[syzbot] [fs?] KASAN: slab-use-after-free Read in lockref_get

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 58f9416d413a Merge branch 'ice-support-to-dump-phy-config-..
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12e2e3e1980000
kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1658c7dd980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3fb480f5ebf6/disk-58f9416d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1a62eb04b3aa/vmlinux-58f9416d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/67d14a897f84/bzImage-58f9416d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5dc28...@syzkaller.appspotmail.com

wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
Read of size 8 at addr ffff88805e5cfe10 by task kworker/u8:8/2405

CPU: 1 PID: 2405 Comm: kworker/u8:8 Not tainted 6.10.0-rc6-syzkaller-01414-g58f9416d413a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:333 [inline]
simple_recursive_removal+0x35/0x8e0 fs/libfs.c:601
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823
ieee80211_sta_debugfs_remove+0x40/0x60 net/mac80211/debugfs_sta.c:1287
__sta_info_destroy_part2+0x35e/0x450 net/mac80211/sta_info.c:1476
__sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
sta_info_destroy_addr+0xf4/0x140 net/mac80211/sta_info.c:1504
ieee80211_destroy_auth_data+0x139/0x270 net/mac80211/mlme.c:4163
ieee80211_sta_work+0x1256/0x3850 net/mac80211/mlme.c:7801
cfg80211_wiphy_work+0x2db/0x490 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 57:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4002 [inline]
kmem_cache_alloc_lru_noprof+0x139/0x2b0 mm/slub.c:4021
__d_alloc+0x31/0x700 fs/dcache.c:1624
d_alloc fs/dcache.c:1704 [inline]
d_alloc_parallel+0xdf/0x1600 fs/dcache.c:2462
__lookup_slow+0x117/0x3f0 fs/namei.c:1677
lookup_one_len+0x18b/0x2d0 fs/namei.c:2764
start_creating+0x187/0x310 fs/debugfs/inode.c:378
debugfs_create_dir+0x25/0x430 fs/debugfs/inode.c:593
ieee80211_sta_debugfs_add+0x132/0x820 net/mac80211/debugfs_sta.c:1262
sta_info_insert_finish net/mac80211/sta_info.c:881 [inline]
sta_info_insert_rcu+0xecf/0x1900 net/mac80211/sta_info.c:949
sta_info_insert+0x16/0xc0 net/mac80211/sta_info.c:954
ieee80211_prep_connection+0xecd/0x12d0 net/mac80211/mlme.c:8319
ieee80211_mgd_auth+0xd42/0x14c0 net/mac80211/mlme.c:8564
rdev_auth net/wireless/rdev-ops.h:485 [inline]
cfg80211_mlme_auth+0x59f/0x980 net/wireless/mlme.c:291
cfg80211_conn_do_work+0x5ed/0xe60 net/wireless/sme.c:181
cfg80211_conn_work+0x27c/0x4d0 net/wireless/sme.c:271
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 0:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4438 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4513
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
__call_rcu_common kernel/rcu/tree.c:3072 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176
__dentry_kill+0x497/0x630 fs/dcache.c:622
dput+0x19f/0x2b0 fs/dcache.c:845
find_next_child fs/libfs.c:594 [inline]
simple_recursive_removal+0x2bd/0x8e0 fs/libfs.c:609
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823
ieee80211_debugfs_remove_netdev net/mac80211/debugfs_netdev.c:1022 [inline]
ieee80211_debugfs_recreate_netdev+0xc4/0x1400 net/mac80211/debugfs_netdev.c:1044
drv_remove_interface+0x1e1/0x590 net/mac80211/driver-ops.c:119
_ieee80211_change_mac net/mac80211/iface.c:278 [inline]
ieee80211_change_mac+0xaf5/0x11e0 net/mac80211/iface.c:310
dev_set_mac_address+0x327/0x510 net/core/dev.c:9095
dev_set_mac_address_user+0x31/0x50 net/core/dev.c:9114
dev_ifsioc+0xbd9/0xe70 net/core/dev_ioctl.c:541
dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:786
sock_do_ioctl+0x240/0x460 net/socket.c:1236
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88805e5cfd60
which belongs to the cache dentry of size 312
The buggy address is located 176 bytes inside of
freed 312-byte region [ffff88805e5cfd60, ffff88805e5cfe98)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e5ce
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015ef98c0 ffffea0000930c80 dead000000000002
raw: 0000000000000000 0000000000150015 00000001ffffefff 0000000000000000
head: 00fff00000000040 ffff888015ef98c0 ffffea0000930c80 dead000000000002
head: 0000000000000000 0000000000150015 00000001ffffefff 0000000000000000
head: 00fff00000000001 ffffea0001797381 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 4552, tgid 4552 (udevd), ts 33320668518, free_ts 17328144731
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3990 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4021
__d_alloc+0x31/0x700 fs/dcache.c:1624
d_alloc+0x4b/0x190 fs/dcache.c:1704
lookup_one_qstr_excl+0xce/0x260 fs/namei.c:1603
filename_create+0x297/0x540 fs/namei.c:3907
do_symlinkat+0xf9/0x3a0 fs/namei.c:4514
__do_sys_symlink fs/namei.c:4542 [inline]
__se_sys_symlink fs/namei.c:4540 [inline]
__x64_sys_symlink+0x7e/0x90 fs/namei.c:4540
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]
free_unref_page+0xd22/0xea0 mm/page_alloc.c:2588
free_contig_range+0x9e/0x160 mm/page_alloc.c:6642
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1017
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1397
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
ffff88805e5cfd00: 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb fb
ffff88805e5cfd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88805e5cfe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805e5cfe80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805e5cff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

