From: Jens Axboe <axboe@kernel.dk>
To: Kyle Zeng <kylebot@openai.com>, io-uring@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, outbounddisclosures@openai.com
Subject: Re: [PATCH] io_uring/io-wq: save worker type before dropping its reference
Date: Fri, 30 Oct 2026 07:07:25 -0600 [thread overview]
Message-ID: <61bb0fc9-d629-4987-ad18-c5eb46074dbf@kernel.dk> (raw)
In-Reply-To: <20261030042101.73491-1-kylebot@openai.com>
On 10/29/26 10:21 PM, Kyle Zeng wrote:
> io_wq_cancel_tw_create() inspects cb->func after calling
> io_worker_cancel_cb(). For an existing worker, that call can drop the
> last worker reference and wake io_worker_exit(). If the canceling task
> is preempted, the worker can be unlinked and freed by kfree_rcu() before
> the callback function is inspected. KASAN reports a slab-use-after-free
> read in this path.
>
> Save whether the callback belongs to an unpublished continuation worker
> while its reference is still held, then use the saved result for the
> conditional free. This preserves the existing accounting and frees only
> the worker allocated for the canceled continuation.
This is already posted and queued up:
https://lore.kernel.org/io-uring/20261028164732.1264069-10-axboe@kernel.dk/T/#u
--
Jens Axboe
prev parent reply other threads:[~2026-10-30 13:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-30 4:21 [PATCH] io_uring/io-wq: save worker type before dropping its reference Kyle Zeng
2026-10-30 13:07 ` Jens Axboe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=61bb0fc9-d629-4987-ad18-c5eb46074dbf@kernel.dk \
--to=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
--cc=kylebot@openai.com \
--cc=linux-kernel@vger.kernel.org \
--cc=outbounddisclosures@openai.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox