On 7/24/24 12:59 PM, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > KMSAN: uninit-value in io_req_task_work_add_remote > > ===================================================== > BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1193 [inline] > BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241 > io_req_local_work_add io_uring/io_uring.c:1193 [inline] > io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241 > io_msg_remote_post io_uring/msg_ring.c:102 [inline] > io_msg_data_remote io_uring/msg_ring.c:133 [inline] > io_msg_ring_data io_uring/msg_ring.c:152 [inline] > io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305 > io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1711 > io_queue_sqe io_uring/io_uring.c:1925 [inline] > io_submit_sqe io_uring/io_uring.c:2181 [inline] > io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2296 > __do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline] > __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143 > __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143 > x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427 > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Uninit was created at: > __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4719 > __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] > alloc_pages_node_noprof include/linux/gfp.h:296 [inline] > alloc_slab_page mm/slub.c:2321 [inline] > allocate_slab+0x203/0x1220 mm/slub.c:2484 > new_slab mm/slub.c:2537 [inline] > ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3723 > __kmem_cache_alloc_bulk mm/slub.c:4759 [inline] > kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4831 > __io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940 > io_alloc_req io_uring/io_uring.h:393 [inline] > io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2285 > __do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline] > __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143 > __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143 > x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427 > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > CPU: 0 UID: 0 PID: 5924 Comm: syz.0.16 Not tainted 6.10.0-syzkaller-12268-g7a3fad30fd8b-dirty #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 > ===================================================== #syz test diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 8e6faa942a6f..198bbbfe465c 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1164,8 +1164,10 @@ static inline void io_req_local_work_add(struct io_kiocb *req, * previous adds should've tried to wake the task. */ nr_tw = nr_tw_prev + 1; +#if 0 if (!(flags & IOU_F_TWQ_LAZY_WAKE)) nr_tw = IO_CQ_WAKE_FORCE; +#endif req->nr_tw = nr_tw; req->io_task_work.node.next = head; -- Jens Axboe
