[syzbot] [kernel?] KASAN: slab-use-after-free Read in pwq_release_workfn

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 626932085009 Add linux-next specific files for 20230825
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12268740680000
kernel config: https://syzkaller.appspot.com/x/.config?x=8a8c992a790e5073
dashboard link: https://syzkaller.appspot.com/bug?extid=60db9f652c92d5bacba4
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e25db7a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15b154c0680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/46ec18b3c2fb/disk-62693208.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b4ea0cb78498/vmlinux-62693208.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5fb3938c7272/bzImage-62693208.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+60db9f...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in pwq_release_workfn+0x339/0x380 kernel/workqueue.c:4124
Read of size 4 at addr ffff888027b831c0 by task pool_workqueue_/3

CPU: 0 PID: 3 Comm: pool_workqueue_ Not tainted 6.5.0-rc7-next-20230825-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report+0xda/0x110 mm/kasan/report.c:588
pwq_release_workfn+0x339/0x380 kernel/workqueue.c:4124
kthread_worker_fn+0x2fc/0xa80 kernel/kthread.c:823
kthread+0x33a/0x430 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
</TASK>

Allocated by task 5054:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383
kmalloc include/linux/slab.h:599 [inline]
kzalloc include/linux/slab.h:720 [inline]
alloc_workqueue+0x16f/0x1490 kernel/workqueue.c:4684
kvm_mmu_init_tdp_mmu+0x23/0x100 arch/x86/kvm/mmu/tdp_mmu.c:19
kvm_mmu_init_vm+0x248/0x2e0 arch/x86/kvm/mmu/mmu.c:6180
kvm_arch_init_vm+0x39/0x720 arch/x86/kvm/x86.c:12311
kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1222 [inline]
kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:5089 [inline]
kvm_dev_ioctl+0xa31/0x1c20 arch/x86/kvm/../../../virt/kvm/kvm_main.c:5131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 5054:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826
slab_free mm/slub.c:3809 [inline]
__kmem_cache_free+0xb8/0x2f0 mm/slub.c:3822
alloc_workqueue+0xe76/0x1490 kernel/workqueue.c:4746
kvm_mmu_init_tdp_mmu+0x23/0x100 arch/x86/kvm/mmu/tdp_mmu.c:19
kvm_mmu_init_vm+0x248/0x2e0 arch/x86/kvm/mmu/mmu.c:6180
kvm_arch_init_vm+0x39/0x720 arch/x86/kvm/x86.c:12311
kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1222 [inline]
kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:5089 [inline]
kvm_dev_ioctl+0xa31/0x1c20 arch/x86/kvm/../../../virt/kvm/kvm_main.c:5131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff888027b83000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 448 bytes inside of
freed 512-byte region [ffff888027b83000, ffff888027b83200)

The buggy address belongs to the physical page:
page:ffffea00009ee000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27b80
head:ffffea00009ee000 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888012c41c80 ffffea000084fd00 dead000000000002
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3260, tgid 3260 (kworker/u4:1), ts 17219877730, free_ts 0
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1530
prep_new_page mm/page_alloc.c:1537 [inline]
get_page_from_freelist+0xf17/0x2e50 mm/page_alloc.c:3200
__alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4456
alloc_pages+0x1a9/0x270 mm/mempolicy.c:2298
alloc_slab_page mm/slub.c:1870 [inline]
allocate_slab+0x251/0x380 mm/slub.c:2017
new_slab mm/slub.c:2070 [inline]
___slab_alloc+0x8be/0x1570 mm/slub.c:3223
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
__kmem_cache_alloc_node+0x137/0x350 mm/slub.c:3517
kmalloc_trace+0x25/0xe0 mm/slab_common.c:1114
kmalloc include/linux/slab.h:599 [inline]
kzalloc include/linux/slab.h:720 [inline]
alloc_bprm+0x51/0xaf0 fs/exec.c:1514
kernel_execve+0xaf/0x4e0 fs/exec.c:1989
call_usermodehelper_exec_async+0x256/0x4c0 kernel/umh.c:110
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
page_owner free stack trace missing

Memory state around the buggy address:
ffff888027b83080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888027b83100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888027b83180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888027b83200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888027b83280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

On Wed, 30 Aug 2023 14:23:49 -0700

> HEAD commit: 626932085009 Add linux-next specific files for 20230825
> git tree: linux-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15b154c0680000

Flush the pwq release worker before freeing workqueue.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

--- x/kernel/workqueue.c
+++ y/kernel/workqueue.c
@@ -4743,6 +4743,7 @@ err_unreg_lockdep:
wq_free_lockdep(wq);
err_free_wq:
free_workqueue_attrs(wq->unbound_attrs);
+ kthread_flush_worker(pwq_release_worker);
kfree(wq);
return NULL;
err_destroy:
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+60db9f...@syzkaller.appspotmail.com

Tested on:

commit: a47fc304 Add linux-next specific files for 20230831
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1440618fa80000
kernel config: https://syzkaller.appspot.com/x/.config?x=8294f0401243efe1

dashboard link: https://syzkaller.appspot.com/bug?extid=60db9f652c92d5bacba4
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=103f1bffa80000

Note: testing is done by a robot and is best-effort only.

