On pondělí 2. ledna 2023 12:45:30 CET Oleksandr Natalenko wrote:
> This is a sudden splash I've got while just using my workstation:
>
> ==================================================================
> BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270
> Use-after-free read at 0x00000000e57c579c (in kfence-#173):
> bfq_exit_icq_bfqq+0x132/0x270
> bfq_exit_icq+0x5e/0x80
> exit_io_context+0x88/0xb0
> do_exit+0x66c/0xb80
> kthread_exit+0x29/0x30
> kthread+0xbd/0x110
> ret_from_fork+0x22/0x30
>
> kfence-#173: 0x000000005d7be631-0x000000006ad0b684, size=568, cache=bfq_queue
> allocated by task 40147 on cpu 16 at 13975.114285s:
> bfq_get_queue+0xdf/0x4e0
> bfq_get_bfqq_handle_split+0x75/0x170
> bfq_insert_requests+0x832/0x2580
> blk_mq_sched_insert_requests+0x63/0x150
> blk_mq_flush_plug_list+0x122/0x360
> __blk_flush_plug+0x106/0x160
> blk_finish_plug+0x29/0x40
> dm_bufio_prefetch+0x108/0x4d0 [dm_bufio]
> dm_tm_issue_prefetches+0x44/0x70 [dm_persistent_data]
> dm_pool_issue_prefetches+0x39/0x43 [dm_thin_pool]
> do_worker+0x4c/0xd60 [dm_thin_pool]
> process_one_work+0x258/0x410
> worker_thread+0x55/0x4c0
> kthread+0xde/0x110
> ret_from_fork+0x22/0x30
>
> freed by task 40147 on cpu 20 at 14500.096700s:
> bfq_put_queue+0x185/0x2d0
> bfq_exit_icq_bfqq+0x129/0x270
> bfq_exit_icq+0x5e/0x80
> exit_io_context+0x88/0xb0
> do_exit+0x66c/0xb80
> kthread_exit+0x29/0x30
> kthread+0xbd/0x110
> ret_from_fork+0x22/0x30
>
> CPU: 20 PID: 40147 Comm: kworker/dying Tainted: G W 6.1.0-pf2 #1 ff5dbde5ea280110a73397797e059b8558cda111
> Hardware name: ASUS System Product Name/Pro WS X570-ACE, BIOS 4304 12/12/2022
> ==================================================================
>
> I'm using v6.1.2, never experienced this before and cannot reproduce it at will. This kernel does not have any extra patches for the block layer on top of v6.1.2.
>
> In case you know what's going on, please let me know.
I assume 246cf66e30 ("block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq") may have fixed the issue. This commit is pending for upcoming v6.1.3.
--
Oleksandr Natalenko (post-factum)
