On Mon, Jun 26, 2023 at 10:03:25AM -0500, Mike Christie wrote: > On 6/26/23 2:15 AM, Michael S. Tsirkin wrote: > > On Mon, Jun 26, 2023 at 12:06:54AM -0700, syzbot wrote: > >> Hello, > >> > >> syzbot found the following issue on: > >> > >> HEAD commit: 8d2be868b42c Add linux-next specific files for 20230623 > >> git tree: linux-next > >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12872950a80000 > >> kernel config: https://syzkaller.appspot.com/x/.config?x=d8ac8dd33677e8e0 > >> dashboard link: https://syzkaller.appspot.com/bug?extid=8540db210d403f1aa214 > >> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15c1b70f280000 > >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=122ee4cb280000 > >> > >> Downloadable assets: > >> disk image: https://storage.googleapis.com/syzbot-assets/2a004483aca3/disk-8d2be868.raw.xz > >> vmlinux: https://storage.googleapis.com/syzbot-assets/5688cb13b277/vmlinux-8d2be868.xz > >> kernel image: https://storage.googleapis.com/syzbot-assets/76de0b63bc53/bzImage-8d2be868.xz > >> > >> The issue was bisected to: > >> > >> commit 21a18f4a51896fde11002165f0e7340f4131d6a0 > >> Author: Mike Christie <michael.christie@xxxxxxxxxx> > >> Date: Tue Jun 13 01:32:46 2023 +0000 > >> > >> vhost: allow userspace to create workers > >> > >> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=130850bf280000 > >> final oops: https://syzkaller.appspot.com/x/report.txt?x=108850bf280000 > >> console output: https://syzkaller.appspot.com/x/log.txt?x=170850bf280000 > >> > >> IMPORTANT: if you fix the issue, please add the following tag to the commit: > >> Reported-by: syzbot+8540db210d403f1aa214@xxxxxxxxxxxxxxxxxxxxxxxxx > >> Fixes: 21a18f4a5189 ("vhost: allow userspace to create workers") > > > > Mike, would appreciate prompt attention to this as I am preparing > > a pull request for the merge window and need to make a > > decision on whether to include your userspace-controlled > > threading patchset. > > > > Do you want me to resubmit the patchset or submit a patch against your vhost > branch? Resubmit pls. > The bug is that vhost-net can call vhost_dev_reset_owner and that will > free the workers. However, I leave the virtqueue->worker pointer set so > we end up referencing the freed workers later on. When I handled a > review comment between v5 and v6, I deleted that code thinking it was > also not needed. > > So the fix is: > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index ab79b064aade..5a07e220e46d 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -607,6 +607,10 @@ static void vhost_workers_free(struct vhost_dev *dev) > > if (!dev->use_worker) > return; > + > + for (i = 0; i < dev->nvqs; i++) > + rcu_assign_pointer(dev->vqs[i]->worker, NULL); > + > /* > * Free the default worker we created and cleanup workers userspace > * created but couldn't clean up (it forgot or crashed). > >
