Re: [PATCH v4] hugetlbfs: move hugetlbfs_free_inode tracepoint to ->destroy_inode()

["David Hildenbrand (Arm)" <david@kernel.org>]

On 11/2/26 14:03, Joas Antonio dos Santos via B4 Relay wrote:
> From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> hugetlbfs_free_inode() calls trace_hugetlbfs_free_inode(), and the
> hugetlbfs__inode event class records inode->i_sb->s_dev.  ->free_inode()
> runs from an RCU callback (destroy_inode() queues i_callback() with
> call_rcu()), and Documentation/filesystems/porting.rst says that this
> callback "is *NOT* ordered wrt superblock destruction; as the matter of
> fact, the superblock and all associated structures might be already
> gone".  put_super() frees the superblock with call_rcu() followed by a
> workqueue item (destroy_super_rcu() -> destroy_super_work()).  syzbot
> hit this with the event enabled:
> 
>   BUG: KASAN: slab-use-after-free in trace_event_raw_event_hugetlbfs__inode+0x45b/0x4c0 include/trace/events/hugetlbfs.h:36
>   Read of size 4 at addr ffff888038850010 by task syz-executor952/6134
>    hugetlbfs_free_inode+0x15e/0x1f0 fs/hugetlbfs/inode.c:1182
>    i_callback+0x46/0x80 fs/inode.c:317
>    rcu_do_batch kernel/rcu/tree.c:2650 [inline]
>    rcu_core+0x5f0/0x1220 kernel/rcu/tree.c:2919
>   Allocated by task 6134:
>    alloc_super fs/super.c:326 [inline]
>    sget_fc+0x1ba/0x1f60 fs/super.c:874
>    hugetlbfs_get_tree+0x1e7/0x2b0 fs/hugetlbfs/inode.c:1431
>   Freed by task 855:
>    kfree+0x22b/0x6d0 mm/slub.c:6923
>    process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
> 
> Emit the event from hugetlbfs_destroy_inode() instead.  destroy_inode()
> calls ->destroy_inode() synchronously, before it queues the RCU
> callback, while the superblock is still alive; hugetlbfs_destroy_inode()
> already dereferences inode->i_sb there.  ->free_inode() is left with
> only the kmem_cache_free().
> 
> Since the event no longer fires from ->free_inode(), rename it to
> hugetlbfs_destroy_inode so that its name matches where it is emitted,
> as suggested by David and Muchun.
> 
> Found by syzbot; analysed and tested with the syzbot C reproducer on an
> arm64 KASAN kernel.
> 
> Fixes: 014ad7c42a69 ("hugetlbfs: use tracepoints in hugetlbfs functions.")
> Reported-by: syzbot+91e1fc35f51774c479b2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6ae27525.5451848c.f7707.0001.GAE@google.com/
> Suggested-by: David Hildenbrand <david@kernel.org>
> Suggested-by: Muchun Song <muchun.song@linux.dev>
> Cc: stable@vger.kernel.org
> Reviewed-by: Muchun Song <muchun.song@linux.dev>
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
> ---

Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David