[Edward AD]

From: Edward Adam Davis <ead...@sina.com>

please test wq invalid pointer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 626932085009

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index c85825e17df8..aae1004d0a59 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4743,6 +4743,12 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
wq_free_lockdep(wq);
err_free_wq:
free_workqueue_attrs(wq->unbound_attrs);
+ if (wq->cpu_pwq) {
+ for_each_possible_cpu(cpu)
+ kfree(*per_cpu_ptr(wq->cpu_pwq, cpu));
+ free_percpu(wq->cpu_pwq);
+ wq->cpu_pwq = NULL;
+ }
kfree(wq);
return NULL;
err_destroy:

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

kernel/workqueue.c:4747:39: error: 'cpu' undeclared (first use in this function)


Tested on:

commit: 62693208 Add linux-next specific files for 20230825
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
kernel config: https://syzkaller.appspot.com/x/.config?x=8a8c992a790e5073

dashboard link: https://syzkaller.appspot.com/bug?extid=60db9f652c92d5bacba4
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1223bddba80000

[Lizhi Xu]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 626932085009

diff --git a/kernel/workqueue.c b/kernel/workqueue.c

index c85825e17df8..91263c6e9cf6 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4743,6 +4743,13 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,

wq_free_lockdep(wq);
err_free_wq:
free_workqueue_attrs(wq->unbound_attrs);
+ if (wq->cpu_pwq) {

+ int cpu;

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in pwq_release_workfn

==================================================================
BUG: KASAN: slab-use-after-free in pwq_release_workfn+0x339/0x380 kernel/workqueue.c:4124

Read of size 4 at addr ffff888020ab25c0 by task pool_workqueue_/3

CPU: 1 PID: 3 Comm: pool_workqueue_ Not tainted 6.5.0-rc7-next-20230825-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report+0xda/0x110 mm/kasan/report.c:588
pwq_release_workfn+0x339/0x380 kernel/workqueue.c:4124
kthread_worker_fn+0x2fc/0xa80 kernel/kthread.c:823
kthread+0x33a/0x430 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
</TASK>

Allocated by task 5489:

kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383
kmalloc include/linux/slab.h:599 [inline]
kzalloc include/linux/slab.h:720 [inline]

alloc_workqueue+0x16f/0x1730 kernel/workqueue.c:4684

kvm_mmu_init_tdp_mmu+0x23/0x100 arch/x86/kvm/mmu/tdp_mmu.c:19
kvm_mmu_init_vm+0x248/0x2e0 arch/x86/kvm/mmu/mmu.c:6180
kvm_arch_init_vm+0x39/0x720 arch/x86/kvm/x86.c:12311
kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1222 [inline]
kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:5089 [inline]
kvm_dev_ioctl+0xa31/0x1c20 arch/x86/kvm/../../../virt/kvm/kvm_main.c:5131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 5489:

kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826
slab_free mm/slub.c:3809 [inline]
__kmem_cache_free+0xb8/0x2f0 mm/slub.c:3822

alloc_workqueue+0x105d/0x1730 kernel/workqueue.c:4753

kvm_mmu_init_tdp_mmu+0x23/0x100 arch/x86/kvm/mmu/tdp_mmu.c:19
kvm_mmu_init_vm+0x248/0x2e0 arch/x86/kvm/mmu/mmu.c:6180
kvm_arch_init_vm+0x39/0x720 arch/x86/kvm/x86.c:12311
kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1222 [inline]
kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:5089 [inline]
kvm_dev_ioctl+0xa31/0x1c20 arch/x86/kvm/../../../virt/kvm/kvm_main.c:5131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Last potentially related work creation:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:492
__call_rcu_common.constprop.0+0x9a/0x790 kernel/rcu/tree.c:2653
fib6_info_release include/net/ip6_fib.h:332 [inline]
fib6_info_release include/net/ip6_fib.h:329 [inline]
fib6_del_route net/ipv6/ip6_fib.c:2005 [inline]
fib6_del+0x12f0/0x1750 net/ipv6/ip6_fib.c:2038
fib6_clean_node+0x41d/0x5a0 net/ipv6/ip6_fib.c:2200
fib6_walk_continue+0x44a/0x8c0 net/ipv6/ip6_fib.c:2122
fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2170
fib6_clean_tree+0xd7/0x110 net/ipv6/ip6_fib.c:2250
__fib6_clean_all+0x102/0x2d0 net/ipv6/ip6_fib.c:2266
rt6_sync_down_dev net/ipv6/route.c:4889 [inline]
rt6_disable_ip+0x7e4/0xa00 net/ipv6/route.c:4894
addrconf_ifdown.isra.0+0x112/0x1c50 net/ipv6/addrconf.c:3792
addrconf_notify+0x22d/0x1920 net/ipv6/addrconf.c:3715
notifier_call_chain+0xb6/0x3b0 kernel/notifier.c:93
call_netdevice_notifiers_info+0xb9/0x130 net/core/dev.c:1970
call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
call_netdevice_notifiers net/core/dev.c:2022 [inline]
dev_close_many+0x305/0x640 net/core/dev.c:1563
unregister_netdevice_many_notify+0x41b/0x1a20 net/core/dev.c:10908
unregister_netdevice_many net/core/dev.c:10991 [inline]
default_device_exit_batch+0x584/0x740 net/core/dev.c:11450
ops_exit_list+0x125/0x170 net/core/net_namespace.c:175
cleanup_net+0x505/0xb20 net/core/net_namespace.c:614
process_one_work+0x887/0x15d0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8bb/0x1290 kernel/workqueue.c:2784

