From: Jens Axboe <[email protected]>
To: syzbot <[email protected]>,
[email protected], [email protected],
[email protected], [email protected]
Subject: Re: [syzbot] KASAN: use-after-free Write in io_queue_worker_create
Date: Fri, 10 Dec 2021 08:33:19 -0700 [thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
On 12/10/21 4:00 AM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in io_wq_put_and_exit
>
> INFO: task syz-executor.2:8594 blocked for more than 143 seconds.
> Not tainted 5.16.0-rc1-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.2 state:D stack:26928 pid: 8594 ppid: 3894 flags:0x00024004
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:4972 [inline]
> __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
> schedule+0xd2/0x260 kernel/sched/core.c:6326
> schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
> do_wait_for_common kernel/sched/completion.c:85 [inline]
> __wait_for_common kernel/sched/completion.c:106 [inline]
> wait_for_common kernel/sched/completion.c:117 [inline]
> wait_for_completion+0x174/0x270 kernel/sched/completion.c:138
> io_wq_exit_workers fs/io-wq.c:1222 [inline]
> io_wq_put_and_exit+0x33a/0xb70 fs/io-wq.c:1257
> io_uring_clean_tctx fs/io_uring.c:9803 [inline]
> io_uring_cancel_generic+0x622/0x695 fs/io_uring.c:9886
> io_uring_files_cancel include/linux/io_uring.h:16 [inline]
> do_exit+0x60c/0x2b40 kernel/exit.c:787
> do_group_exit+0x125/0x310 kernel/exit.c:929
> get_signal+0x47d/0x2220 kernel/signal.c:2830
> arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
> handle_signal_work kernel/entry/common.c:148 [inline]
> exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
> exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
> __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
> syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
> do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7fe940cbfb49
> RSP: 002b:00007fe940435218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: fffffffffffffe00 RBX: 00007fe940dd2f68 RCX: 00007fe940cbfb49
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe940dd2f68
> RBP: 00007fe940dd2f60 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe940dd2f6c
> R13: 00007ffc1b1af90f R14: 00007fe940435300 R15: 0000000000022000
> </TASK>
#syz test git://git.kernel.dk/linux-block io_uring-5.16
--
Jens Axboe
next prev parent reply other threads:[~2021-12-10 15:33 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-06 6:43 [syzbot] KASAN: use-after-free Write in io_queue_worker_create syzbot
2021-12-06 17:28 ` Jens Axboe
2021-12-10 5:21 ` syzbot
2021-12-10 5:26 ` Jens Axboe
2021-12-10 11:00 ` syzbot
2021-12-10 15:33 ` Jens Axboe [this message]
2021-12-10 16:15 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox