Re: [syzbot] KASAN: use-after-free Read in bdev_free_inode

[Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>]

This seems to be kfree() before RCU grace period.

struct block_device *bdev_alloc(struct gendisk *disk, u8 partno)
{
	struct block_device *bdev;
	struct inode *inode;

	inode = new_inode(blockdev_superblock);
	if (!inode)
		return NULL;
	inode->i_mode = S_IFBLK;
	inode->i_rdev = 0;
	inode->i_data.a_ops = &def_blk_aops;
	mapping_set_gfp_mask(&inode->i_data, GFP_USER);

	bdev = I_BDEV(inode);
	mutex_init(&bdev->bd_fsfreeze_mutex);
	spin_lock_init(&bdev->bd_size_lock);
	bdev->bd_disk = disk; // <= Assigns pointer to "disk".
	bdev->bd_partno = partno;
	bdev->bd_inode = inode;
	bdev->bd_stats = alloc_percpu(struct disk_stats);
	if (!bdev->bd_stats) {
		iput(inode); // <= Will call bdev_free_inode() via i_callback() after RCU from destroy_inode() from evict() from iput_final() from iput().
		return NULL;
	}
	return bdev;
}

struct gendisk *__alloc_disk_node(struct request_queue *q, int node_id,
		struct lock_class_key *lkclass)
{
	struct gendisk *disk;

	if (!blk_get_queue(q))
		return NULL;

	disk = kzalloc_node(sizeof(struct gendisk), GFP_KERNEL, node_id);
	if (!disk)
		goto out_put_queue;

	disk->bdi = bdi_alloc(node_id);
	if (!disk->bdi)
		goto out_free_disk;

	disk->part0 = bdev_alloc(disk, 0);
	if (!disk->part0)
		goto out_free_bdi;

	disk->node_id = node_id;
	mutex_init(&disk->open_mutex);
	xa_init(&disk->part_tbl);
	if (xa_insert(&disk->part_tbl, 0, disk->part0, GFP_KERNEL))
		goto out_destroy_part_tbl;

	rand_initialize_disk(disk);
	disk_to_dev(disk)->class = &block_class;
	disk_to_dev(disk)->type = &disk_type;
	device_initialize(disk_to_dev(disk));
	inc_diskseq(disk);
	disk->queue = q;
	q->disk = disk;
	lockdep_init_map(&disk->lockdep_map, "(bio completion)", lkclass, 0);
#ifdef CONFIG_BLOCK_HOLDER_DEPRECATED
	INIT_LIST_HEAD(&disk->slave_bdevs);
#endif
	return disk;

out_destroy_part_tbl:
	xa_destroy(&disk->part_tbl);
	iput(disk->part0->bd_inode); // <= The same race problem exists?
out_free_bdi:
	bdi_put(disk->bdi);
out_free_disk:
	kfree(disk); // <= Releasing "disk" despite "disk->part0->bd_disk == disk" when bdev_free_inode() will dereference ->bd_disk after RCU.
out_put_queue:
	blk_put_queue(q);
	return NULL;
}