Re: [syzbot] KASAN: use-after-free Write in io_queue_worker_create

Jens Axboe
2021-12-10T15:33:24Z

On 12/10/21 4:00 AM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in io_wq_put_and_exit
>
> INFO: task syz-executor.2:8594 blocked for more than 143 seconds.
> Not tainted 5.16.0-rc1-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.2 state:D stack:26928 pid: 8594 ppid: 3894 flags:0x00024004
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:4972 [inline]
> __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
> schedule+0xd2/0x260 kernel/sched/core.c:6326
> schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
> do_wait_for_common kernel/sched/completion.c:85 [inline]
> __wait_for_common kernel/sched/completion.c:106 [inline]
> wait_for_common kernel/sched/completion.c:117 [inline]
> wait_for_completion+0x174/0x270 kernel/sched/completion.c:138
> io_wq_exit_workers fs/io-wq.c:1222 [inline]
> io_wq_put_and_exit+0x33a/0xb70 fs/io-wq.c:1257
> io_uring_clean_tctx fs/io_uring.c:9803 [inline]
> io_uring_cancel_generic+0x622/0x695 fs/io_uring.c:9886
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x60c/0x2b40 kernel/exit.c:787
> do_group_exit+0x125/0x310 kernel/exit.c:929
> get_signal+0x47d/0x2220 kernel/signal.c:2830
> arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
> __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7fe940cbfb49
> RSP: 002b:00007fe940435218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: fffffffffffffe00 RBX: 00007fe940dd2f68 RCX: 00007fe940cbfb49
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe940dd2f68
> RBP: 00007fe940dd2f60 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe940dd2f6c
> R13: 00007ffc1b1af90f R14: 00007fe940435300 R15: 0000000000022000
> </TASK>

#syz test git://git.kernel.dk/linux-block io_uring-5.16

--
Jens Axboe