From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FDFEEB64DC for ; Mon, 10 Jul 2023 21:36:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232056AbjGJVg0 (ORCPT ); Mon, 10 Jul 2023 17:36:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230286AbjGJVgX (ORCPT ); Mon, 10 Jul 2023 17:36:23 -0400 Received: from mail-pf1-x449.google.com (mail-pf1-x449.google.com [IPv6:2607:f8b0:4864:20::449]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D9DCDF for ; Mon, 10 Jul 2023 14:36:22 -0700 (PDT) Received: by mail-pf1-x449.google.com with SMTP id d2e1a72fcca58-66a4c89bbb1so8429428b3a.0 for ; Mon, 10 Jul 2023 14:36:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1689024981; x=1691616981; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=/QG81dWOU8+2ZMkJte6cgGvEOzd5BwfWPVokHYZjTCI=; b=YVhfLbBTU4JQlqdFpX2Ac0IgNx/KSHgY/Ejx2BdoDE/MLijjJYYMBBwq6Ge8MevxjD EEfd4626N9pgSJJiqdeOyu1+EHmFMw8fh/GUKqiT8HvaQg6JVVwKxh1wrSdJzin4Vr/Z JV6Y9FF44gvlIobv+bgjxcKa2uDrZzEL293g2lXwFqZjK1zbfG4NGPMkepmdk89iC3IZ TU4S/lHGUj4LFO6qvZ5xNXoauDexLCzPXYDFBWH4XSfxBvpFTA65emmBgFfDntbIv3vc JQwRFFdb8TwKqE3lpN8gtn96Go4HkixsjBHYumLD9yaYpGrMNXgoP9XKL5KhyvIlrZ1s OpXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689024981; x=1691616981; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/QG81dWOU8+2ZMkJte6cgGvEOzd5BwfWPVokHYZjTCI=; b=EMfU03aqvQmXtFj9IdsEH2uiwHlpLIdXMB7jDdBDfndTMwT3Ebt5QoWBTwbrXBoTf/ 22DILbEmR3ggmLB2aN37IQNARYm73N5Tty+2+xgRtvTKppSFCmDlcuxOOqyR4BP8S4sn GoXMBbRgQwWOky5pSoqOOB3/mgjLdiY7EhIp84ZsLODD1qpkW0I3FlD9SYVd/Vyu2aCr GU8E5ibtcGIkL/tQPhQ3NqGZM3SWmhtwpBjycMtrGYo+WfTS4VwZzPMkDe2Qv5tby4rt 5bmSUCqnhlOcB+1lspmevxyIGyOfpJO/SZHePxU/o04WtKT3T9QpeI3F9tXuGyHjma2C JiWg== X-Gm-Message-State: ABy/qLaaMEcwwRhZ5dpBoxiFYRMVGAeET131iU18Iug0/E0vIEHRXWqK 6685bu50JYcWHs7at6Xy+NNbt8NEgw4= X-Google-Smtp-Source: APBJJlHIuDFrwsAjRxk1OL9H4JWUY+yazFv9EjV7KH84+DIRy01I9YCDp3Q6Nc1wAFBQaSPiE5gAOrH7j9k= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:2392:b0:674:1663:1283 with SMTP id f18-20020a056a00239200b0067416631283mr18725049pfc.1.1689024981471; Mon, 10 Jul 2023 14:36:21 -0700 (PDT) Date: Mon, 10 Jul 2023 14:36:19 -0700 In-Reply-To: <20230626113540-mutt-send-email-mst@kernel.org> Mime-Version: 1.0 References: <000000000000df3e3b05ff02fe20@google.com> <20230626031411-mutt-send-email-mst@kernel.org> <216718d1-1e32-9ebc-bd5e-96beab3fdc1b@oracle.com> <20230626113540-mutt-send-email-mst@kernel.org> Message-ID: Subject: Re: [syzbot] [net?] [virt?] [kvm?] KASAN: slab-use-after-free Read in __vhost_vq_attach_worker From: Sean Christopherson To: "Michael S. Tsirkin" Cc: Mike Christie , syzbot , jasowang@redhat.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, virtualization@lists.linux-foundation.org Content-Type: text/plain; charset="us-ascii" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jun 26, 2023, Michael S. Tsirkin wrote: > On Mon, Jun 26, 2023 at 10:03:25AM -0500, Mike Christie wrote: > > On 6/26/23 2:15 AM, Michael S. Tsirkin wrote: > > > On Mon, Jun 26, 2023 at 12:06:54AM -0700, syzbot wrote: > > >> Hello, > > >> > > >> syzbot found the following issue on: > > >> > > >> HEAD commit: 8d2be868b42c Add linux-next specific files for 20230623 > > >> git tree: linux-next > > >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12872950a80000 > > >> kernel config: https://syzkaller.appspot.com/x/.config?x=d8ac8dd33677e8e0 > > >> dashboard link: https://syzkaller.appspot.com/bug?extid=8540db210d403f1aa214 > > >> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > > >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15c1b70f280000 > > >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=122ee4cb280000 > > >> > > >> Downloadable assets: > > >> disk image: https://storage.googleapis.com/syzbot-assets/2a004483aca3/disk-8d2be868.raw.xz > > >> vmlinux: https://storage.googleapis.com/syzbot-assets/5688cb13b277/vmlinux-8d2be868.xz > > >> kernel image: https://storage.googleapis.com/syzbot-assets/76de0b63bc53/bzImage-8d2be868.xz > > >> > > >> The issue was bisected to: > > >> > > >> commit 21a18f4a51896fde11002165f0e7340f4131d6a0 > > >> Author: Mike Christie > > >> Date: Tue Jun 13 01:32:46 2023 +0000 > > >> > > >> vhost: allow userspace to create workers > > >> > > >> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=130850bf280000 > > >> final oops: https://syzkaller.appspot.com/x/report.txt?x=108850bf280000 > > >> console output: https://syzkaller.appspot.com/x/log.txt?x=170850bf280000 > > >> > > >> IMPORTANT: if you fix the issue, please add the following tag to the commit: > > >> Reported-by: syzbot+8540db210d403f1aa214@syzkaller.appspotmail.com > > >> Fixes: 21a18f4a5189 ("vhost: allow userspace to create workers") > > > > > > Mike, would appreciate prompt attention to this as I am preparing > > > a pull request for the merge window and need to make a > > > decision on whether to include your userspace-controlled > > > threading patchset. > > > > > > > Do you want me to resubmit the patchset or submit a patch against your vhost > > branch? > > Resubmit pls. Closing this out from syzbot's perspective since v9 (now in linux-next and Linus' tree) added back Mike's fix. #syz invalid