On Mon, 15 Jul 2024 19:02:19 -0700

> syzbot found the following issue on:
>
> HEAD commit: 58f9416d413a Merge branch 'ice-support-to-dump-phy-config-..
> git tree: net-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git 58f9416d413a

--- x/net/mac80211/debugfs_sta.c
+++ y/net/mac80211/debugfs_sta.c
@@ -1284,6 +1284,12 @@ void ieee80211_sta_debugfs_add(struct st

void ieee80211_sta_debugfs_remove(struct sta_info *sta)
{
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+ if (!sdata->debugfs.subdir_stations)
+ return;
+ if (!sdata->vif.debugfs_dir)
+ return;
debugfs_remove_recursive(sta->debugfs_dir);
sta->debugfs_dir = NULL;
}
--

[syzbot]

syzbot has bisected this issue to:

commit 0a3d898ee9a8303d5b3982b97ef0703919c3ea76
Author: Benjamin Berg <benjam...@intel.com>
Date: Wed Dec 20 02:38:01 2023 +0000

wifi: mac80211: add/remove driver debugfs entries as appropriate

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=150e3cf1980000
start commit: 58f9416d413a Merge branch 'ice-support-to-dump-phy-config-..
git tree: net-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=170e3cf1980000
console output: https://syzkaller.appspot.com/x/log.txt?x=130e3cf1980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1658c7dd980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000

Reported-by: syzbot+d5dc28...@syzkaller.appspotmail.com
Fixes: 0a3d898ee9a8 ("wifi: mac80211: add/remove driver debugfs entries as appropriate")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get

wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005

Read of size 8 at addr ffff88806631f3c8 by task kworker/u8:6/1093

CPU: 1 PID: 1093 Comm: kworker/u8:6 Not tainted 6.10.0-rc6-syzkaller-01414-g58f9416d413a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:333 [inline]
simple_recursive_removal+0x35/0x8e0 fs/libfs.c:601
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823

ieee80211_sta_debugfs_remove+0xaa/0xe0 net/mac80211/debugfs_sta.c:1293

__sta_info_destroy_part2+0x35e/0x450 net/mac80211/sta_info.c:1476
__sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
sta_info_destroy_addr+0xf4/0x140 net/mac80211/sta_info.c:1504
ieee80211_destroy_auth_data+0x139/0x270 net/mac80211/mlme.c:4163
ieee80211_sta_work+0x1256/0x3850 net/mac80211/mlme.c:7801
cfg80211_wiphy_work+0x2db/0x490 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 5200:

Freed by task 16:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4438 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4513
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554

run_ksoftirqd+0xca/0x130 kernel/softirq.c:928
smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88806631f318

which belongs to the cache dentry of size 312
The buggy address is located 176 bytes inside of

freed 312-byte region [ffff88806631f318, ffff88806631f450)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6631e

head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88802baca901

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)

raw: 00fff00000000040 ffff888015ef98c0 ffffea0001982900 dead000000000002
raw: 0000000000000000 0000000000150015 00000001ffffefff ffff88802baca901
head: 00fff00000000040 ffff888015ef98c0 ffffea0001982900 dead000000000002
head: 0000000000000000 0000000000150015 00000001ffffefff ffff88802baca901
head: 00fff00000000001 ffffea000198c781 ffffffffffffffff 0000000000000000
head: 0000000700000002 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5179, tgid 5179 (kworker/1:4), ts 163914560570, free_ts 74628115189

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3990 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4021
__d_alloc+0x31/0x700 fs/dcache.c:1624

d_alloc fs/dcache.c:1704 [inline]
d_alloc_parallel+0xdf/0x1600 fs/dcache.c:2462
__lookup_slow+0x117/0x3f0 fs/namei.c:1677
lookup_one_len+0x18b/0x2d0 fs/namei.c:2764
start_creating+0x187/0x310 fs/debugfs/inode.c:378

__debugfs_create_file+0x73/0x4b0 fs/debugfs/inode.c:423
ieee80211_sta_debugfs_add+0x214/0x820 net/mac80211/debugfs_sta.c:1267

sta_info_insert_finish net/mac80211/sta_info.c:881 [inline]
sta_info_insert_rcu+0xecf/0x1900 net/mac80211/sta_info.c:949

page last free pid 5096 tgid 5096 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]

free_unref_folios+0xf23/0x19e0 mm/page_alloc.c:2637
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:329
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
unmap_region+0x2df/0x350 mm/mmap.c:2370
do_vmi_align_munmap+0x1122/0x18c0 mm/mmap.c:2683
do_vmi_munmap+0x261/0x2f0 mm/mmap.c:2759
__vm_munmap+0x1fc/0x400 mm/mmap.c:3038
__do_sys_munmap mm/mmap.c:3055 [inline]
__se_sys_munmap mm/mmap.c:3052 [inline]
__x64_sys_munmap+0x68/0x80 mm/mmap.c:3052

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88806631f280: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
ffff88806631f300: fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806631f380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806631f400: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
ffff88806631f480: fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=116d152d980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=13cb792d980000

[Edward Adam Davis]

before remove debugfs_dir set reference pointer to NULL

#syz test: linux-next 58f9416d413a

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 68596ef78b15..b9961edf6fa5 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -1019,8 +1019,10 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
if (!sdata->vif.debugfs_dir)
return;

- debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ struct dentry *debugfs_dir = sdata->vif.debugfs_dir;
+
sdata->vif.debugfs_dir = NULL;
+ debugfs_remove_recursive(debugfs_dir);
sdata->debugfs.subdir_stations = NULL;
}

diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 1e9389c49a57..357f310ec75f 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -1284,6 +1284,11 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)

void ieee80211_sta_debugfs_remove(struct sta_info *sta)
{
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+

+ if (!sdata->vif.debugfs_dir)
+ return;
+

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get

wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005

Read of size 8 at addr ffff888079a80228 by task kworker/u8:4/62

CPU: 0 PID: 62 Comm: kworker/u8:4 Not tainted 6.10.0-rc6-syzkaller-01414-g58f9416d413a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:333 [inline]
simple_recursive_removal+0x35/0x8e0 fs/libfs.c:601
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823

ieee80211_sta_debugfs_remove+0x85/0xb0 net/mac80211/debugfs_sta.c:1292

__sta_info_destroy_part2+0x35e/0x450 net/mac80211/sta_info.c:1476
__sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
sta_info_destroy_addr+0xf4/0x140 net/mac80211/sta_info.c:1504
ieee80211_destroy_auth_data+0x139/0x270 net/mac80211/mlme.c:4163
ieee80211_sta_work+0x1256/0x3850 net/mac80211/mlme.c:7801
cfg80211_wiphy_work+0x2db/0x490 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 9:

ieee80211_debugfs_remove_netdev net/mac80211/debugfs_netdev.c:1025 [inline]
ieee80211_debugfs_recreate_netdev+0xe5/0x1400 net/mac80211/debugfs_netdev.c:1046

drv_remove_interface+0x1e1/0x590 net/mac80211/driver-ops.c:119
_ieee80211_change_mac net/mac80211/iface.c:278 [inline]
ieee80211_change_mac+0xaf5/0x11e0 net/mac80211/iface.c:310
dev_set_mac_address+0x327/0x510 net/core/dev.c:9095
dev_set_mac_address_user+0x31/0x50 net/core/dev.c:9114
dev_ifsioc+0xbd9/0xe70 net/core/dev_ioctl.c:541
dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:786
sock_do_ioctl+0x240/0x460 net/socket.c:1236
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888079a80178

which belongs to the cache dentry of size 312
The buggy address is located 176 bytes inside of

freed 312-byte region [ffff888079a80178, ffff888079a802b0)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888079a818f8 pfn:0x79a80

head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff8880246c0001
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000240 ffff888015ef98c0 ffffea0000908290 ffffea0000908990
raw: ffff888079a818f8 000000000015000d 00000001ffffefff ffff8880246c0001
head: 00fff00000000240 ffff888015ef98c0 ffffea0000908290 ffffea0000908990
head: ffff888079a818f8 000000000015000d 00000001ffffefff ffff8880246c0001
head: 00fff00000000001 ffffea0001e6a001 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5158, tgid 5158 (syz-executor), ts 70763984393, free_ts 17755264398

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3990 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4021
__d_alloc+0x31/0x700 fs/dcache.c:1624

d_alloc+0x4b/0x190 fs/dcache.c:1704
lookup_one_qstr_excl+0xce/0x260 fs/namei.c:1603
filename_create+0x297/0x540 fs/namei.c:3907
do_symlinkat+0xf9/0x3a0 fs/namei.c:4514

__do_sys_symlinkat fs/namei.c:4537 [inline]
__se_sys_symlinkat fs/namei.c:4534 [inline]
__x64_sys_symlinkat+0x99/0xb0 fs/namei.c:4534

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

page last free pid 1 tgid 1 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]

free_unref_page+0xd22/0xea0 mm/page_alloc.c:2588
free_contig_range+0x9e/0x160 mm/page_alloc.c:6642
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1017
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1397
do_one_initcall+0x248/0x880 init/main.c:1267
do_initcall_level+0x157/0x210 init/main.c:1329
do_initcalls+0x3f/0x80 init/main.c:1345
kernel_init_freeable+0x435/0x5d0 init/main.c:1578
kernel_init+0x1d/0x2b0 init/main.c:1467

ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:

ffff888079a80100: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa
ffff888079a80180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888079a80200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888079a80280: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
ffff888079a80300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15ce003d980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=168e003d980000

[Berg, Benjamin]

Hi,

we assume in ieee80211_debugfs_recreate_netdev that there are no
stations, as their debugfs entries will be removed but not recreated.

In this case, ieee80211_debugfs_recreate_netdev is called because the
mac address is changed and we do have a station.

My hunch right now would be that we should prevent changing the mac
address while we have a valid station on the interface. But, we can
also recreate the station entries and maybe we should do that either
way to ensure we cannot get into this bad state.

Benjamin

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

[Hillf Danton]

On Mon, 15 Jul 2024 19:02:19 -0700

> syzbot found the following issue on:
>
> HEAD commit: 58f9416d413a Merge branch 'ice-support-to-dump-phy-config-..
> git tree: net-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git 58f9416d413a

--- x/net/mac80211/debugfs_netdev.c
+++ y/net/mac80211/debugfs_netdev.c
@@ -1016,12 +1016,15 @@ static void ieee80211_debugfs_add_netdev

void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
{
+ mutex_lock(&sdata->debug_mutex);
if (!sdata->vif.debugfs_dir)
- return;
+ goto out;

debugfs_remove_recursive(sdata->vif.debugfs_dir);
sdata->vif.debugfs_dir = NULL;
sdata->debugfs.subdir_stations = NULL;
+out:
+ mutex_unlock(&sdata->debug_mutex);
}

void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
--- x/net/mac80211/debugfs_sta.c
+++ y/net/mac80211/debugfs_sta.c
@@ -1284,8 +1284,13 @@ void ieee80211_sta_debugfs_add(struct st

void ieee80211_sta_debugfs_remove(struct sta_info *sta)
{
- debugfs_remove_recursive(sta->debugfs_dir);

+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+

+ mutex_lock(&sdata->debug_mutex);
+ if (sdata->debugfs.subdir_stations != NULL)

+ debugfs_remove_recursive(sta->debugfs_dir);
sta->debugfs_dir = NULL;

+ mutex_unlock(&sdata->debug_mutex);
}

#undef DEBUGFS_ADD
--- x/net/mac80211/ieee80211_i.h
+++ y/net/mac80211/ieee80211_i.h
@@ -1172,6 +1172,7 @@ struct ieee80211_sub_if_data {
u16 desired_active_links;

u16 restart_active_links;
+ struct mutex debug_mutex;

