Hi,
Using the same fuzzing campaign as the sibling slab-UAF report, we hit a
use-after-free in the module loader's `idempotent()` while concurrently
loading ath10k_pci modules. This variant frees the backing physical page
entirely (returned to buddy, all KASAN shadow `0xff`), and is followed by a
GPF in the same function.
Reproducer summary:
BUG: KASAN: use-after-free in idempotent kernel/module/main.c:3682 [inline]
BUG: KASAN: use-after-free in idempotent_init_module
kernel/module/main.c:3788 [inline]
BUG: KASAN: use-after-free in __do_sys_finit_module
kernel/module/main.c:3815 [inline]
Read of size 8 at addr ffff88800f54fe48 by task modprobe/733
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 ... pfn:0xf54f (shadow all 0xff = freed)
Followed by:
Oops: general protection fault, probably for non-canonical address
0xdffffc00000003a5; KASAN: probably user-memory-access in range
[0x0000000000001d28-0x0000000000001d2f] inside idempotent().
`idempotent()` walks the global `idem_hash` list comparing `existing->cookie !=
cookie` where `cookie = file_inode(f)`. `fdget` pins only the `struct file`, not
the inode/backing page. A concurrent `close()` of the module-load fd frees the
inode's page and returns it to the buddy allocator (refcount 0, shadow all
`0xff`); another in-flight `finit_module` then dereferences that freed cookie.
This is the same root cause as the sibling slab-UAF
(https://lore.kernel.org/all/[email protected]/)
— the
only difference is the object type released: a whole buddy page here vs. a
`UNIX-STREAM` slab object there. Should be fixed together in
`idempotent_init_module()` / `idempotent()`.
The crash report shows below:
BUG: KASAN: use-after-free in idempotent kernel/module/main.c:3682 [inline]
BUG: KASAN: use-after-free in idempotent_init_module kernel/module/main.c:3788
[inline]
BUG: KASAN: use-after-free in __do_sys_finit_module kernel/module/main.c:3815
[inline]
BUG: KASAN: use-after-free in __se_sys_finit_module+0x2ce/0x570
kernel/module/main.c:3799
Read of size 8 at addr ffff88800f54fe48 by task modprobe/733
CPU: 0 UID: 0 PID: 733 Comm: modprobe Tainted: G D 7.1.0 #1
PREEMPT(lazy)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xa2/0xd0 lib/dump_stack.c:120
print_address_description+0x77/0x200 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
idempotent kernel/module/main.c:3682 [inline]
idempotent_init_module kernel/module/main.c:3788 [inline]
__do_sys_finit_module kernel/module/main.c:3815 [inline]
__se_sys_finit_module+0x2ce/0x570 kernel/module/main.c:3799
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x143/0x470 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3387df725d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01
c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffda1809848 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055fcd40f9e40 RCX: 00007f3387df725d
RDX: 0000000000000000 RSI: 000055fcbe6cfe52 RDI: 0000000000000008
RBP: 00007ffda1809900 R08: 0000000000000040 R09: 00007ffda1809890
R10: 00007f3387ed3b20 R11: 0000000000000246 R12: 000055fcbe6cfe52
R13: 0000000000040000 R14: 000055fcd4101590 R15: 0000000000000000
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xf54f
flags: 0x100000000000000(node=0|zone=1)
raw: 0100000000000000 0000000000000000 ffffea00003d53c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800f54fd00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88800f54fd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88800f54fe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88800f54fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88800f54ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Regards,
Yang Zi
