linux-kernel - BUG: KFENCE: use-after-free read in bfq_exit_icq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8202004.NyiUUSuA9g@natalenko.name>
Date:   Mon, 02 Jan 2023 12:45:30 +0100
From:   Oleksandr Natalenko <oleksandr@...alenko.name>
To:     linux-kernel@...r.kernel.org
Cc:     Paolo Valente <paolo.valente@...aro.org>,
        Jens Axboe <axboe@...nel.dk>, linux-block@...r.kernel.org
Subject: BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270

Hello.

This is a sudden splash I've got while just using my workstation:

==================================================================
BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270
Use-after-free read at 0x00000000e57c579c (in kfence-#173):
 bfq_exit_icq_bfqq+0x132/0x270
 bfq_exit_icq+0x5e/0x80
 exit_io_context+0x88/0xb0
 do_exit+0x66c/0xb80
 kthread_exit+0x29/0x30
 kthread+0xbd/0x110
 ret_from_fork+0x22/0x30

kfence-#173: 0x000000005d7be631-0x000000006ad0b684, size=568, cache=bfq_queue
allocated by task 40147 on cpu 16 at 13975.114285s:
 bfq_get_queue+0xdf/0x4e0
 bfq_get_bfqq_handle_split+0x75/0x170
 bfq_insert_requests+0x832/0x2580
 blk_mq_sched_insert_requests+0x63/0x150
 blk_mq_flush_plug_list+0x122/0x360
 __blk_flush_plug+0x106/0x160
 blk_finish_plug+0x29/0x40
 dm_bufio_prefetch+0x108/0x4d0 [dm_bufio]
 dm_tm_issue_prefetches+0x44/0x70 [dm_persistent_data]
 dm_pool_issue_prefetches+0x39/0x43 [dm_thin_pool]
 do_worker+0x4c/0xd60 [dm_thin_pool]
 process_one_work+0x258/0x410
 worker_thread+0x55/0x4c0
 kthread+0xde/0x110
 ret_from_fork+0x22/0x30

freed by task 40147 on cpu 20 at 14500.096700s:
 bfq_put_queue+0x185/0x2d0
 bfq_exit_icq_bfqq+0x129/0x270
 bfq_exit_icq+0x5e/0x80
 exit_io_context+0x88/0xb0
 do_exit+0x66c/0xb80
 kthread_exit+0x29/0x30
 kthread+0xbd/0x110
 ret_from_fork+0x22/0x30

CPU: 20 PID: 40147 Comm: kworker/dying Tainted: G        W          6.1.0-pf2 #1 ff5dbde5ea280110a73397797e059b8558cda111
Hardware name: ASUS System Product Name/Pro WS X570-ACE, BIOS 4304 12/12/2022
==================================================================

I'm using v6.1.2, never experienced this before and cannot reproduce it at will. This kernel does not have any extra patches for the block layer on top of v6.1.2.

In case you know what's going on, please let me know.

Thanks!

-- 
Oleksandr Natalenko (post-factum)