On 5/25/21 11:08 PM, qiang.zhang@xxxxxxxxxxxxx wrote: > From: Zqiang <qiang.zhang@xxxxxxxxxxxxx> > > BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 > Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802 > > Call Trace: > __dump_stack [inline] > dump_stack+0x141/0x1d7 > print_address_description.constprop.0.cold+0x5b/0x2c6 > __kasan_report [inline] > kasan_report.cold+0x7c/0xd8 > __wake_up_common+0x637/0x650 > __wake_up_common_lock+0xd0/0x130 > io_worker_handle_work+0x9dd/0x1790 > io_wqe_worker+0xb2a/0xd40 > ret_from_fork+0x1f/0x30 > > Allocated by task 28798: > kzalloc_node [inline] > io_wq_create+0x3c4/0xdd0 > io_init_wq_offload [inline] > io_uring_alloc_task_context+0x1bf/0x6b0 > __io_uring_add_task_file+0x29a/0x3c0 > io_uring_add_task_file [inline] > io_uring_install_fd [inline] > io_uring_create [inline] > io_uring_setup+0x209a/0x2bd0 > do_syscall_64+0x3a/0xb0 > entry_SYSCALL_64_after_hwframe+0x44/0xae > > Freed by task 28798: > kfree+0x106/0x2c0 > io_wq_destroy+0x182/0x380 > io_wq_put [inline] > io_wq_put_and_exit+0x7a/0xa0 > io_uring_clean_tctx [inline] > __io_uring_cancel+0x428/0x530 > io_uring_files_cancel > do_exit+0x299/0x2a60 > do_group_exit+0x125/0x310 > get_signal+0x47f/0x2150 > arch_do_signal_or_restart+0x2a8/0x1eb0 > handle_signal_work[inline] > exit_to_user_mode_loop [inline] > exit_to_user_mode_prepare+0x171/0x280 > __syscall_exit_to_user_mode_work [inline] > syscall_exit_to_user_mode+0x19/0x60 > do_syscall_64+0x47/0xb0 > entry_SYSCALL_64_after_hwframe > > There are the following scenarios, hash waitqueue is shared by > io-wq1 and io-wq2. (note: wqe is worker) > > io-wq1:worker2 | locks bit1 > io-wq2:worker1 | waits bit1 > io-wq1:worker3 | waits bit1 > > io-wq1:worker2 | completes all wqe bit1 work items > io-wq1:worker2 | drop bit1, exit > > io-wq2:worker1 | locks bit1 > io-wq1:worker3 | can not locks bit1, waits bit1 and exit > io-wq1 | exit and free io-wq1 > io-wq2:worker1 | drops bit1 > io-wq1:worker3 | be waked up, even though wqe is freed > > After all iou-wrk belonging to io-wq1 have exited, remove wqe > form hash waitqueue, it is guaranteed that there will be no more > wqe belonging to io-wq1 in the hash waitqueue. Thanks, applied. -- Jens Axboe
