On Mon, 25 Oct 2021 at 10:39, John Garry <john.garry@xxxxxxxxxx> wrote: > > On 25/10/2021 02:35, syzbot wrote: > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: 51dba6e335ff Add linux-next specific files for 20211020 > > git tree: linux-next > > console output:https://syzkaller.appspot.com/x/log.txt?x=10171dc8b00000 > > kernel config:https://syzkaller.appspot.com/x/.config?x=1adca843ed814d57 > > dashboard link:https://syzkaller.appspot.com/bug?extid=412ca156285f619b8b62 > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > > syz repro:https://syzkaller.appspot.com/x/repro.syz?x=14f768b4b00000 > > C reproducer:https://syzkaller.appspot.com/x/repro.c?x=1295a8c7300000 > > > > The issue was bisected to: > > > > commit 645db34e50501aac141713fb47a315e5202ff890 > > I think that it should be e155b0c238b2 ("blk-mq: Use shared tags for > shared sbitmap support") > > > Author: John Garry<john.garry@xxxxxxxxxx> > > Date: Tue Oct 5 10:23:36 2021 +0000 > > > > blk-mq: Refactor and rename blk_mq_free_map_and_{requests->rqs}() > > > > bisection log:https://syzkaller.appspot.com/x/bisect.txt?x=1597e130b00000 > > final oops:https://syzkaller.appspot.com/x/report.txt?x=1797e130b00000 > > console output:https://syzkaller.appspot.com/x/log.txt?x=1397e130b00000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by:syzbot+412ca156285f619b8b62@xxxxxxxxxxxxxxxxxxxxxxxxx > > Fixes: 645db34e5050 ("blk-mq: Refactor and rename blk_mq_free_map_and_{requests->rqs}()") > > > > ================================================================== > > BUG: KASAN: use-after-free in blk_mq_sched_tags_teardown+0x2a1/0x2d0 block/blk-mq-sched.c:544 > > Read of size 4 at addr ffff8880760b81e0 by task systemd-udevd/6750 > > #syz fix: blk-mq-sched: Don't reference queue tagset in > blk_mq_sched_tags_teardown() Hi John, Thanks for updating the bug. It looks like the title was line wrapped. There is a hack specifically for gmail to put the title onto separate line, it's still parsable this way (if the whole title fits into 78 cols of course :)) #syz fix: blk-mq-sched: Don't reference queue tagset in blk_mq_sched_tags_teardown()
