linux-kernel - Re: [syzbot] [io-uring?] INFO: task hung in io_uring_del_tctx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d0cd8a65-b565-4275-b87d-51d10e88069f@kernel.dk>
Date: Mon, 27 Oct 2025 16:04:05 -0600
From: Jens Axboe <axboe@...nel.dk>
To: syzbot <syzbot+10a9b495f54a17b607a6@...kaller.appspotmail.com>,
 io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com, Keith Busch <kbusch@...nel.org>
Subject: Re: [syzbot] [io-uring?] INFO: task hung in io_uring_del_tctx_node
 (5)

On 10/27/25 3:07 PM, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    72fb0170ef1f Add linux-next specific files for 20251024
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13087be2580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=10a9b495f54a17b607a6
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14725d2f980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11233b04580000

[snip]

> RAX: ffffffff82431501 RBX: 0000000000000018 RCX: ffffffff824315fd
> RDX: 0000000000000001 RSI: 0000000000000018 RDI: ffffc9000383f880
> RBP: 0000000000000000 R08: ffffc9000383f897 R09: 1ffff92000707f12
> R10: dffffc0000000000 R11: fffff52000707f13 R12: 0000000000000003
> R13: ffff888079527128 R14: fffff52000707f13 R15: 1ffff92000707f10
> FS:  00007f4e567906c0(0000) GS:ffff888125cdc000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055db9a726918 CR3: 000000002ec48000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  __asan_memset+0x22/0x50 mm/kasan/shadow.c:84
>  seq_printf+0xad/0x270 fs/seq_file.c:403
>  __io_uring_show_fdinfo io_uring/fdinfo.c:142 [inline]
>  io_uring_show_fdinfo+0x734/0x17d0 io_uring/fdinfo.c:256
>  seq_show+0x5bc/0x730 fs/proc/fd.c:68
>  seq_read_iter+0x4ef/0xe20 fs/seq_file.c:230
>  seq_read+0x369/0x480 fs/seq_file.c:162
>  vfs_read+0x200/0xa30 fs/read_write.c:570
>  ksys_read+0x145/0x250 fs/read_write.c:715
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f

Keith, I'm pretty sure your change:

commit 1cba30bf9fdd6c982708f3587f609a30c370d889
Author: Keith Busch <kbusch@...nel.org>
Date:   Thu Oct 16 11:09:38 2025 -0700

    io_uring: add support for IORING_SETUP_SQE_MIXED

leaves fdinfo open up to being broken. Before, we had:

sq_entries = min(sq_tail - sq_head, ctx->sq_entries);

as a cap for the loop, now you just have:

while (sq_head < sq_tail) {

which seems like a bad idea. It's also missing an sq_head increment if
we hit this condition:

if (sq_idx > sq_mask)
	continue;

which is also something you can trigger, and which would also end up in
an infinite loop.

Totally untested, but how about something like the below:

diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 7fb900f1d8f6..3f254ae0ad61 100644
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -66,6 +66,7 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 	unsigned int cq_head = READ_ONCE(r->cq.head);
 	unsigned int cq_tail = READ_ONCE(r->cq.tail);
 	unsigned int sq_shift = 0;
+	unsigned int sq_entries;
 	int sq_pid = -1, sq_cpu = -1;
 	u64 sq_total_time = 0, sq_work_time = 0;
 	unsigned int i;
@@ -88,17 +89,18 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 	seq_printf(m, "CqTail:\t%u\n", cq_tail);
 	seq_printf(m, "CachedCqTail:\t%u\n", data_race(ctx->cached_cq_tail));
 	seq_printf(m, "SQEs:\t%u\n", sq_tail - sq_head);
-	while (sq_head < sq_tail) {
+	sq_entries = min(sq_tail - sq_head, ctx->sq_entries);
+	for (i = 0; i < sq_entries; i++) {
+		unsigned int entry = i + sq_head;
 		struct io_uring_sqe *sqe;
 		unsigned int sq_idx;
 		bool sqe128 = false;
 		u8 opcode;
 
 		if (ctx->flags & IORING_SETUP_NO_SQARRAY)
-			sq_idx = sq_head & sq_mask;
+			sq_idx = entry & sq_mask;
 		else
-			sq_idx = READ_ONCE(ctx->sq_array[sq_head & sq_mask]);
-
+			sq_idx = READ_ONCE(ctx->sq_array[entry & sq_mask]);
 		if (sq_idx > sq_mask)
 			continue;
 
@@ -140,7 +142,6 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 			}
 		}
 		seq_printf(m, "\n");
-		sq_head++;
 	}
 	seq_printf(m, "CQEs:\t%u\n", cq_tail - cq_head);
 	while (cq_head < cq_tail) {

-- 
Jens Axboe