Date:   Thu, 25 Feb 2021 13:38:17 +0800
From:   kernel test robot <oliver.sang@...el.com>
To:     Jens Axboe <axboe@...nel.dk>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Memory Management List <linux-mm@...ck.org>,
        lkp@...ts.01.org, lkp@...el.com
Subject: [io_uring]  6f70bae3cf: BUG:KASAN:use-after-free_in__lock_acquire


Greeting,

FYI, we noticed the following commit (built with gcc-9):

commit: 6f70bae3cffed4f3b1a4e9f94b8505e114a40223 ("io_uring: ensure io-wq context is always destroyed for tasks")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master


in testcase: trinity
version: trinity-static-x86_64-x86_64-1c734c75-1_2020-01-06
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+-------------------------------------------+------------+------------+
|                                           | e4595c30ec | 6f70bae3cf |
+-------------------------------------------+------------+------------+
| boot_successes                            | 10         | 0          |
| boot_failures                             | 0          | 6          |
| BUG:KASAN:use-after-free_in__lock_acquire | 0          | 6          |
| INFO:trying_to_register_non-static_key    | 0          | 6          |
+-------------------------------------------+------------+------------+


If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>


[   86.069634] BUG: KASAN: use-after-free in __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1)) 
[   86.070069] Read of size 8 at addr ffff88810feb0710 by task trinity-c3/790
[   86.070508]
[   86.070613] CPU: 0 PID: 790 Comm: trinity-c3 Not tainted 5.11.0-07414-g6f70bae3cffe #1
[   86.071119] Call Trace:
[   86.071284] ? dump_stack (kbuild/src/consumer/lib/dump_stack.c:79 kbuild/src/consumer/lib/dump_stack.c:130) 
[   86.071523] ? print_address_description+0x26/0x3d8 
[   86.071910] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1)) 
[   86.072176] ? kasan_report (kbuild/src/consumer/mm/kasan/report.c:397 kbuild/src/consumer/mm/kasan/report.c:413) 
[   86.072430] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1)) 
[   86.072695] ? __asan_load8 (kbuild/src/consumer/mm/kasan/generic.c:179 kbuild/src/consumer/mm/kasan/generic.c:252) 
[   86.072943] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1)) 
[   86.073208] ? lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:437 kbuild/src/consumer/kernel/locking/lockdep.c:5512) 
[   86.073463] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349) 
[   86.073731] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:5478) 
[   86.074006] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006) 
[   86.074352] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278) 
[   86.074591] ? rcu_read_lock_held (kbuild/src/consumer/kernel/rcu/update.c:120) 
[   86.074869] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006) 
[   86.075217] ? _raw_spin_lock_irqsave (kbuild/src/consumer/include/linux/spinlock_api_smp.h:117 kbuild/src/consumer/kernel/locking/spinlock.c:159) 
[   86.075518] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349) 
[   86.075780] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349) 
[   86.076043] ? ttwu_do_wakeup+0x42/0x42 
[   86.076338] ? wake_up_process (kbuild/src/consumer/kernel/sched/core.c:3535) 
[   86.076601] ? io_wq_destroy (kbuild/src/consumer/fs/io-wq.c:1000) 
[   86.076857] ? __io_uring_files_cancel (kbuild/src/consumer/fs/io_uring.c:8809) 
[   86.077178] ? __io_uring_free (kbuild/src/consumer/fs/io_uring.c:8794) 
[   86.077436] ? read_cred_subscribers (kbuild/src/consumer/arch/x86/include/asm/atomic.h:29 kbuild/src/consumer/include/asm-generic/atomic-instrumented.h:28 kbuild/src/consumer/kernel/cred.c:75) 
[   86.077741] ? __validate_process_creds (kbuild/src/consumer/kernel/cred.c:793 (discriminator 1) kbuild/src/consumer/kernel/cred.c:855 (discriminator 1)) 
[   86.078058] ? do_exit (kbuild/src/consumer/include/linux/io_uring.h:47 kbuild/src/consumer/kernel/exit.c:780) 
[   86.078284] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278) 
[   86.078522] ? forget_original_parent (kbuild/src/consumer/kernel/exit.c:728) 
[   86.078829] ? do_group_exit (kbuild/src/consumer/kernel/exit.c:932) 
[   86.079087] ? __do_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931) 
[   86.079368] ? __x64_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931) 
[   86.079654] ? do_syscall_64 (kbuild/src/consumer/arch/x86/entry/common.c:46) 
[   86.079903] ? entry_SYSCALL_64_after_hwframe (kbuild/src/consumer/arch/x86/entry/entry_64.S:112) 
[   86.080244]
[   86.080349] Allocated by task 0:
[   86.080563] (stack is not available)
[   86.080796]
[   86.080900] Freed by task 11:
[   86.081097] arch_stack_walk (kbuild/src/consumer/arch/x86/kernel/stacktrace.c:25) 
[   86.081345] stack_trace_save (kbuild/src/consumer/kernel/stacktrace.c:113) 
[   86.081599] kasan_save_stack (kbuild/src/consumer/mm/kasan/common.c:38) 
[   86.081863] kasan_set_track (kbuild/src/consumer/mm/kasan/common.c:46) 
[   86.082109] kasan_set_free_info (kbuild/src/consumer/mm/kasan/generic.c:358) 
[   86.082380] ____kasan_slab_free (kbuild/src/consumer/mm/kasan/common.c:364) 
[   86.082661] __kasan_slab_free (kbuild/src/consumer/mm/kasan/common.c:369) 
[   86.082919] slab_free_freelist_hook (kbuild/src/consumer/mm/slub.c:1580) 
[   86.083224] kmem_cache_free (kbuild/src/consumer/mm/slub.c:3143 kbuild/src/consumer/mm/slub.c:3159) 
[   86.083478] free_task_struct (kbuild/src/consumer/kernel/fork.c:175) 
[   86.083733] free_task (kbuild/src/consumer/kernel/fork.c:465) 
[   86.083948] __put_task_struct (kbuild/src/consumer/kernel/fork.c:742) 
[   86.084218] put_task_struct (kbuild/src/consumer/include/linux/sched/task.h:111) 
