>
> drivers/base/swnode.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
> index b1726a3515f6..5c78fa6ae772 100644
> --- a/drivers/base/swnode.c
> +++ b/drivers/base/swnode.c
> @@ -1080,6 +1080,7 @@ void software_node_notify(struct device *dev)
> if (!swnode)
> return;
>
> + kobject_get(&swnode->kobj);
> ret = sysfs_create_link(&dev->kobj, &swnode->kobj, "software_node");
> if (ret)
> return;
> @@ -1089,8 +1090,6 @@ void software_node_notify(struct device *dev)
> sysfs_remove_link(&dev->kobj, "software_node");
> return;
> }
> -
> - kobject_get(&swnode->kobj);
> }
>
> void software_node_notify_remove(struct device *dev)
> --
> 2.43.0
>

--
Sakari Ailus

[Hillf Danton]

On Sun, 06 Apr 2025 04:37:28 -0700

> syzbot found the following issue on:
>
> HEAD commit: acc4d5ff0b61 Merge tag 'net-6.15-rc0' of git://git.kernel...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=15a807cf980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=24f9c4330e7c0609
> dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109077b0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13717c3f980000

#syz test

--- x/drivers/base/swnode.c
+++ y/drivers/base/swnode.c
@@ -1103,12 +1103,11 @@ void software_node_notify_remove(struct

sysfs_remove_link(&swnode->kobj, dev_name(dev));
sysfs_remove_link(&dev->kobj, "software_node");
- kobject_put(&swnode->kobj);

if (swnode->managed) {
set_secondary_fwnode(dev, NULL);
- kobject_put(&swnode->kobj);
}
+ kobject_put(&swnode->kobj);
}

static int __init software_node_init(void)

--- x/net/batman-adv/hard-interface.c
+++ y/net/batman-adv/hard-interface.c
@@ -725,7 +725,6 @@ int batadv_hardif_enable_interface(struc

kref_get(&hard_iface->refcount);

- dev_hold(mesh_iface);
netdev_hold(mesh_iface, &hard_iface->meshif_dev_tracker, GFP_ATOMIC);
hard_iface->mesh_iface = mesh_iface;
bat_priv = netdev_priv(hard_iface->mesh_iface);
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+2ff229...@syzkaller.appspotmail.com
Tested-by: syzbot+2ff229...@syzkaller.appspotmail.com

Tested on:

commit: 834a4a68 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16cafc04580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a972ee73c2fcf8ca

dashboard link: https://syzkaller.appspot.com/bug?extid=2ff22910687ee0dfd48e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14f5f0cc580000

Note: testing is done by a robot and is best-effort only.