#ifdef CONFIG_MAC80211_DEBUGFS
struct {
--- x/net/mac80211/iface.c
+++ y/net/mac80211/iface.c
@@ -1091,6 +1091,7 @@ static void ieee80211_set_default_queues
static void ieee80211_sdata_init(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata)
{
+ mutex_init(&sdata->debug_mutex);
sdata->local = local;

/*
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get

wlan1: send auth to 08:02:11:00:00:00 (try 2/3)
wlan1: send auth to 08:02:11:00:00:00 (try 3/3)

wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005

Read of size 8 at addr ffff88806706cf60 by task kworker/u8:3/51

CPU: 1 PID: 51 Comm: kworker/u8:3 Not tainted 6.10.0-rc6-syzkaller-01414-g58f9416d413a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:333 [inline]
simple_recursive_removal+0x35/0x8e0 fs/libfs.c:601
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823

ieee80211_sta_debugfs_remove+0x98/0xe0 net/mac80211/debugfs_sta.c:1291

__sta_info_destroy_part2+0x35e/0x450 net/mac80211/sta_info.c:1476
__sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
sta_info_destroy_addr+0xf4/0x140 net/mac80211/sta_info.c:1504
ieee80211_destroy_auth_data+0x139/0x270 net/mac80211/mlme.c:4163
ieee80211_sta_work+0x1256/0x3850 net/mac80211/mlme.c:7801
cfg80211_wiphy_work+0x2db/0x490 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 786:

ieee80211_debugfs_remove_netdev net/mac80211/debugfs_netdev.c:1023 [inline]
ieee80211_debugfs_recreate_netdev+0xd5/0x1400 net/mac80211/debugfs_netdev.c:1047

drv_remove_interface+0x1e1/0x590 net/mac80211/driver-ops.c:119
_ieee80211_change_mac net/mac80211/iface.c:278 [inline]
ieee80211_change_mac+0xaf5/0x11e0 net/mac80211/iface.c:310
dev_set_mac_address+0x327/0x510 net/core/dev.c:9095
dev_set_mac_address_user+0x31/0x50 net/core/dev.c:9114
dev_ifsioc+0xbd9/0xe70 net/core/dev_ioctl.c:541
dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:786
sock_do_ioctl+0x240/0x460 net/socket.c:1236
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88806706ceb0

which belongs to the cache dentry of size 312
The buggy address is located 176 bytes inside of

freed 312-byte region [ffff88806706ceb0, ffff88806706cfe8)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6706c

head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88802d138201
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015ef98c0 ffffea00019c0d80 dead000000000003
raw: 0000000000000000 0000000000150015 00000001ffffefff ffff88802d138201
head: 00fff00000000040 ffff888015ef98c0 ffffea00019c0d80 dead000000000003
head: 0000000000000000 0000000000150015 00000001ffffefff ffff88802d138201
head: 00fff00000000001 ffffea00019c1b01 ffffffffffffffff 0000000000000000
head: 0000000700000002 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 4548, tgid 4548 (udevd), ts 79059185868, free_ts 66719430476

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3990 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4021
__d_alloc+0x31/0x700 fs/dcache.c:1624

d_alloc fs/dcache.c:1704 [inline]
d_alloc_parallel+0xdf/0x1600 fs/dcache.c:2462
__lookup_slow+0x117/0x3f0 fs/namei.c:1677

lookup_slow+0x53/0x70 fs/namei.c:1709
walk_component+0x2e1/0x410 fs/namei.c:2004
lookup_last fs/namei.c:2469 [inline]
path_lookupat+0x16f/0x450 fs/namei.c:2493
filename_lookup+0x256/0x610 fs/namei.c:2522
user_path_at_empty+0x42/0x60 fs/namei.c:2929
page last free pid 5092 tgid 5092 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]

free_unref_folios+0xf23/0x19e0 mm/page_alloc.c:2637
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:329
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
unmap_region+0x2df/0x350 mm/mmap.c:2370
do_vmi_align_munmap+0x1122/0x18c0 mm/mmap.c:2683
do_vmi_munmap+0x261/0x2f0 mm/mmap.c:2759
__vm_munmap+0x1fc/0x400 mm/mmap.c:3038
__do_sys_munmap mm/mmap.c:3055 [inline]
__se_sys_munmap mm/mmap.c:3052 [inline]
__x64_sys_munmap+0x68/0x80 mm/mmap.c:3052

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88806706ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff88806706ce80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb
>ffff88806706cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806706cf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff88806706d000: fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=12e6a03d980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=13a3b731980000