[   86.084465] delayed_put_task_struct (kbuild/src/consumer/kernel/exit.c:173) 
[   86.084767] rcu_process_callbacks (kbuild/src/consumer/kernel/rcu/tiny.c:98 kbuild/src/consumer/kernel/rcu/tiny.c:130) 
[   86.085058] __do_softirq (kbuild/src/consumer/kernel/softirq.c:343) 
[   86.085300]
[   86.085404] The buggy address belongs to the object at ffff88810feb0000
[   86.085404]  which belongs to the cache task_struct of size 10368
[   86.086212] The buggy address is located 1808 bytes inside of
[   86.086212]  10368-byte region [ffff88810feb0000, ffff88810feb2880)
[   86.086968] The buggy address belongs to the page:
[   86.087278] page:00000000a6c89120 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10feb0
[   86.087879] head:00000000a6c89120 order:3 compound_mapcount:0 compound_pincount:0
[   86.088357] flags: 0x4000000000010200(slab|head)
[   86.088662] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100100dc0
[   86.089156] raw: 0000000000000000 0000000000030003 00000001ffffffff 0000000000000000
[   86.089650] page dumped because: kasan: bad access detected
[   86.090018]
[   86.090123] Memory state around the buggy address:
[   86.090433]  ffff88810feb0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   86.090896]  ffff88810feb0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   86.091358] >ffff88810feb0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   86.091820]                          ^
[   86.092066]  ffff88810feb0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   86.092528]  ffff88810feb0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   86.092989] ==================================================================
[   86.093449] Disabling lock debugging due to kernel taint
[   86.093801] INFO: trying to register non-static key.
[   86.094123] the code is fine but needs lockdep annotation.
[   86.094473] turning off the locking correctness validator.
[   86.094825] CPU: 0 PID: 790 Comm: trinity-c3 Tainted: G    B             5.11.0-07414-g6f70bae3cffe #1
[   86.095418] Call Trace:
[   86.095583] ? dump_stack (kbuild/src/consumer/lib/dump_stack.c:79 kbuild/src/consumer/lib/dump_stack.c:130) 
[   86.095817] ? register_lock_class (kbuild/src/consumer/kernel/locking/lockdep.c:936 kbuild/src/consumer/kernel/locking/lockdep.c:1247) 
[   86.096110] ? _raw_spin_unlock_irqrestore (kbuild/src/consumer/include/linux/spinlock_api_smp.h:159 kbuild/src/consumer/kernel/locking/spinlock.c:191) 
[   86.096434] ? is_dynamic_key (kbuild/src/consumer/kernel/locking/lockdep.c:1235) 
[   86.096699] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4779) 
[   86.096962] ? lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:437 kbuild/src/consumer/kernel/locking/lockdep.c:5512) 
[   86.097214] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349) 
[   86.097472] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:5478) 
[   86.097756] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006) 
[   86.098099] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278) 
[   86.098336] ? rcu_read_lock_held (kbuild/src/consumer/kernel/rcu/update.c:120) 
[   86.098610] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006) 
[   86.098953] ? _raw_spin_lock_irqsave (kbuild/src/consumer/include/linux/spinlock_api_smp.h:117 kbuild/src/consumer/kernel/locking/spinlock.c:159) 
[   86.099250] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349) 
[   86.099508] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349) 
[   86.099767] ? ttwu_do_wakeup+0x42/0x42 
[   86.100058] ? wake_up_process (kbuild/src/consumer/kernel/sched/core.c:3535) 
[   86.100320] ? io_wq_destroy (kbuild/src/consumer/fs/io-wq.c:1000) 
[   86.100572] ? __io_uring_files_cancel (kbuild/src/consumer/fs/io_uring.c:8809) 
[   86.100883] ? __io_uring_free (kbuild/src/consumer/fs/io_uring.c:8794) 
[   86.101141] ? read_cred_subscribers (kbuild/src/consumer/arch/x86/include/asm/atomic.h:29 kbuild/src/consumer/include/asm-generic/atomic-instrumented.h:28 kbuild/src/consumer/kernel/cred.c:75) 
[   86.101432] ? __validate_process_creds (kbuild/src/consumer/kernel/cred.c:793 (discriminator 1) kbuild/src/consumer/kernel/cred.c:855 (discriminator 1)) 
[   86.101777] ? do_exit (kbuild/src/consumer/include/linux/io_uring.h:47 kbuild/src/consumer/kernel/exit.c:780) 
[   86.102003] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278) 
[   86.102240] ? forget_original_parent (kbuild/src/consumer/kernel/exit.c:728) 
[   86.102549] ? do_group_exit (kbuild/src/consumer/kernel/exit.c:932) 
[   86.102808] ? __do_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931) 
[   86.103091] ? __x64_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931) 
[   86.103376] ? do_syscall_64 (kbuild/src/consumer/arch/x86/entry/common.c:46) 
[   86.103625] ? entry_SYSCALL_64_after_hwframe (kbuild/src/consumer/arch/x86/entry/entry_64.S:112) 
[   89.183692] caif:caif_disconnect_client(): nothing to disconnect
[   89.185869] caif:caif_disconnect_client(): nothing to disconnect
[   89.186518] caif:caif_disconnect_client(): nothing to disconnect
[   89.187438] caif:caif_disconnect_client(): nothing to disconnect
[   89.188112] caif:caif_disconnect_client(): nothing to disconnect
[   89.188737] caif:caif_disconnect_client(): nothing to disconnect
[   89.189737] caif:caif_disconnect_client(): nothing to disconnect
[   89.190413] caif:caif_disconnect_client(): nothing to disconnect
[   89.191422] caif:caif_disconnect_client(): nothing to disconnect
[   89.192109] caif:caif_disconnect_client(): nothing to disconnect
[   89.192742] caif:caif_disconnect_client(): nothing to disconnect
[   89.193745] caif:caif_disconnect_client(): nothing to disconnect