kthread+0x33a/0x430 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

The buggy address belongs to the object at ffff888020ab2400

which belongs to the cache kmalloc-512 of size 512
The buggy address is located 448 bytes inside of

freed 512-byte region [ffff888020ab2400, ffff888020ab2600)

The buggy address belongs to the physical page:

page:ffffea000082ac00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20ab0
head:ffffea000082ac00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888012c41c80 0000000000000000 dead000000000001

raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1796, tgid 1796 (kworker/u4:4), ts 12890938353, free_ts 0

set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1530
prep_new_page mm/page_alloc.c:1537 [inline]
get_page_from_freelist+0xf17/0x2e50 mm/page_alloc.c:3200
__alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4456
alloc_pages+0x1a9/0x270 mm/mempolicy.c:2298
alloc_slab_page mm/slub.c:1870 [inline]
allocate_slab+0x251/0x380 mm/slub.c:2017
new_slab mm/slub.c:2070 [inline]
___slab_alloc+0x8be/0x1570 mm/slub.c:3223
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
__kmem_cache_alloc_node+0x137/0x350 mm/slub.c:3517
kmalloc_trace+0x25/0xe0 mm/slab_common.c:1114
kmalloc include/linux/slab.h:599 [inline]
kzalloc include/linux/slab.h:720 [inline]
alloc_bprm+0x51/0xaf0 fs/exec.c:1514
kernel_execve+0xaf/0x4e0 fs/exec.c:1989
call_usermodehelper_exec_async+0x256/0x4c0 kernel/umh.c:110
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
page_owner free stack trace missing

Memory state around the buggy address:

ffff888020ab2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888020ab2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888020ab2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888020ab2600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888020ab2680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Tested on:

commit: 62693208 Add linux-next specific files for 20230825
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=15e7feb7a80000

kernel config: https://syzkaller.appspot.com/x/.config?x=8a8c992a790e5073
dashboard link: https://syzkaller.appspot.com/bug?extid=60db9f652c92d5bacba4
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=118e6fe3a80000

[Edward AD]

From: Edward Adam Davis <ead...@sina.com>

please test wq invalid pointer

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 626932085009

diff --git a/kernel/workqueue.c b/kernel/workqueue.c

index c85825e17df8..e9f181d12050 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4741,6 +4741,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
err_unreg_lockdep:
wq_unregister_lockdep(wq);
wq_free_lockdep(wq);
+ return NULL;
err_free_wq:
free_workqueue_attrs(wq->unbound_attrs);
kfree(wq);

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+60db9f...@syzkaller.appspotmail.com

Tested on:

commit: 62693208 Add linux-next specific files for 20230825
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=114e4e57a80000

kernel config: https://syzkaller.appspot.com/x/.config?x=8a8c992a790e5073
dashboard link: https://syzkaller.appspot.com/bug?extid=60db9f652c92d5bacba4
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11e9fc13a80000

[Edward AD]

When "alloc_and_link_pwqs" fails to be called in the "apply_wqattrs_prepare"
function, "put_pwq" may be called, and it will be executed asynchronously.
Because "alloc_and_link_pwqs" returns a negative value, the "alloc_workqueue"
will release wq, which will cause an exception when accessing the released
wq when executing to "pwq_release_workfn".

When 'alloc_and_link_pwqs' returns a negative value, wq is no longer released.
And when wq->pwqs is an empty list, it will also be called in "pwq_release_wor
kfn" to release wq.

Signed-off-by: Edward AD <ead...@sina.com>
---
kernel/workqueue.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index c85825e17df8..e9f181d12050 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4741,6 +4741,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
err_unreg_lockdep:
wq_unregister_lockdep(wq);
wq_free_lockdep(wq);
+ return NULL;
err_free_wq:
free_workqueue_attrs(wq->unbound_attrs);
kfree(wq);

--
2.25.1