[Edward Adam Davis]

before remove debugfs_dir set reference pointer to NULL

#syz test: linux-next 58f9416d413a

diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index fe868b521622..fe29ba561599 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -113,11 +113,10 @@ void drv_remove_interface(struct ieee80211_local *local,
if (!check_sdata_in_driver(sdata))
return;

- sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
-
/* Remove driver debugfs entries */
ieee80211_debugfs_recreate_netdev(sdata, sdata->vif.valid_links);

+ sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
trace_drv_remove_interface(local, sdata);
local->ops->remove_interface(&local->hw, &sdata->vif);
trace_drv_return_void(local);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get

wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005

Read of size 8 at addr ffff88806b24ede8 by task kworker/u8:1/7170

CPU: 0 PID: 7170 Comm: kworker/u8:1 Not tainted 6.10.0-rc6-syzkaller-01414-g58f9416d413a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:333 [inline]
simple_recursive_removal+0x35/0x8e0 fs/libfs.c:601
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823

ieee80211_sta_debugfs_remove+0x40/0x60 net/mac80211/debugfs_sta.c:1287

__sta_info_destroy_part2+0x35e/0x450 net/mac80211/sta_info.c:1476
__sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
sta_info_destroy_addr+0xf4/0x140 net/mac80211/sta_info.c:1504
ieee80211_destroy_auth_data+0x139/0x270 net/mac80211/mlme.c:4163
ieee80211_sta_work+0x1256/0x3850 net/mac80211/mlme.c:7801
cfg80211_wiphy_work+0x2db/0x490 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 928:

ieee80211_debugfs_remove_netdev net/mac80211/debugfs_netdev.c:1022 [inline]
ieee80211_debugfs_recreate_netdev+0xc4/0x1400 net/mac80211/debugfs_netdev.c:1044

drv_remove_interface+0x1c9/0x580 net/mac80211/driver-ops.c:117

_ieee80211_change_mac net/mac80211/iface.c:278 [inline]
ieee80211_change_mac+0xaf5/0x11e0 net/mac80211/iface.c:310
dev_set_mac_address+0x327/0x510 net/core/dev.c:9095
dev_set_mac_address_user+0x31/0x50 net/core/dev.c:9114
dev_ifsioc+0xbd9/0xe70 net/core/dev_ioctl.c:541
dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:786
sock_do_ioctl+0x240/0x460 net/socket.c:1236
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88806b24ed38

which belongs to the cache dentry of size 312
The buggy address is located 176 bytes inside of

freed 312-byte region [ffff88806b24ed38, ffff88806b24ee70)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6b24e

head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff88802d91c601
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015ef98c0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000150015 00000001ffffefff ffff88802d91c601
head: 00fff00000000040 ffff888015ef98c0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000150015 00000001ffffefff ffff88802d91c601
head: 00fff00000000001 ffffea0001ac9381 ffffffffffffffff 0000000000000000

head: 0000000700000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5271, tgid 5271 (udevd), ts 76674984449, free_ts 59074482394

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2265
allocate_slab+0x5a/0x2f0 mm/slub.c:2428
new_slab mm/slub.c:2481 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
__slab_alloc+0x58/0xa0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3990 [inline]
kmem_cache_alloc_lru_noprof+0x1c5/0x2b0 mm/slub.c:4021
__d_alloc+0x31/0x700 fs/dcache.c:1624
d_alloc fs/dcache.c:1704 [inline]
d_alloc_parallel+0xdf/0x1600 fs/dcache.c:2462

lookup_open fs/namei.c:3430 [inline]
open_last_lookups fs/namei.c:3574 [inline]
path_openat+0x92f/0x35f0 fs/namei.c:3810
do_filp_open+0x235/0x490 fs/namei.c:3840
do_sys_openat2+0x13e/0x1d0 fs/open.c:1413
do_sys_open fs/open.c:1428 [inline]
__do_sys_openat fs/open.c:1444 [inline]
__se_sys_openat fs/open.c:1439 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1439

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

page last free pid 5091 tgid 5091 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]
free_unref_folios+0xf23/0x19e0 mm/page_alloc.c:2637
folios_put_refs+0x93a/0xa60 mm/swap.c:1024
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:329
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
unmap_region+0x2df/0x350 mm/mmap.c:2370
do_vmi_align_munmap+0x1122/0x18c0 mm/mmap.c:2683
do_vmi_munmap+0x261/0x2f0 mm/mmap.c:2759
__vm_munmap+0x1fc/0x400 mm/mmap.c:3038
__do_sys_munmap mm/mmap.c:3055 [inline]
__se_sys_munmap mm/mmap.c:3052 [inline]
__x64_sys_munmap+0x68/0x80 mm/mmap.c:3052
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88806b24ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
ffff88806b24ed00: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
>ffff88806b24ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806b24ee00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff88806b24ee80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17736fdd980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1028d8e6980000

