On 1/10/25 7:13 AM, Pavel Begunkov wrote: > On 1/10/25 13:56, Dmitry Vyukov wrote: >> On Fri, 10 Jan 2025 at 14:51, syzbot >> <syzbot+3d92cfcfa84070b0a470@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: >>> >>> Hello, >>> >>> syzbot found the following issue on: >>> >>> HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g.. >>> git tree: upstream >>> console output: https://syzkaller.appspot.com/x/log.txt?x=1377fac4580000 >>> kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7 >>> dashboard link: https://syzkaller.appspot.com/bug?extid=3d92cfcfa84070b0a470 >>> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 >>> >>> Unfortunately, I don't have any reproducer for this issue yet. >>> >>> Downloadable assets: >>> disk image: https://storage.googleapis.com/syzbot-assets/6e96673b1b94/disk-ccb98cce.raw.xz >>> vmlinux: https://storage.googleapis.com/syzbot-assets/528385411880/vmlinux-ccb98cce.xz >>> kernel image: https://storage.googleapis.com/syzbot-assets/b061a4d50538/bzImage-ccb98cce.xz >>> >>> IMPORTANT: if you fix the issue, please add the following tag to the commit: >>> Reported-by: syzbot+3d92cfcfa84070b0a470@xxxxxxxxxxxxxxxxxxxxxxxxx >>> >>> ================================================================== >>> BUG: KASAN: slab-use-after-free in thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341 >>> Read of size 8 at addr ffff88803578c510 by task syz.2.3223/27552 >>> >>> CPU: 1 UID: 0 PID: 27552 Comm: syz.2.3223 Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0 >>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 >>> Call Trace: >>> <TASK> >>> __dump_stack lib/dump_stack.c:94 [inline] >>> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 >>> print_address_description mm/kasan/report.c:378 [inline] >>> print_report+0x169/0x550 mm/kasan/report.c:489 >>> kasan_report+0x143/0x180 mm/kasan/report.c:602 >>> thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341 >>> thread_group_cputime_adjusted+0xa6/0x340 kernel/sched/cputime.c:639 >>> getrusage+0x1000/0x1340 kernel/sys.c:1863 >>> io_uring_show_fdinfo+0xdfe/0x1770 io_uring/fdinfo.c:197 >> >> This looks to be more likely an io-uring issue rather than cputime.c >> >> #syz set subsystems: io-uring >> >> +maintainers > > Thanks. It probably needs something like below. > > diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c > index 6df5e649c413..5768e31e99b1 100644 > --- a/io_uring/sqpoll.c > +++ b/io_uring/sqpoll.c > @@ -268,8 +268,12 @@ static int io_sq_thread(void *data) > DEFINE_WAIT(wait); > > /* offload context creation failed, just exit */ > - if (!current->io_uring) > + if (!current->io_uring) { > + mutex_lock(&sqd->lock); > + sqd->thread = NULL; > + mutex_unlock(&sqd->lock); > goto err_out; > + } > > snprintf(buf, sizeof(buf), "iou-sqp-%d", sqd->task_pid); > set_task_comm(current, buf); Indeed - can you send that out and I can include it in this weeks pull? -- Jens Axboe
