linux-kernel - Re: [syzbot] KASAN: use-after-free Write in io_queue_worker

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8544854b-226d-befd-bd91-5af182c2b03d@kernel.dk>
Date:   Fri, 10 Dec 2021 08:33:19 -0700
From:   Jens Axboe <axboe@...nel.dk>
To:     syzbot <syzbot+b60c982cb0efc5e05a47@...kaller.appspotmail.com>,
        asml.silence@...il.com, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Write in io_queue_worker_create

On 12/10/21 4:00 AM, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in io_wq_put_and_exit
> 
> INFO: task syz-executor.2:8594 blocked for more than 143 seconds.
>       Not tainted 5.16.0-rc1-syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz-executor.2  state:D stack:26928 pid: 8594 ppid:  3894 flags:0x00024004
> Call Trace:
>  <TASK>
>  context_switch kernel/sched/core.c:4972 [inline]
>  __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
>  schedule+0xd2/0x260 kernel/sched/core.c:6326
>  schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
>  do_wait_for_common kernel/sched/completion.c:85 [inline]
>  __wait_for_common kernel/sched/completion.c:106 [inline]
>  wait_for_common kernel/sched/completion.c:117 [inline]
>  wait_for_completion+0x174/0x270 kernel/sched/completion.c:138
>  io_wq_exit_workers fs/io-wq.c:1222 [inline]
>  io_wq_put_and_exit+0x33a/0xb70 fs/io-wq.c:1257
>  io_uring_clean_tctx fs/io_uring.c:9803 [inline]
>  io_uring_cancel_generic+0x622/0x695 fs/io_uring.c:9886
>  io_uring_files_cancel include/linux/io_uring.h:16 [inline]
>  do_exit+0x60c/0x2b40 kernel/exit.c:787
>  do_group_exit+0x125/0x310 kernel/exit.c:929
>  get_signal+0x47d/0x2220 kernel/signal.c:2830
>  arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
>  handle_signal_work kernel/entry/common.c:148 [inline]
>  exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
>  exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
>  __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
>  syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
>  do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
>  entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7fe940cbfb49
> RSP: 002b:00007fe940435218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
> RAX: fffffffffffffe00 RBX: 00007fe940dd2f68 RCX: 00007fe940cbfb49
> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe940dd2f68
> RBP: 00007fe940dd2f60 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe940dd2f6c
> R13: 00007ffc1b1af90f R14: 00007fe940435300 R15: 0000000000022000
>  </TASK>

#syz test git://git.kernel.dk/linux-block io_uring-5.16

-- 
Jens Axboe