[Edward Adam Davis]

before remove debugfs_dir set reference pointer to NULL

#syz test: linux-next 58f9416d413a

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index aa22f09e6d14..6d807c3abcb6 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1473,7 +1473,8 @@ static void __sta_info_destroy_part2(struct sta_info *sta, bool recalc)
cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
kfree(sinfo);

- ieee80211_sta_debugfs_remove(sta);
+ if (sdata->flags & IEEE80211_SDATA_IN_DRIVER)
+ ieee80211_sta_debugfs_remove(sta);

ieee80211_destroy_frag_cache(&sta->frags);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get

wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005

Read of size 8 at addr ffff88807aa2ade8 by task kworker/u8:9/2858

CPU: 0 PID: 2858 Comm: kworker/u8:9 Not tainted 6.10.0-rc6-syzkaller-01414-g58f9416d413a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__lock_acquire+0x78/0x1fd0 kernel/locking/lockdep.c:5005
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
lockref_get+0x15/0x60 lib/lockref.c:50
dget include/linux/dcache.h:333 [inline]
simple_recursive_removal+0x35/0x8e0 fs/libfs.c:601
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823
ieee80211_sta_debugfs_remove+0x40/0x60 net/mac80211/debugfs_sta.c:1287

__sta_info_destroy_part2+0x3b2/0x4c0 net/mac80211/sta_info.c:1477
__sta_info_destroy net/mac80211/sta_info.c:1493 [inline]
sta_info_destroy_addr+0xf4/0x140 net/mac80211/sta_info.c:1505

ieee80211_destroy_auth_data+0x139/0x270 net/mac80211/mlme.c:4163
ieee80211_sta_work+0x1256/0x3850 net/mac80211/mlme.c:7801
cfg80211_wiphy_work+0x2db/0x490 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 5176:

Freed by task 25:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4438 [inline]
kmem_cache_free+0x145/0x350 mm/slub.c:4513
rcu_do_batch kernel/rcu/tree.c:2535 [inline]
rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554

do_softirq+0x11b/0x1e0 kernel/softirq.c:455
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
spin_unlock_bh include/linux/spinlock.h:396 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline]
nsim_dev_trap_report_work+0x75d/0xaa0 drivers/net/netdevsim/dev.c:850

process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541
__call_rcu_common kernel/rcu/tree.c:3072 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176
__dentry_kill+0x497/0x630 fs/dcache.c:622
dput+0x19f/0x2b0 fs/dcache.c:845
find_next_child fs/libfs.c:594 [inline]
simple_recursive_removal+0x2bd/0x8e0 fs/libfs.c:609
debugfs_remove+0x49/0x70 fs/debugfs/inode.c:823
ieee80211_debugfs_remove_netdev net/mac80211/debugfs_netdev.c:1022 [inline]
ieee80211_debugfs_recreate_netdev+0xc4/0x1400 net/mac80211/debugfs_netdev.c:1044

drv_remove_interface+0x1e1/0x590 net/mac80211/driver-ops.c:119

_ieee80211_change_mac net/mac80211/iface.c:278 [inline]
ieee80211_change_mac+0xaf5/0x11e0 net/mac80211/iface.c:310
dev_set_mac_address+0x327/0x510 net/core/dev.c:9095
dev_set_mac_address_user+0x31/0x50 net/core/dev.c:9114
dev_ifsioc+0xbd9/0xe70 net/core/dev_ioctl.c:541
dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:786
sock_do_ioctl+0x240/0x460 net/socket.c:1236
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88807aa2ad38

which belongs to the cache dentry of size 312
The buggy address is located 176 bytes inside of

freed 312-byte region [ffff88807aa2ad38, ffff88807aa2ae70)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7aa2a

head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888022de1f01

anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015ef98c0 0000000000000000 dead000000000001

raw: 0000000000000000 0000000000150015 00000001ffffefff ffff888022de1f01

head: 00fff00000000040 ffff888015ef98c0 0000000000000000 dead000000000001

head: 0000000000000000 0000000000150015 00000001ffffefff ffff888022de1f01
head: 00fff00000000001 ffffea0001ea8a81 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 5900, tgid 5900 (udevd), ts 118723483735, free_ts 96879687479

