On 09/10/2020 11:02, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: e4fb79c7 Add linux-next specific files for 20201008 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=1592ee1b900000 > kernel config: https://syzkaller.appspot.com/x/.config?x=568d41fe4341ed0f > dashboard link: https://syzkaller.appspot.com/bug?extid=77efce558b2b9e6b6405 > compiler: gcc (GCC) 10.1.0-syz 20200507 > > Unfortunately, I don't have any reproducer for this issue yet. > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+77efce558b2b9e6b6405@xxxxxxxxxxxxxxxxxxxxxxxxx > > ================================================================== > BUG: KASAN: use-after-free in xas_next_entry include/linux/xarray.h:1630 [inline] > BUG: KASAN: use-after-free in __io_uring_files_cancel+0x417/0x440 fs/io_uring.c:8681 > Read of size 1 at addr ffff888033631880 by task syz-executor.1/8477 > > CPU: 1 PID: 8477 Comm: syz-executor.1 Not tainted 5.9.0-rc8-next-20201008-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x198/0x1fb lib/dump_stack.c:118 > print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:385 > __kasan_report mm/kasan/report.c:545 [inline] > kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 > xas_next_entry include/linux/xarray.h:1630 [inline] > __io_uring_files_cancel+0x417/0x440 fs/io_uring.c:8681 > io_uring_files_cancel include/linux/io_uring.h:35 [inline] > exit_files+0xe4/0x170 fs/file.c:456 > do_exit+0xae9/0x2930 kernel/exit.c:801 > do_group_exit+0x125/0x310 kernel/exit.c:903 > get_signal+0x428/0x1f00 kernel/signal.c:2757 > arch_do_signal+0x82/0x2470 arch/x86/kernel/signal.c:811 > exit_to_user_mode_loop kernel/entry/common.c:161 [inline] > exit_to_user_mode_prepare+0x194/0x1f0 kernel/entry/common.c:192 > syscall_exit_to_user_mode+0x7a/0x2c0 kernel/entry/common.c:267 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 It seems this fails on "node->shift" in xas_next_entry(), that would mean that the node itself was freed while we're iterating on it. __io_uring_files_cancel() iterates with xas_next_entry() and creates XA_STATE once by hand, but it also removes entries in the loop with io_uring_del_task_file() -> xas_store(&xas, NULL); without updating the iterating XA_STATE. Could it be the problem? See a diff below diff --git a/fs/io_uring.c b/fs/io_uring.c index 824ed4e01562..356313c7aec2 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8617,10 +8617,9 @@ static int io_uring_add_task_file(struct file *file) /* * Remove this io_uring_file -> task mapping. */ -static void io_uring_del_task_file(struct file *file) +static void io_uring_del_task_file(struct file *file, struct xa_state *xas) { struct io_uring_task *tctx = current->io_uring; - XA_STATE(xas, &tctx->xa, (unsigned long) file); if (tctx->last == file) tctx->last = NULL; @@ -8643,7 +8642,7 @@ static void __io_uring_attempt_task_drop(struct file *file) rcu_read_unlock(); if (old == file) - io_uring_del_task_file(file); + io_uring_del_task_file(file, &xas); } /* @@ -8687,7 +8686,7 @@ void __io_uring_files_cancel(struct files_struct *files) io_uring_cancel_task_requests(ctx, files); if (files) - io_uring_del_task_file(file); + io_uring_del_task_file(file, &xas); } while (1); } -- Pavel Begunkov
