On 8/8/26 7:00 PM, Yang Zi wrote: > Hi, > > While fuzzing the kernel with syzkaller (KASAN), we hit a slab > use-after-free in the module loader's idempotent path. The crash is a > Read of size 8 in `idempotent()` in kernel/module/main.c while > concurrently loading modules via `finit_module`, when the load fd is > `close()`d from another thread. > > Reproducer summary: > > BUG: KASAN: slab-use-after-free in idempotent kernel/module/main.c:3682 > [inline] > BUG: KASAN: slab-use-after-free in idempotent_init_module > kernel/module/main.c:3788 [inline] > BUG: KASAN: slab-use-after-free in __do_sys_finit_module > kernel/module/main.c:3815 [inline] > Read of size 8 at addr ffff88800d36fe48 by task modprobe/715 > > The buggy address belongs to the object at ffff88800d36f700 > which belongs to the cache UNIX-STREAM of size 2048 > The buggy address is located 1864 bytes inside of a freed 2048-byte region > > Allocated by task 634: __sys_socket → unix_create1 → sk_alloc → > kmem_cache_alloc (2048 B) > Freed by task 634: __x64_sys_close → __fput → sock_close → unix_release_sock > → __sk_destruct → sk_prot_free → kmem_cache_free > > `idempotent()` uses `file_inode(f)` as the cookie to compare entries on the > global `idem_hash` list. `fdget` only holds a reference on the `struct file`, > not on the inode/socket object. When a concurrent thread `close()`s the > module-load fd while another `finit_module` is inside `idempotent()`, the > `UNIX-STREAM` socket object is freed and the inode-cookie is dereferenced on > the hash list → slab-use-after-free (Read 8 B). > > Root-cause hypothesis: the `file_inode(f)` cookie has no lifetime protection > across the `hlist_for_each_entry` in `idempotent()`; the concurrent `close` > can release the object underneath the traversal.
This doesn't quite hold up. 1) idempotent() never dereferences the file_inode(f) cookie, so it cannot cause a use-after-free. 2) finit_module() calls fdget() on the input file and the file itself pins its inode. I'm afraid this looks very much like AI-generated spam. If it is a genuine report, please provide more information, such as a syzkaller reproducer and the full boot log. -- Thanks, Petr
