> > > On 5/12/23 15:10, syzbot wrote: >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: 16a8829130ca nfs: fix another case of NULL/IS_ERR confusio.. >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=162c0566280000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=8bc832f563d8bf38 >> dashboard link: https://syzkaller.appspot.com/bug?extid=79f283f1f4ccc6e8b624 >> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 >> >> Unfortunately, I don't have any reproducer for this issue yet. >> >> Downloadable assets: >> disk image: https://storage.googleapis.com/syzbot-assets/f8c18a31ba47/disk-16a88291.raw.xz >> vmlinux: https://storage.googleapis.com/syzbot-assets/03a18f29b7e7/vmlinux-16a88291.xz >> kernel image: https://storage.googleapis.com/syzbot-assets/1db2407ade1e/bzImage-16a88291.xz >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+79f283f1f4ccc6e8b624@xxxxxxxxxxxxxxxxxxxxxxxxx >> >> xfrm0 speed is unknown, defaulting to 1000 >> ================================================================== >> BUG: KASAN: slab-use-after-free in siw_query_port+0x37b/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:177 >> Read of size 4 at addr ffff888034efa0e8 by task kworker/1:4/24211 >> >> CPU: 1 PID: 24211 Comm: kworker/1:4 Not tainted 6.4.0-rc1-syzkaller-00012-g16a8829130ca #0 >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 >> Workqueue: infiniband ib_cache_event_task >> Call Trace: >> <TASK> >> __dump_stack lib/dump_stack.c:88 [inline] >> dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 >> print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 >> print_report mm/kasan/report.c:462 [inline] >> kasan_report+0x11c/0x130 mm/kasan/report.c:572 >> siw_query_port+0x37b/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:177 >> iw_query_port drivers/infiniband/core/device.c:2049 [inline] >> ib_query_port drivers/infiniband/core/device.c:2090 [inline] >> ib_query_port+0x3c4/0x8f0 drivers/infiniband/core/device.c:2082 >> ib_cache_update.part.0+0xcf/0x920 drivers/infiniband/core/cache.c:1487 >> ib_cache_update drivers/infiniband/core/cache.c:1561 [inline] >> ib_cache_event_task+0x1b1/0x270 drivers/infiniband/core/cache.c:1561 >> process_one_work+0x99a/0x15e0 kernel/workqueue.c:2405 >> worker_thread+0x67d/0x10c0 kernel/workqueue.c:2552 >> kthread+0x344/0x440 kernel/kthread.c:379 >> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 >> </TASK> > > This might be similar as 390d3fdcae2d, let me play with syzbot a bit 😉 > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git This crash does not have a reproducer. I cannot test it. > for-rc > > diff --git a/drivers/infiniband/core/device.c > b/drivers/infiniband/core/device.c > index a666847bd714..9dd59f8d5f05 100644 > --- a/drivers/infiniband/core/device.c > +++ b/drivers/infiniband/core/device.c > @@ -2016,6 +2016,7 @@static int iw_query_port(struct ib_device *device, > { > struct in_device *inetdev; > struct net_device *netdev; > +int ret; > > memset(port_attr, 0, sizeof(*port_attr)); > > @@ -2045,8 +2046,9 @@static int iw_query_port(struct ib_device *device, > rcu_read_unlock(); > } > > +ret = device->ops.query_port(device, port_num, port_attr); > dev_put(netdev); > - return device->ops.query_port(device, port_num, port_attr); > +return ret; > } > > static int __ib_query_port(struct ib_device *device,
