While testing linux-next (20240304) under kdevops, I see
this KASAN splat, seems 100% reproducible:
==================================================================
BUG: KASAN: slab-use-after-free in v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
Read of size 8 at addr ffff888119369600 by task mount/666
CPU: 0 PID: 666 Comm: mount Not tainted 6.8.0-rc7-next-20240304 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x73/0xb0
print_report+0xc4/0x620
? preempt_count_sub+0x14/0xc0
? __virt_addr_valid+0x144/0x2f0
kasan_report+0xbd/0xf0
? v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
? v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
v9fs_fid_iget_dotl+0x112/0x160 [9p]
v9fs_mount+0x27c/0x4c0 [9p]
? __pfx_v9fs_mount+0x10/0x10 [9p]
? vfs_parse_fs_string+0xd4/0x120
? __pfx_vfs_parse_fs_string+0x10/0x10
? __pfx_v9fs_mount+0x10/0x10 [9p]
legacy_get_tree+0x83/0xd0
vfs_get_tree+0x49/0x180
path_mount+0x61c/0xf90
? __pfx_path_mount+0x10/0x10
? user_path_at_empty+0x40/0x50
? kmem_cache_free+0x189/0x470
__x64_sys_mount+0x194/0x1d0
? __pfx___x64_sys_mount+0x10/0x10
? ktime_get_coarse_real_ts64+0x5c/0x80
do_syscall_64+0x6f/0x150
entry_SYSCALL_64_after_hwframe+0x6c/0x74
RIP: 0033:0x7fd2124e1b9e
Code: 48 8b 0d 6d 02 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3a 02 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd198cf698 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000055a9ad2149c0 RCX: 00007fd2124e1b9e
RDX: 000055a9ad214d00 RSI: 000055a9ad214d40 RDI: 000055a9ad214d20
RBP: 00007ffd198cf7c0 R08: 000055a9ad214c80 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 000055a9ad214d20 R14: 000055a9ad214d00 R15: 00007fd212611076
</TASK>
Allocated by task 666:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
__kasan_kmalloc+0x8b/0x90
p9_client_getattr_dotl+0x3b/0x1d0
v9fs_fid_iget_dotl+0x7d/0x160 [9p]
v9fs_mount+0x27c/0x4c0 [9p]
legacy_get_tree+0x83/0xd0
vfs_get_tree+0x49/0x180
path_mount+0x61c/0xf90
__x64_sys_mount+0x194/0x1d0
do_syscall_64+0x6f/0x150
entry_SYSCALL_64_after_hwframe+0x6c/0x74
Freed by task 666:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
kasan_save_free_info+0x37/0x60
poison_slab_object+0x103/0x180
__kasan_slab_free+0x10/0x30
kfree+0x107/0x390
v9fs_fid_iget_dotl+0xe5/0x160 [9p]
v9fs_mount+0x27c/0x4c0 [9p]
legacy_get_tree+0x83/0xd0
vfs_get_tree+0x49/0x180
path_mount+0x61c/0xf90
__x64_sys_mount+0x194/0x1d0
do_syscall_64+0x6f/0x150
entry_SYSCALL_64_after_hwframe+0x6c/0x74
The buggy address belongs to the object at ffff888119369600
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
freed 192-byte region [ffff888119369600, ffff8881193696c0)
The buggy address belongs to the physical page:
page does not match folio
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119369
ksm flags: 0x17fffe000000800(slab|node=0|zone=2|lastcpupid=0x3ffff)
page_type: 0xffffffff()
raw: 017fffe000000800 ffff888100042a00 ffffea0004735d80 dead000000000003
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888119369500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888119369580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888119369600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888119369680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888119369700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
fs/9p/vfs_inode_dotl.c:569
--
Chuck Lever