page last free pid 4761 tgid 4761 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]

free_unref_page+0xd22/0xea0 mm/page_alloc.c:2588
__slab_free+0x31b/0x3d0 mm/slub.c:4349
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322

kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4002 [inline]

kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4045
__alloc_skb+0x1c3/0x440 net/core/skbuff.c:664
alloc_skb include/linux/skbuff.h:1320 [inline]
alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6526
sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2815
unix_dgram_sendmsg+0x6d3/0x1f80 net/unix/af_unix.c:2030
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88807aa2ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
ffff88807aa2ad00: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
>ffff88807aa2ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807aa2ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff88807aa2ae80: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb

==================================================================


Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=14034f31980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=12f885a5980000

[Edward Adam Davis]

before remove debugfs_dir set reference pointer to NULL

#syz test: linux-next 58f9416d413a

diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index fe868b521622..5e0f909d4c76 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -113,13 +113,9 @@ void drv_remove_interface(struct ieee80211_local *local,

if (!check_sdata_in_driver(sdata))
return;

- sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
-
- /* Remove driver debugfs entries */

- ieee80211_debugfs_recreate_netdev(sdata, sdata->vif.valid_links);
-

trace_drv_remove_interface(local, sdata);
local->ops->remove_interface(&local->hw, &sdata->vif);
+ sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;

trace_drv_return_void(local);
}

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+d5dc28...@syzkaller.appspotmail.com
Tested-by: syzbot+d5dc28...@syzkaller.appspotmail.com

Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=13a8c72d980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=136131fd980000

Note: testing is done by a robot and is best-effort only.

[Hillf Danton]

On Mon, 15 Jul 2024 19:02:19 -0700

> syzbot found the following issue on:
>
> HEAD commit: 58f9416d413a Merge branch 'ice-support-to-dump-phy-config-..
> git tree: net-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ed24b5980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git 58f9416d413a

--- x/net/mac80211/iface.c
+++ y/net/mac80211/iface.c
@@ -1091,6 +1091,7 @@ static void ieee80211_set_default_queues
static void ieee80211_sdata_init(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata)
{
+ mutex_init(&sdata->debug_mutex);
sdata->local = local;

/*

--- x/net/mac80211/ieee80211_i.h
+++ y/net/mac80211/ieee80211_i.h
@@ -1172,6 +1172,8 @@ struct ieee80211_sub_if_data {

u16 desired_active_links;

u16 restart_active_links;
+ struct mutex debug_mutex;

+ u32 dev_seq, sta_seq;

#ifdef CONFIG_MAC80211_DEBUGFS
struct {
--- x/net/mac80211/debugfs_netdev.c
+++ y/net/mac80211/debugfs_netdev.c
@@ -1016,12 +1016,16 @@ static void ieee80211_debugfs_add_netdev

void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
{
+ mutex_lock(&sdata->debug_mutex);
if (!sdata->vif.debugfs_dir)
- return;
+ goto out;

debugfs_remove_recursive(sdata->vif.debugfs_dir);
sdata->vif.debugfs_dir = NULL;
sdata->debugfs.subdir_stations = NULL;

+ sdata->dev_seq++;

+out:
+ mutex_unlock(&sdata->debug_mutex);
}

void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
--- x/net/mac80211/debugfs_sta.c
+++ y/net/mac80211/debugfs_sta.c

@@ -1280,12 +1280,18 @@ void ieee80211_sta_debugfs_add(struct st
&sta->driver_buffered_tids);

drv_sta_add_debugfs(local, sdata, &sta->sta, sta->debugfs_dir);
+ sdata->sta_seq = sdata->dev_seq;

}

void ieee80211_sta_debugfs_remove(struct sta_info *sta)
{
- debugfs_remove_recursive(sta->debugfs_dir);
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+ mutex_lock(&sdata->debug_mutex);

+ if (sdata->sta_seq == sdata->dev_seq)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+d5dc28...@syzkaller.appspotmail.com
Tested-by: syzbot+d5dc28...@syzkaller.appspotmail.com

Tested on:

commit: 58f9416d Merge branch 'ice-support-to-dump-phy-config-..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=12d9e159980000

kernel config: https://syzkaller.appspot.com/x/.config?x=db697e01efa9d1d7
dashboard link: https://syzkaller.appspot.com/bug?extid=d5dc2801166df6d34774
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=111a7b2d980000