Baokun Li da4a827416 cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() ... We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0 Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...] Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ================================================================== Following is the process that triggers the issue: mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!! When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue. Fixes: 0a7e54c195 ("cachefiles: resend an open request if the read request's object is closed") Signed-off-by: Baokun Li <libaokun1@huawei.com> Link: https://lore.kernel.org/r/20240522114308.2402121-5-libaokun@huaweicloud.com Acked-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com> Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com> Signed-off-by: Christian Brauner <brauner@kernel.org>		2024-05-29 13:03:29 +02:00
..
acpi	ACPI updates for 6.9-rc1	2024-03-13 11:54:05 -07:00
asm-generic	export.h: remove include/asm-generic/export.h	2024-03-28 11:04:20 +09:00
clocksource
crypto	This update includes the following changes:	2024-03-15 14:46:54 -07:00
drm	drm fixes for 6.9-rc1	2024-03-21 19:04:31 -07:00
dt-bindings	Char/Misc and other driver subsystem updates for 6.9-rc1	2024-03-21 13:21:31 -07:00
keys
kunit
kvm	KVM: arm64: Fix host-programmed guest events in nVHE	2024-03-26 01:51:44 -07:00
linux	cpumask: add cpumask_any_and_but()	2024-04-09 16:47:15 +01:00
math-emu
media	media updates for v6.9-rc1	2024-03-15 11:36:54 -07:00
memory
misc
net	net: mana: Fix Rx DMA datasize and skb_over_panic	2024-04-03 19:32:03 -07:00
pcmcia
ras
rdma
rv
scsi	scsi: sd: Fix TCG OPAL unlock on system resume	2024-03-25 15:46:12 -04:00
soc	Char/Misc and other driver subsystem updates for 6.9-rc1	2024-03-21 13:21:31 -07:00
sound	ASoC: Fixes for v6.9	2024-04-05 08:48:12 +02:00
target
trace	cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()	2024-05-29 13:03:29 +02:00
uapi	SCSI fixes on 20240330	2024-03-30 13:44:52 -07:00
ufs
vdso	vdso: Use CONFIG_PAGE_SHIFT in vdso/datapage.h	2024-04-03 21:50:04 +02:00
video
xen