Patch "io_uring/tctx: work around xa_store() allocation error issue" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    io_uring/tctx: work around xa_store() allocation error issue

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-tctx-work-around-xa_store-allocation-error-.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 03068f9d622cb9e2925a4b509f0d1401c99241ed
Author: Jens Axboe <axboe@xxxxxxxxx>
Date:   Fri Nov 29 07:20:28 2024 -0700

    io_uring/tctx: work around xa_store() allocation error issue
    
    [ Upstream commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 ]
    
    syzbot triggered the following WARN_ON:
    
    WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51
    
    which is the
    
    WARN_ON_ONCE(!xa_empty(&tctx->xa));
    
    sanity check in __io_uring_free() when a io_uring_task is going through
    its final put. The syzbot test case includes injecting memory allocation
    failures, and it very much looks like xa_store() can fail one of its
    memory allocations and end up with ->head being non-NULL even though no
    entries exist in the xarray.
    
    Until this issue gets sorted out, work around it by attempting to
    iterate entries in our xarray, and WARN_ON_ONCE() if one is found.
    
    Reported-by: syzbot+cc36d44ec9f368e443d3@xxxxxxxxxxxxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@xxxxxxxxxx/
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index c043fe93a3f23..84f6a83857204 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -47,8 +47,19 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx,
 void __io_uring_free(struct task_struct *tsk)
 {
 	struct io_uring_task *tctx = tsk->io_uring;
+	struct io_tctx_node *node;
+	unsigned long index;
 
-	WARN_ON_ONCE(!xa_empty(&tctx->xa));
+	/*
+	 * Fault injection forcing allocation errors in the xa_store() path
+	 * can lead to xa_empty() returning false, even though no actual
+	 * node is stored in the xarray. Until that gets sorted out, attempt
+	 * an iteration here and warn if any entries are found.
+	 */
+	xa_for_each(&tctx->xa, index, node) {
+		WARN_ON_ONCE(1);
+		break;
+	}
 	WARN_ON_ONCE(tctx->io_wq);
 	WARN_ON_ONCE(tctx->cached_refs);