"KASAN: slab-use-after-free Write in detach_worker" in Linux Kernel v6.12-rc4

"KASAN: slab-use-after-free Write in detach_worker" in Linux Kernel v6.12-rc4

[cheung wall]

[-- Attachment #1: Type: text/plain, Size: 440 bytes --]

Hello,

I am writing to report a potential vulnerability identified in the
Linux Kernel version v6.12-rc4. This vulnerability was discovered
while I was testing the kernel.

Linux Kernel Repository Git Commit:
42f7652d3eb527d03665b09edac47f85fb600924 (tag: v6.12-rc4)

Bug Location: detach_worker+0x164/0x180 kernel/workqueue.c:2709

Attached is the bug log file and report file.

Thank you for your time and attention.

Best regards

Wall

[-- Attachment #2: log --]
[-- Type: application/octet-stream, Size: 1064588 bytes --]

[-- Attachment #3: report --]
[-- Type: application/octet-stream, Size: 5373 bytes --]

==================================================================
BUG: KASAN: slab-use-after-free in __list_del include/linux/list.h:195 [inline]
BUG: KASAN: slab-use-after-free in __list_del_entry include/linux/list.h:218 [inline]
BUG: KASAN: slab-use-after-free in list_del include/linux/list.h:229 [inline]
BUG: KASAN: slab-use-after-free in detach_worker+0x164/0x180 kernel/workqueue.c:2709
Write of size 8 at addr ffff88810d694380 by task kworker/R-write/40

CPU: 1 UID: 0 PID: 40 Comm: kworker/R-write Not tainted 6.12.0-rc4 #1
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue:  0x0 (writeback)
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xcb/0x620 mm/kasan/report.c:488
 kasan_report+0xbd/0xf0 mm/kasan/report.c:601
 __list_del include/linux/list.h:195 [inline]
 __list_del_entry include/linux/list.h:218 [inline]
 list_del include/linux/list.h:229 [inline]
 detach_worker+0x164/0x180 kernel/workqueue.c:2709
 worker_detach_from_pool kernel/workqueue.c:2728 [inline]
 rescuer_thread+0x69d/0xcd0 kernel/workqueue.c:3526
 kthread+0x2c2/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 8064:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:394
 kmalloc_node_noprof include/linux/slab.h:901 [inline]
 get_unbound_pool kernel/workqueue.c:5008 [inline]
 alloc_unbound_pwq+0x687/0x1000 kernel/workqueue.c:5136
 apply_wqattrs_prepare+0x49c/0xe20 kernel/workqueue.c:5261
 apply_workqueue_attrs_locked+0x64/0xf0 kernel/workqueue.c:5337
 wq_cpumask_store+0xe4/0x180 kernel/workqueue.c:7139
 dev_attr_store+0x57/0x80 drivers/base/core.c:2447
 sysfs_kf_write+0x117/0x170 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x33c/0x500 fs/kernfs/file.c:334
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xbcb/0x10d0 fs/read_write.c:683
 ksys_write+0x122/0x250 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xbf/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 0:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3a/0x60 mm/kasan/generic.c:579
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x38/0x50 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:2342 [inline]
 slab_free mm/slub.c:4579 [inline]
 kfree+0x212/0x4a0 mm/slub.c:4727
 rcu_do_batch kernel/rcu/tree.c:2567 [inline]
 rcu_core+0x835/0x17f0 kernel/rcu/tree.c:2823
 handle_softirqs+0x1b1/0x7d0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0x94/0xc0 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x70/0x80 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Last potentially related work creation:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 __kasan_record_aux_stack+0x8c/0xa0 mm/kasan/generic.c:541
 __call_rcu_common.constprop.0+0x6a/0xad0 kernel/rcu/tree.c:3086
 put_unbound_pool+0x552/0x830 kernel/workqueue.c:4965
 pwq_release_workfn+0x4c6/0x9e0 kernel/workqueue.c:5065
 kthread_worker_fn+0x2b9/0xb00 kernel/kthread.c:844
 kthread+0x2c2/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88810d694000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 896 bytes inside of
 freed 2048-byte region [ffff88810d694000, ffff88810d694800)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810d694000 pfn:0x10d690
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000240(workingset|head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000240 ffff888100042f00 ffffea0004032610 ffffea00043bc810
raw: ffff88810d694000 0000000000080001 00000001f5000000 0000000000000000
head: 0200000000000240 ffff888100042f00 ffffea0004032610 ffffea00043bc810
head: ffff88810d694000 0000000000080001 00000001f5000000 0000000000000000
head: 0200000000000003 ffffea000435a401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88810d694280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88810d694300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88810d694380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88810d694400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88810d694480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Re: "KASAN: slab-use-after-free Write in detach_worker" in Linux Kernel v6.12-rc4

[Tejun Heo]

On Wed, Jan 15, 2025 at 10:10:26AM +0800, cheung wall wrote:
> Hello,
> 
> I am writing to report a potential vulnerability identified in the
> Linux Kernel version v6.12-rc4. This vulnerability was discovered
> while I was testing the kernel.
> 
> Linux Kernel Repository Git Commit:
> 42f7652d3eb527d03665b09edac47f85fb600924 (tag: v6.12-rc4)
> 
> Bug Location: detach_worker+0x164/0x180 kernel/workqueue.c:2709
> 
> Attached is the bug log file and report file.
> 
> Thank you for your time and attention.

I don't know how reproducible the problem is but can you please see whether
the followign patch resolves the issue?

Thanks.

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 33a23c7b2274..e1d2f8bf28d7 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3516,22 +3516,22 @@ static int rescuer_thread(void *__rescuer)
 			}
 		}
 
-		/*
-		 * Put the reference grabbed by send_mayday().  @pool won't
-		 * go away while we're still attached to it.
-		 */
-		put_pwq(pwq);
-
 		/*
 		 * Leave this pool. Notify regular workers; otherwise, we end up
 		 * with 0 concurrency and stalling the execution.
 		 */
 		kick_pool(pool);
-
 		raw_spin_unlock_irq(&pool->lock);
-
 		worker_detach_from_pool(rescuer);
 
+		/*
+		 * Put the reference grabbed by send_mayday(). This must come
+		 * after the final access of the pool.
+		 */
+		raw_spin_lock_irq(&pool->lock);
+		put_pwq(pwq);
+		raw_spin_unlock_irq(&pool->lock);
+
 		raw_spin_lock_irq(&wq_mayday_lock);
 	}