Kboot worker: lkp-worker05
Elapsed time: 120

kvm=(
qemu-system-x86_64
-enable-kvm
-cpu SandyBridge
-kernel $kernel
-initrd initrd-vm-snb-146.cgz
-m 8192
-smp 2
-device e1000,netdev=net0
-netdev user,id=net0,hostfwd=tcp::32032-:22
-boot order=nc
-no-reboot
-watchdog i6300esb
-watchdog-action debug
-rtc base=localtime
-serial stdio
-display none
-monitor null
)

append=(
ip=::::vm-snb-146::dhcp
root=/dev/ram0
user=lkp
job=/job-script
ARCH=x86_64
kconfig=x86_64-randconfig-a011-20210223
branch=linux-next/master
commit=6f70bae3cffed4f3b1a4e9f94b8505e114a40223
BOOT_IMAGE=/pkg/linux/x86_64-randconfig-a011-20210223/gcc-9/6f70bae3cffed4f3b1a4e9f94b8505e114a40223/vmlinuz-5.11.0-07414-g6f70bae3cffe
vmalloc=512M
max_uptime=2100
RESULT_ROOT=/result/trinity/300s/vm-snb/yocto-x86_64-minimal-20190520.cgz/x86_64-randconfig-a011-20210223/gcc-9/6f70bae3cffed4f3b1a4e9f94b8505e114a40223/3
result_service=tmpfs
selinux=0
debug
apic=debug
sysrq_always_enabled
rcupdate.rcu_cpu_stall_timeout=100
net.ifnames=0
printk.devkmsg=on
panic=-1
softlockup_panic=1
nmi_watchdog=panic
oops=panic
load_ramdisk=2
prompt_ramdisk=0
drbd.minor_count=8
systemd.log_level=err
ignore_loglevel


To reproduce:

        # build kernel
	cd linux
	cp config-5.11.0-07414-g6f70bae3cffe .config
	make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
Oliver Sang


View attachment "config-5.11.0-07414-g6f70bae3cffe" of type "text/plain" (129491 bytes)

View attachment "job-script" of type "text/plain" (4163 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (15092 bytes)

Powered by blists - more mailing lists