[syzbot] KASAN: use-after-free Read in snd_pcm_post_stop

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=123b545e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17530902480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e29d28...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:100
Read of size 8 at addr ffff88801eb938f0 by task syz-executor234/5078

CPU: 0 PID: 5078 Comm: syz-executor234 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
__wake_up_common+0x637/0x650 kernel/sched/wait.c:100
__wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138
snd_pcm_post_stop+0x91/0x1f0 sound/core/pcm_native.c:1522
snd_pcm_action_single+0xf4/0x130 sound/core/pcm_native.c:1283
snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364
snd_pcm_stop sound/core/pcm_native.c:1543 [inline]
snd_pcm_drop+0x165/0x2b0 sound/core/pcm_native.c:2227
snd_pcm_kernel_ioctl+0x243/0x2e0 sound/core/pcm_native.c:3456
snd_pcm_oss_sync+0x230/0x810 sound/core/oss/pcm_oss.c:1746
snd_pcm_oss_release+0x27a/0x300 sound/core/oss/pcm_oss.c:2590
__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f864105c209
Code: Unable to access opcode bytes at 0x7f864105c1df.
RSP: 002b:00007fff6e56b898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 00007f864105c209
RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006
RBP: 0000000000000000 R08: 00007fff6e56ba38 R09: 00007fff6e56ba38
R10: 000000000000000d R11: 0000000000000246 R12: 00007f864101f800
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
</TASK>

Allocated by task 5078:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 1002:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2737
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2967
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88801eb938c0
which belongs to the cache io_kiocb of size 216
The buggy address is located 48 bytes inside of
216-byte region [ffff88801eb938c0, ffff88801eb93998)

The buggy address belongs to the physical page:
page:ffffea00007ae4c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eb93
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801bc32dc0 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5078, tgid 5078 (syz-executor234), ts 58909389529, free_ts 58908987546
prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
skb_free_frag include/linux/skbuff.h:3193 [inline]
skb_free_head+0x96/0x110 net/core/skbuff.c:818
skb_release_data+0x5f4/0x870 net/core/skbuff.c:849
skb_release_all net/core/skbuff.c:914 [inline]
__kfree_skb+0x4f/0x70 net/core/skbuff.c:928
tcp_rcv_established+0x15fd/0x2270 net/ipv4/tcp_input.c:5927
tcp_v4_do_rcv+0x663/0x9d0 net/ipv4/tcp_ipv4.c:1721
tcp_v4_rcv+0x2eab/0x3280 net/ipv4/tcp_ipv4.c:2142
ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x2ec/0x4f0 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:302 [inline]
NF_HOOK include/linux/netfilter.h:296 [inline]
ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:454 [inline]
ip_sublist_rcv_finish+0x9a/0x2c0 net/ipv4/ip_input.c:580
ip_list_rcv_finish.constprop.0+0x4f9/0x6c0 net/ipv4/ip_input.c:630
ip_sublist_rcv net/ipv4/ip_input.c:638 [inline]
ip_list_rcv+0x347/0x4a0 net/ipv4/ip_input.c:673
__netif_receive_skb_list_ptype net/core/dev.c:5525 [inline]
__netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5573
__netif_receive_skb_list net/core/dev.c:5625 [inline]
netif_receive_skb_list_internal+0x75f/0xdc0 net/core/dev.c:5716

Memory state around the buggy address:
ffff88801eb93780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801eb93800: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
>ffff88801eb93880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88801eb93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801eb93980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000

Remove poll rentries before freeing request.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 0a093b2893c7

--- x/io_uring/poll.h
+++ y/io_uring/poll.h
@@ -28,6 +28,7 @@ int io_poll_add(struct io_kiocb *req, un

int io_poll_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe);
int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags);
+void io_poll_cleanup(struct io_kiocb *);

struct io_cancel_data;
int io_poll_cancel(struct io_ring_ctx *ctx, struct io_cancel_data *cd,
--- x/io_uring/poll.c
+++ y/io_uring/poll.c
@@ -820,6 +820,11 @@ static struct io_kiocb *io_poll_file_fin
return NULL;
}

+void io_poll_cleanup(struct io_kiocb *req)
+{
+ io_poll_remove_entries(req);
+}
+
static int io_poll_disarm(struct io_kiocb *req)
{
if (!req)
--- x/io_uring/io_uring.c
+++ y/io_uring/io_uring.c
@@ -2734,6 +2734,7 @@ static void io_req_caches_free(struct io
while (!io_req_cache_empty(ctx)) {
struct io_kiocb *req = io_alloc_req(ctx);

+ io_poll_cleanup(req);
kmem_cache_free(req_cachep, req);
nr++;
}
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in snd_pcm_oss_poll

==================================================================
BUG: KASAN: use-after-free in snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849
Read of size 8 at addr ffff888017b9dda0 by task syz-executor.0/5602

CPU: 0 PID: 5602 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849
vfs_poll include/linux/poll.h:88 [inline]
io_poll_check_events io_uring/poll.c:279 [inline]
io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327
handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169
tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224
task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635

arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f5fc228c0c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5fc2f2e168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007f5fc23abf80 RCX: 00007f5fc228c0c9

RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006

RBP: 00007f5fc22e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff0b78073f R14: 00007f5fc2f2e300 R15: 0000000000022000
</TASK>

Allocated by task 5602:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52

____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2433 [inline]
snd_pcm_oss_open.part.0+0x558/0x1330 sound/core/oss/pcm_oss.c:2535
snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499
soundcore_open+0x452/0x620 sound/sound_core.c:593
chrdev_open+0x26a/0x770 fs/char_dev.c:414
do_dentry_open+0x6cc/0x13f0 fs/open.c:883
do_open fs/namei.c:3558 [inline]
path_openat+0x1bc1/0x2b40 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x16d/0x4c0 fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_sys_openat fs/open.c:1343 [inline]
__se_sys_openat fs/open.c:1338 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1338

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 5601:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]

__kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2415 [inline]
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline]
snd_pcm_oss_release+0x182/0x300 sound/core/oss/pcm_oss.c:2592

__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179

resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204

__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff888017b9dda0
which belongs to the cache kmalloc-16 of size 16
The buggy address is located 0 bytes inside of
16-byte region [ffff888017b9dda0, ffff888017b9ddb0)

The buggy address belongs to the physical page:

page:ffffea00005ee740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888017b9dd60 pfn:0x17b9d
anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff8880124413c0 0000000000000000 dead000000000001
raw: ffff888017b9dd60 0000000080800076 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2868545565, free_ts 0

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590

alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2114
alloc_pages+0x233/0x270 mm/mempolicy.c:2276

alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193

__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
__kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc+0x4a/0xd0 mm/slab_common.c:980
acpi_ns_get_normalized_pathname+0x4d/0x9f drivers/acpi/acpica/nsnames.c:306
acpi_ex_start_trace_method+0x2e/0x343 drivers/acpi/acpica/extrace.c:176
acpi_ds_begin_method_execution+0x46/0x7c3 drivers/acpi/acpica/dsmethod.c:304
acpi_ps_execute_method+0x94/0x620 drivers/acpi/acpica/psxface.c:105
acpi_ns_evaluate+0x6d4/0x973 drivers/acpi/acpica/nseval.c:205
acpi_ut_evaluate_object+0xf5/0x3fa drivers/acpi/acpica/uteval.c:60
acpi_ut_execute_STA+0x86/0x17f drivers/acpi/acpica/uteval.c:223
page_owner free stack trace missing

Memory state around the buggy address:

ffff888017b9dc80: fb fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc
ffff888017b9dd00: 00 00 fc fc 00 05 fc fc 00 00 fc fc fb fb fc fc
>ffff888017b9dd80: fb fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc
^
ffff888017b9de00: fa fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc
ffff888017b9de80: fa fb fc fc 00 00 fc fc fa fb fc fc fb fb fc fc
==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13dcf65e480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=16f75c7e480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000

Bump req->file up to make vfs_poll() safe.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 0a093b2893c7

--- x/include/linux/io_uring_types.h
+++ y/include/linux/io_uring_types.h
@@ -578,6 +578,7 @@ struct io_kiocb {
struct io_kiocb *link;
/* custom credentials, valid IFF REQ_F_CREDS is set */
const struct cred *creds;
+ struct file *poll_file;
struct io_wq_work work;
};

--- x/io_uring/io_uring.c
+++ y/io_uring/io_uring.c
@@ -976,6 +976,8 @@ static void __io_req_complete_post(struc
io_put_kbuf_comp(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
ctx->locked_free_nr++;
}
@@ -1099,6 +1101,8 @@ __cold void io_free_req(struct io_kiocb
io_req_put_rsrc(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);

spin_lock(&ctx->completion_lock);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
@@ -2140,6 +2144,7 @@ static int io_init_req(struct io_ring_ct
req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

--- x/io_uring/poll.c
+++ y/io_uring/poll.c
@@ -714,6 +714,8 @@ int io_arm_poll_handler(struct io_kiocb

io_kbuf_recycle(req, issue_flags);

+ get_file(req->file);
+ req->poll_file = req->file;
ret = __io_arm_poll_handler(req, &apoll->poll, &ipt, mask, issue_flags);
if (ret)
return ret > 0 ? IO_APOLL_READY : IO_APOLL_ABORTED;
@@ -943,6 +945,8 @@ int io_poll_add(struct io_kiocb *req, un
if (req->ctx->flags & (IORING_SETUP_SQPOLL|IORING_SETUP_SINGLE_ISSUER))
req->flags |= REQ_F_HASH_LOCKED;

+ get_file(req->file);
+ req->poll_file = req->file;
ret = __io_arm_poll_handler(req, poll, &ipt, poll->events, issue_flags);
if (ret > 0) {
io_req_set_res(req, ipt.result_mask, 0);
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_fallback_tw

==================================================================
BUG: KASAN: use-after-free in io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1253
Read of size 8 at addr ffff888029b7c948 by task syz-executor.0/5601

CPU: 1 PID: 5601 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1253
tctx_task_work.cold+0xf/0x2c io_uring/io_uring.c:1223

task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859

arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f9fa6c8c0c9
Code: Unable to access opcode bytes at 0x7f9fa6c8c09f.
RSP: 002b:00007f9fa7a98168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007f9fa6dabf80 RCX: 00007f9fa6c8c0c9

RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006

RBP: 00007f9fa6ce7ae9 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffdca0565bf R14: 00007f9fa7a98300 R15: 0000000000022000
</TASK>

Allocated by task 5601:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52

__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033

__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1064
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2412
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3434

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 33:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]

kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2742
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2972

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff888029b7c8c0
which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of
224-byte region [ffff888029b7c8c0, ffff888029b7c9a0)

The buggy address belongs to the physical page:

page:ffffea0000a6df00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29b7c
memcg:ffff88801de69981

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff888146395500 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88801de69981

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5601, tgid 5600 (syz-executor.0), ts 79202512513, free_ts 51400073995

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590

alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281

alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193

__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026

__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1064
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2412
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3434

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482

__vunmap+0x7fe/0xc00 mm/vmalloc.c:2746
__vfree+0x3c/0xd0 mm/vmalloc.c:2794
vfree+0x5e/0x90 mm/vmalloc.c:2825
kcov_put kernel/kcov.c:428 [inline]
kcov_put+0x26/0x40 kernel/kcov.c:424
kcov_close+0x10/0x20 kernel/kcov.c:524

__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179

exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859

arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86

Memory state around the buggy address:

ffff888029b7c800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888029b7c880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888029b7c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888029b7c980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888029b7ca00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=14412b16480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=15c09ea6480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000

Bump req->file up to make vfs_poll() safe.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 0a093b2893c7

--- x/include/linux/io_uring_types.h
+++ y/include/linux/io_uring_types.h
@@ -578,6 +578,7 @@ struct io_kiocb {
struct io_kiocb *link;
/* custom credentials, valid IFF REQ_F_CREDS is set */
const struct cred *creds;
+ struct file *poll_file;
struct io_wq_work work;
};

--- x/io_uring/poll.c
+++ y/io_uring/poll.c
@@ -714,6 +714,8 @@ int io_arm_poll_handler(struct io_kiocb

io_kbuf_recycle(req, issue_flags);

+ get_file(req->file);
+ req->poll_file = req->file;
ret = __io_arm_poll_handler(req, &apoll->poll, &ipt, mask, issue_flags);
if (ret)
return ret > 0 ? IO_APOLL_READY : IO_APOLL_ABORTED;
@@ -943,6 +945,8 @@ int io_poll_add(struct io_kiocb *req, un
if (req->ctx->flags & (IORING_SETUP_SQPOLL|IORING_SETUP_SINGLE_ISSUER))
req->flags |= REQ_F_HASH_LOCKED;

+ get_file(req->file);
+ req->poll_file = req->file;
ret = __io_arm_poll_handler(req, poll, &ipt, poll->events, issue_flags);
if (ret > 0) {
io_req_set_res(req, ipt.result_mask, 0);

--- x/io_uring/io_uring.c
+++ y/io_uring/io_uring.c
@@ -248,8 +248,12 @@ static __cold void io_fallback_req_func(
bool locked = false;

percpu_ref_get(&ctx->refs);
- llist_for_each_entry_safe(req, tmp, node, io_task_work.node)
+ llist_for_each_entry_safe(req, tmp, node, io_task_work.node) {
req->io_task_work.func(req, &locked);
+ if (req_ref_put_and_test(req)) {
+ io_free_req(req);
+ }
+ }

if (locked) {
io_submit_flush_completions(ctx);
@@ -976,6 +980,8 @@ static void __io_req_complete_post(struc

io_put_kbuf_comp(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
ctx->locked_free_nr++;
}

@@ -1099,6 +1105,8 @@ __cold void io_free_req(struct io_kiocb

io_req_put_rsrc(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);

spin_lock(&ctx->completion_lock);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);

@@ -1169,6 +1177,9 @@ static unsigned int handle_tw_list(struc
req->io_task_work.func(req, locked);
node = next;
count++;
+ if (req_ref_put_and_test(req)) {
+ io_free_req(req);
+ }
}

return count;
@@ -1296,6 +1307,7 @@ void __io_req_task_work_add(struct io_ki
if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ req_ref_get(req);
if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

@@ -2140,6 +2152,7 @@ static int io_init_req(struct io_ring_ct

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING in __io_req_task_work_add

------------[ cut here ]------------
WARNING: CPU: 1 PID: 0 at io_uring/refs.h:31 req_ref_get io_uring/refs.h:31 [inline]
WARNING: CPU: 1 PID: 0 at io_uring/refs.h:31 __io_req_task_work_add+0x763/0x850 io_uring/io_uring.c:1310
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

RIP: 0010:req_ref_get io_uring/refs.h:31 [inline]
RIP: 0010:__io_req_task_work_add+0x763/0x850 io_uring/io_uring.c:1310
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 e6 00 00 00 49 8b 7c 24 18 be 01 00 00 00 e8 e7 28 57 fd e9 00 fe ff ff e8 cd 73 80 fd <0f> 0b e9 fd f9 ff ff e8 c1 73 80 fd 0f 0b e9 56 fa ff ff e8 b5 73
RSP: 0018:ffffc900001e0a48 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880711ba8c0 RCX: 0000000000000100
RDX: ffff88813feb9d40 RSI: ffffffff84014913 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: ffff88807e836000
R13: ffff8880711ba920 R14: ffff88801cfd4c00 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f00038cf5a8 CR3: 0000000027f59000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
io_req_task_work_add io_uring/io_uring.h:95 [inline]
__io_poll_execute io_uring/poll.c:366 [inline]
io_poll_wake+0x243/0x600 io_uring/poll.c:441
__wake_up_common+0x147/0x650 kernel/sched/wait.c:107
__wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138
snd_pcm_update_state+0x445/0x510 sound/core/pcm_lib.c:204
snd_pcm_update_hw_ptr0+0xada/0x1af0 sound/core/pcm_lib.c:465
snd_pcm_period_elapsed_under_stream_lock+0x156/0x220 sound/core/pcm_lib.c:1817
snd_pcm_period_elapsed+0x2c/0x50 sound/core/pcm_lib.c:1849
dummy_hrtimer_callback+0x98/0x1b0 sound/drivers/dummy.c:385
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x600/0xcf0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x17f/0x360 kernel/time/hrtimer.c:1766
__do_softirq+0x1fb/0xaf6 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x1fd/0x2a0 drivers/acpi/processor_idle.c:570
Code: 89 de e8 36 39 7b f7 84 db 75 ac e8 bd 3c 7b f7 e8 38 bd 81 f7 66 90 e8 b1 3c 7b f7 0f 00 2d 2a 44 ab 00 e8 a5 3c 7b f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 60 39 7b f7 48 85 db
RSP: 0018:ffffc90000177d10 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88813feb9d40 RSI: ffffffff8a06803b RDI: 0000000000000000
RBP: ffff888012684864 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888012684800 R14: ffff888012684864 R15: ffff88801c228004
acpi_idle_enter+0x368/0x510 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x1af/0xd40 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3f7/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:400
start_secondary+0x256/0x300 arch/x86/kernel/smpboot.c:264
secondary_startup_64_no_verify+0xce/0xdb
</TASK>
----------------
Code disassembly (best guess):
0: 89 de mov %ebx,%esi
2: e8 36 39 7b f7 callq 0xf77b393d
7: 84 db test %bl,%bl
9: 75 ac jne 0xffffffb7
b: e8 bd 3c 7b f7 callq 0xf77b3ccd
10: e8 38 bd 81 f7 callq 0xf781bd4d
15: 66 90 xchg %ax,%ax
17: e8 b1 3c 7b f7 callq 0xf77b3ccd
1c: 0f 00 2d 2a 44 ab 00 verw 0xab442a(%rip) # 0xab444d
23: e8 a5 3c 7b f7 callq 0xf77b3ccd
28: fb sti
29: f4 hlt
* 2a: 9c pushfq <-- trapping instruction
2b: 5b pop %rbx
2c: 81 e3 00 02 00 00 and $0x200,%ebx
32: fa cli
33: 31 ff xor %edi,%edi
35: 48 89 de mov %rbx,%rsi
38: e8 60 39 7b f7 callq 0xf77b399d
3d: 48 85 db test %rbx,%rbx

Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=17d091ee480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1100ada1480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -1296,6 +1307,8 @@ void __io_req_task_work_add(struct io_ki

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ if (req->flags & REQ_F_REFCOUNT)

+ req_ref_get(req);
if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

@@ -2140,6 +2153,7 @@ static int io_init_req(struct io_ring_ct

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in dummy_pcm_prepare

==================================================================
BUG: KASAN: use-after-free in dummy_pcm_prepare+0xae/0xc0 sound/drivers/dummy.c:504
Read of size 8 at addr ffff888077855200 by task syz-executor.0/5606

CPU: 1 PID: 5606 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

dummy_pcm_prepare+0xae/0xc0 sound/drivers/dummy.c:504
snd_pcm_do_prepare+0x6a/0xb0 sound/core/pcm_native.c:1959
snd_pcm_action_single+0x75/0x130 sound/core/pcm_native.c:1281
snd_pcm_action_nonatomic+0x12b/0x160 sound/core/pcm_native.c:1400
snd_pcm_kernel_ioctl+0x264/0x2e0 sound/core/pcm_native.c:3450
snd_pcm_oss_prepare+0x44/0x220 sound/core/oss/pcm_oss.c:1154
snd_pcm_oss_make_ready+0x161/0x1b0 sound/core/oss/pcm_oss.c:1182
snd_pcm_oss_set_trigger.isra.0+0x30f/0x6e0 sound/core/oss/pcm_oss.c:2092
snd_pcm_oss_poll+0x613/0xab0 sound/core/oss/pcm_oss.c:2878

vfs_poll include/linux/poll.h:88 [inline]
io_poll_check_events io_uring/poll.c:279 [inline]
io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327

handle_tw_list+0x253/0x540 io_uring/io_uring.c:1177
tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1235

task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635

arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7faa7168c0c9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007faa72462168 EFLAGS: 00000246
ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007faa717abf80 RCX: 00007faa7168c0c9

RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006

RBP: 00007faa716e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd3b035a6f R14: 00007faa72462300 R15: 0000000000022000
</TASK>

Allocated by task 5606:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52

____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]

dummy_hrtimer_create+0x45/0x190 sound/drivers/dummy.c:456
dummy_pcm_open+0xd4/0x5a0 sound/drivers/dummy.c:556
snd_pcm_open_substream+0xa92/0x1820 sound/core/pcm_native.c:2748
snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2454 [inline]
snd_pcm_oss_open.part.0+0x6dc/0x1330 sound/core/oss/pcm_oss.c:2535

snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499
soundcore_open+0x452/0x620 sound/sound_core.c:593
chrdev_open+0x26a/0x770 fs/char_dev.c:414
do_dentry_open+0x6cc/0x13f0 fs/open.c:883
do_open fs/namei.c:3558 [inline]
path_openat+0x1bc1/0x2b40 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x16d/0x4c0 fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_sys_openat fs/open.c:1343 [inline]
__se_sys_openat fs/open.c:1338 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1338

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 5605:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]

__kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800
dummy_pcm_close+0x93/0xc0 sound/drivers/dummy.c:589
snd_pcm_release_substream.part.0+0x10e/0x330 sound/core/pcm_native.c:2714
snd_pcm_release_substream+0x5b/0x70 sound/core/pcm_native.c:2707
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2413 [inline]
snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline]
snd_pcm_oss_release+0x175/0x300 sound/core/oss/pcm_oss.c:2592

__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179

resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]

exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204

__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff888077855200
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
128-byte region [ffff888077855200, ffff888077855280)

The buggy address belongs to the physical page:

page:ffffea0001de1540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77855

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff8880124418c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5553, tgid 5553 (syz-executor.0), ts 119232426868, free_ts 118550967401

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590

__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_slab_page mm/slub.c:1853 [inline]
allocate_slab+0xa7/0x350 mm/slub.c:1998

new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193

__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
__kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]

__kmalloc_node+0x4d/0xd0 mm/slab_common.c:974
kmalloc_array_node include/linux/slab.h:697 [inline]
kcalloc_node include/linux/slab.h:702 [inline]
memcg_alloc_slab_cgroups+0x8f/0x150 mm/memcontrol.c:2899
memcg_slab_post_alloc_hook+0xa9/0x390 mm/slab.h:546
slab_post_alloc_hook mm/slab.h:777 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]
kmem_cache_alloc+0x1a7/0x320 mm/slub.c:3476
copy_sighand kernel/fork.c:1668 [inline]
copy_process+0x26c4/0x7740 kernel/fork.c:2266
kernel_clone+0xeb/0x9a0 kernel/fork.c:2687
__do_sys_clone+0xba/0x100 kernel/fork.c:2828

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff888077855100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
ffff888077855180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888077855200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888077855280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888077855300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=137d2c5e480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=14260046480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

+ /* if (req_ref_put_and_test(req)) {
+ io_free_req(req);
+ } */

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_fallback_req_func

==================================================================
BUG: KASAN: use-after-free in io_fallback_req_func+0xce/0x2fd io_uring/io_uring.c:251
Read of size 8 at addr ffff88807ed29948 by task kworker/1:4/5593

CPU: 1 PID: 5593 Comm: kworker/1:4 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Workqueue: events io_fallback_req_func

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_fallback_req_func+0xce/0x2fd io_uring/io_uring.c:251
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
process_scheduled_works kernel/workqueue.c:2356 [inline]
worker_thread+0x807/0x1090 kernel/workqueue.c:2445

kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

</TASK>

Allocated by task 5603:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52

__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033

__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3443

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 1170:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]

kmem_cache_free+0xec/0x4e0 mm/slub.c:3809
io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2751
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2981

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88807ed298c0

which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of

224-byte region [ffff88807ed298c0, ffff88807ed299a0)

The buggy address belongs to the physical page:

page:ffffea0001fb4a40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ed29
memcg:ffff8880290cd081

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff8881462e6280 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff8880290cd081

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 89380836523, free_ts 88705663139

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590

alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]

allocate_slab+0x25f/0x350 mm/slub.c:1998

new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193

__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026

__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3443

ffff88807ed29800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88807ed29880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88807ed29900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807ed29980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807ed29a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=172d8f86480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=16fabd5e480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -2728,6 +2742,7 @@ static void io_req_caches_free(struct io
{
int nr = 0;

+ flush_delayed_work(&ctx->fallback_work);
mutex_lock(&ctx->uring_lock);
io_flush_cached_locked_reqs(ctx, &ctx->submit_state);

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING: ODEBUG bug in __io_put_task

IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
------------[ cut here ]------------
ODEBUG: free active (active state 1) object: ffff88802a236ca8 object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 899 at lib/debugobjects.c:509 debug_print_object+0x194/0x2c0 lib/debugobjects.c:509
Modules linked in:
CPU: 0 PID: 899 Comm: kworker/0:2 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: events io_fallback_req_func

RIP: 0010:debug_print_object+0x194/0x2c0 lib/debugobjects.c:509
Code: df 48 89 fe 48 c1 ee 03 80 3c 16 00 0f 85 c7 00 00 00 48 8b 14 dd c0 dc a6 8a 50 4c 89 ee 48 c7 c7 80 d0 a6 8a e8 40 76 ae 05 <0f> 0b 58 83 05 0e 25 66 0a 01 48 83 c4 20 5b 5d 41 5c 41 5d 41 5e
RSP: 0018:ffffc90004aef950 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff88801eba3a80 RSI: ffffffff8166972c RDI: fffff5200095df1c
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8a4dd0a0
R13: ffffffff8aa6d580 R14: ffff888070a92da8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00005639964dc950 CR3: 000000007dcca000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

<TASK>
__debug_check_no_obj_freed lib/debugobjects.c:996 [inline]
debug_check_no_obj_freed+0x305/0x420 lib/debugobjects.c:1027
slab_free_hook mm/slub.c:1756 [inline]
slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1807

slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

put_task_struct_many include/linux/sched/task.h:125 [inline]
__io_put_task+0x155/0x1e0 io_uring/io_uring.c:729
io_put_task io_uring/io_uring.h:328 [inline]
__io_req_complete_post+0x7ec/0xd20 io_uring/io_uring.c:982
io_req_complete_post+0xf1/0x1a0 io_uring/io_uring.c:998
io_req_task_complete+0x189/0x260 io_uring/io_uring.c:1636
io_poll_task_func+0xa95/0x1220 io_uring/poll.c:347
io_fallback_req_func+0xfd/0x204 io_uring/io_uring.c:252

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

</TASK>

Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=17a99c7a480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1145447e480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -975,7 +979,9 @@ static void __io_req_complete_post(struc
*/
io_put_kbuf_comp(req);
io_dismantle_req(req);
- io_put_task(req->task, 1);
+ // io_put_task(req->task, 1);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_req_caches_free

==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2750
Read of size 8 at addr ffff88801da98938 by task kworker/u4:3/46

CPU: 1 PID: 46 Comm: kworker/u4:3 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Workqueue: events_unbound io_ring_exit_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]
io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2750
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2982

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>

Allocated by task 5596:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421

__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3444

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 46:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]

slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807

slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1b5/0x1f2 io_uring/io_uring.c:2752
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2982

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88801da988c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 120 bytes inside of
224-byte region [ffff88801da988c0, ffff88801da989a0)

The buggy address belongs to the physical page:

page:ffffea000076a600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1da98
memcg:ffff88801cfa1401

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88801bf2a280 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff88801cfa1401

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5596, tgid 5595 (syz-executor.0), ts 93592785724, free_ts 93586502326

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2421

__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3444

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2637
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302

kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]

slab_alloc_node mm/slub.c:3452 [inline]
slab_alloc mm/slub.c:3460 [inline]
__kmem_cache_alloc_lru mm/slub.c:3467 [inline]

kmem_cache_alloc_lru+0x20e/0x580 mm/slub.c:3483
alloc_inode_sb include/linux/fs.h:2692 [inline]
sock_alloc_inode+0x27/0x1d0 net/socket.c:304
alloc_inode+0x61/0x230 fs/inode.c:260
new_inode_pseudo+0x17/0x80 fs/inode.c:1019
sock_alloc+0x40/0x270 net/socket.c:627
__sock_create+0xbd/0x810 net/socket.c:1479
io_uring_get_file io_uring/io_uring.c:3604 [inline]
io_uring_create io_uring/io_uring.c:3785 [inline]
io_uring_setup.cold+0x1913/0x1d97 io_uring/io_uring.c:3835

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff88801da98800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88801da98880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88801da98900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801da98980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801da98a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1073daa6480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=17832c5e480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -975,7 +975,8 @@ static void __io_req_complete_post(struc

*/
io_put_kbuf_comp(req);
io_dismantle_req(req);
- io_put_task(req->task, 1);

+ if (req->poll_file)
+ fput(req->poll_file);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
ctx->locked_free_nr++;
}

@@ -1099,6 +1100,8 @@ __cold void io_free_req(struct io_kiocb

io_req_put_rsrc(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);

spin_lock(&ctx->completion_lock);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);

@@ -1296,6 +1299,8 @@ void __io_req_task_work_add(struct io_ki

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ if (req->flags & REQ_F_REFCOUNT)
+ req_ref_get(req);
if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

@@ -1458,7 +1463,7 @@ void io_free_batch_list(struct io_ring_c
}
task_refs++;
node = req->comp_list.next;
- io_req_add_to_cache(req, ctx);
+ kmem_cache_free(req_cachep, req);
} while (node);

if (task)
@@ -2140,6 +2145,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,6 +2734,7 @@ static void io_req_caches_free(struct io

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_poll_remove_all_table

==================================================================
BUG: KASAN: use-after-free in io_poll_remove_all_table+0x161/0x2bd io_uring/poll.c:740
Read of size 8 at addr ffff888070848958 by task syz-executor.0/5603

CPU: 0 PID: 5603 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_poll_remove_all_table+0x161/0x2bd io_uring/poll.c:740
io_poll_remove_all+0x2e/0x4b io_uring/poll.c:761
io_ring_ctx_wait_and_kill+0x1a0/0x340 io_uring/io_uring.c:3024
io_uring_release+0x46/0x4a io_uring/io_uring.c:3049

__fput+0x27c/0xa90 fs/file_table.c:321
task_work_run+0x16f/0x270 kernel/task_work.c:179

exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859

arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7efcf9a8c0c9
Code: Unable to access opcode bytes at 0x7efcf9a8c09f.
RSP: 002b:00007efcfa823168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007efcf9babf80 RCX: 00007efcf9a8c0c9

RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006

RBP: 00007efcf9ae7ae9 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffdae1fefdf R14: 00007efcfa823300 R15: 0000000000022000

</TASK>

Allocated by task 5603:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033

__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 5603:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_free_batch_list+0xdc/0x7d0 io_uring/io_uring.c:1466
__io_submit_flush_completions+0x4ea/0x940 io_uring/io_uring.c:1501
io_submit_flush_completions io_uring/io_uring.c:173 [inline]
ctx_flush_and_put+0x13c/0x210 io_uring/io_uring.c:1145
tctx_task_work+0x1af/0x530 io_uring/io_uring.c:1236

task_work_run+0x16f/0x270 kernel/task_work.c:179
get_signal+0x1c7/0x24f0 kernel/signal.c:2635
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff8880708488c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 152 bytes inside of
224-byte region [ffff8880708488c0, ffff8880708489a0)

The buggy address belongs to the physical page:

page:ffffea0001c21200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70848
memcg:ffff888017e79781

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff8881463e0500 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888017e79781

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 91825186400, free_ts 91803934935

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026

__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff888070848800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff888070848880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888070848900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888070848980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888070848a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=15640391480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=175567ba480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -2140,6 +2145,7 @@ static int io_init_req(struct io_ring_ct
req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,7 +2734,9 @@ static void io_req_caches_free(struct io

{
int nr = 0;

+ flush_delayed_work(&ctx->fallback_work);
mutex_lock(&ctx->uring_lock);

+ io_poll_remove_all(ctx, NULL, true);
io_flush_cached_locked_reqs(ctx, &ctx->submit_state);

while (!io_req_cache_empty(ctx)) {
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_req_caches_free

==================================================================

BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]

BUG: KASAN: use-after-free in io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2743
Read of size 8 at addr ffff88802848f938 by task kworker/u4:2/29

CPU: 0 PID: 29 Comm: kworker/u4:2 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022

Workqueue: events_unbound io_ring_exit_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]

io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2743
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2975

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

</TASK>

Allocated by task 5603:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413

__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3437

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 29:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2745
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2975

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88802848f8c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 120 bytes inside of
224-byte region [ffff88802848f8c0, ffff88802848f9a0)

The buggy address belongs to the physical page:

page:ffffea0000a123c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2848f
memcg:ffff888028e66b81

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88801bcba780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888028e66b81

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 86682323238, free_ts 86643623166

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2413

__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3437

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page+0x1d/0x490 mm/page_alloc.c:3482

qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302

kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]

slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x17c/0x330 mm/slub.c:3491

__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc_node+0x4d/0xd0 mm/slab_common.c:974

kmalloc_node include/linux/slab.h:610 [inline]
kvmalloc_node+0xa2/0x1a0 mm/util.c:603
kvmalloc include/linux/slab.h:737 [inline]
seq_buf_alloc fs/seq_file.c:38 [inline]
seq_read_iter+0x7fb/0x1280 fs/seq_file.c:210
kernfs_fop_read_iter+0x4ce/0x690 fs/kernfs/file.c:279
call_read_iter include/linux/fs.h:1846 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x681/0x930 fs/read_write.c:470
ksys_read+0x12b/0x250 fs/read_write.c:613

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff88802848f800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88802848f880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88802848f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802848f980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802848fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=17950e0e480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=15cf6919480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -1428,8 +1433,10 @@ void io_free_batch_list(struct io_ring_c
if (unlikely(req->flags & IO_REQ_CLEAN_SLOW_FLAGS)) {
if (req->flags & REQ_F_REFCOUNT) {
node = req->comp_list.next;
- if (!req_ref_put_and_test(req))
+ if (!req_ref_put_and_test(req)) {
+ req->comp_list.next = NULL;
continue;
+ }
}
if ((req->flags & REQ_F_POLLED) && req->apoll) {
struct async_poll *apoll = req->apoll;
@@ -2140,6 +2147,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,7 +2736,9 @@ static void io_req_caches_free(struct io

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_fallback_tw

==================================================================
BUG: KASAN: use-after-free in io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1252
Read of size 8 at addr ffff888070672948 by task syz-executor.0/5596

CPU: 0 PID: 5596 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_fallback_tw+0x6d/0x119 io_uring/io_uring.c:1252
tctx_task_work.cold+0xf/0x2c io_uring/io_uring.c:1222

task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7fee6588c0c9
Code: Unable to access opcode bytes at 0x7fee6588c09f.
RSP: 002b:00007fee66584168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007fee659abf80 RCX: 00007fee6588c0c9

RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006

RBP: 00007fee658e7ae9 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fff6c752b9f R14: 00007fee66584300 R15: 0000000000022000
</TASK>

Allocated by task 5596:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 2864:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2747
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2977

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff8880706728c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 136 bytes inside of
224-byte region [ffff8880706728c0, ffff8880706729a0)

The buggy address belongs to the physical page:

page:ffffea0001c19c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70672
memcg:ffff888029e25881

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88801bf30780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888029e25881

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5596, tgid 5595 (syz-executor.0), ts 114425164040, free_ts 101753733828

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x17c/0x330 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:966 [inline]

__kmalloc+0x4a/0xd0 mm/slab_common.c:980
kmalloc include/linux/slab.h:584 [inline]
tomoyo_realpath_from_path+0xc3/0x600 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x217/0x570 security/tomoyo/file.c:723
security_file_ioctl+0x54/0xb0 security/security.c:1624
__do_sys_ioctl fs/ioctl.c:864 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0xb7/0x210 fs/ioctl.c:856

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff888070672800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888070672880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888070672900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888070672980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888070672a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1189dc39480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1004dc7e480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -1301,8 +1304,6 @@ void __io_req_task_work_add(struct io_ki

if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method)))
return;
-
- io_fallback_tw(tctx);
}

static void __cold io_move_task_work_from_local(struct io_ring_ctx *ctx)
@@ -2140,6 +2141,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,7 +2730,9 @@ static void io_req_caches_free(struct io

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in tctx_task_work

==================================================================
BUG: KASAN: use-after-free in io_fallback_tw io_uring/io_uring.c:1252 [inline]
BUG: KASAN: use-after-free in tctx_task_work.cold+0x10a/0x11d io_uring/io_uring.c:1222
Read of size 8 at addr ffff888024f00948 by task syz-executor.0/5598

CPU: 1 PID: 5598 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_fallback_tw io_uring/io_uring.c:1252 [inline]
tctx_task_work.cold+0x10a/0x11d io_uring/io_uring.c:1222

task_work_run+0x16f/0x270 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0xb17/0x2a90 kernel/exit.c:867
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
get_signal+0x225f/0x24f0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7ff84e88c0c9
Code: Unable to access opcode bytes at 0x7ff84e88c09f.
RSP: 002b:00007ff84f57d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007ff84e9abf80 RCX: 00007ff84e88c0c9

RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006

RBP: 00007ff84e8e7ae9 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffd739e0c8f R14: 00007ff84f57d300 R15: 0000000000022000
</TASK>

Allocated by task 5598:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2409
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3433

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 9:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2741
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2971

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff888024f008c0

which belongs to the cache io_kiocb of size 224
The buggy address is located 136 bytes inside of

224-byte region [ffff888024f008c0, ffff888024f009a0)

The buggy address belongs to the physical page:

page:ffffea000093c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24f00
memcg:ffff88801264c781

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88814614c640 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88801264c781

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5598, tgid 5597 (syz-executor.0), ts 86881423641, free_ts 86232019510

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2409
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3433

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff888024f00800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888024f00880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888024f00900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888024f00980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888024f00a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11d23496480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=11b23c41480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -1292,6 +1295,8 @@ void __io_req_task_work_add(struct io_ki
return;
}

+ if (!(req->flags & REQ_F_REFCOUNT))
+ return;
/* task_work already pending, we're done */

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

@@ -2140,6 +2145,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,7 +2734,9 @@ static void io_req_caches_free(struct io

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING in io_ring_exit_work

------------[ cut here ]------------
WARNING: CPU: 1 PID: 75 at io_uring/io_uring.c:2977 io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Modules linked in:
CPU: 0 PID: 75 Comm: kworker/u4:4 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023

Workqueue: events_unbound io_ring_exit_work
RIP: 0010:io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Code: 40 8c e8 57 f4 02 f8 48 8b 05 f0 59 74 02 31 ff 4c 8b 74 24 10 49 29 c6 4c 89 f6 e8 8e 21 b5 f7 4d 85 f6 79 10 e8 b4 24 b5 f7 <0f> 0b 48 c7 44 24 08 70 17 00 00 e8 a4 24 b5 f7 48 8b 74 24 08 48
RSP: 0018:ffffc900020afbd0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807e004838 RCX: 0000000000000000
RDX: ffff888018ca57c0 RSI: ffffffff89cc982c RDI: 0000000000000007
RBP: ffff88807e004000 R08: 0000000000000007 R09: 0000000000000000
R10: fffffffffffffff9 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88807e004040 R14: fffffffffffffff9 R15: ffff88807e0043c8
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055a8f42b70c0 CR3: 000000000c571000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

</TASK>


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=111bfc46480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=111aca96480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800

> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next

@@ -1296,6 +1299,8 @@ void __io_req_task_work_add(struct io_ki

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ if (!(req->flags & REQ_F_REFCOUNT))
+ return;

if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in io_ring_exit_work

------------[ cut here ]------------

WARNING: CPU: 0 PID: 11 at io_uring/io_uring.c:2977 io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Modules linked in:
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
RIP: 0010:io_ring_exit_work+0x320/0xc80 io_uring/io_uring.c:2977
Code: 40 8c e8 57 f4 02 f8 48 8b 05 f0 59 74 02 31 ff 4c 8b 74 24 10 49 29 c6 4c 89 f6 e8 8e 21 b5 f7 4d 85 f6 79 10 e8 b4 24 b5 f7 <0f> 0b 48 c7 44 24 08 70 17 00 00 e8 a4 24 b5 f7 48 8b 74 24 08 48

RSP: 0018:ffffc90000107bd0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807969a838 RCX: 0000000000000000
RDX: ffff88813fe4ba80 RSI: ffffffff89cc982c RDI: 0000000000000007
RBP: ffff88807969a000 R08: 0000000000000007 R09: 0000000000000000
R10: fffffffffffffffe R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88807969a040 R14: fffffffffffffffe R15: ffff88807969a3c8
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00005555568ee708 CR3: 0000000029c9e000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=118c8241480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=15607d19480000

[Hillf Danton]

@@ -1296,12 +1299,16 @@ void __io_req_task_work_add(struct io_ki

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ if (!(req->flags & REQ_F_REFCOUNT))

+ goto out;
+

if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method)))
return;

+out:
io_fallback_tw(tctx);
}

@@ -2140,6 +2147,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,7 +2736,9 @@ static void io_req_caches_free(struct io

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_req_caches_free

==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2745
Read of size 8 at addr ffff8880711c7938 by task kworker/u4:5/1184

CPU: 1 PID: 1184 Comm: kworker/u4:5 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]

io_req_caches_free+0x1a8/0x201 io_uring/io_uring.c:2745
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2977

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>

Allocated by task 5597:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 1184:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1c4/0x201 io_uring/io_uring.c:2747
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2977

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff8880711c78c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 120 bytes inside of
224-byte region [ffff8880711c78c0, ffff8880711c79a0)

The buggy address belongs to the physical page:

page:ffffea0001c471c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x711c7
memcg:ffff88802b0a9f01

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88801c3f03c0 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff88802b0a9f01

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5597, tgid 5596 (syz-executor.0), ts 92319099413, free_ts 80415300921

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3439

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__folio_put_small mm/swap.c:106 [inline]
__folio_put+0xc5/0x140 mm/swap.c:129
folio_put include/linux/mm.h:1203 [inline]
put_page include/linux/mm.h:1272 [inline]
anon_pipe_buf_release+0x3fb/0x4c0 fs/pipe.c:138
pipe_buf_release include/linux/pipe_fs_i.h:183 [inline]
pipe_read+0x614/0x1110 fs/pipe.c:324

call_read_iter include/linux/fs.h:1846 [inline]
new_sync_read fs/read_write.c:389 [inline]

vfs_read+0x7fa/0x930 fs/read_write.c:470
ksys_read+0x1ec/0x250 fs/read_write.c:613

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff8880711c7800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff8880711c7880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff8880711c7900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880711c7980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880711c7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11b06c96480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1056f519480000

[Hillf Danton]

@@ -1296,12 +1299,15 @@ void __io_req_task_work_add(struct io_ki

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ if (!(req->flags & REQ_F_REFCOUNT))
+ goto out;
+
if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method)))
return;

-
+out:
io_fallback_tw(tctx);
}

@@ -2140,6 +2146,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_fallback_req_func

==================================================================
BUG: KASAN: use-after-free in io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:251
Read of size 8 at addr ffff888070652948 by task kworker/0:4/5090

CPU: 0 PID: 5090 Comm: kworker/0:4 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023

Workqueue: events io_fallback_req_func

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:251

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>

Allocated by task 5603:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2414
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 9:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2744
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2974

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff8880706528c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 136 bytes inside of
224-byte region [ffff8880706528c0, ffff8880706529a0)

The buggy address belongs to the physical page:

page:ffffea0001c19480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70652
memcg:ffff888026aa6301

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff888146499780 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888026aa6301

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 88591275349, free_ts 64543666654

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2414
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3436

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]

__free_pages_ok+0x6ac/0xdc0 mm/page_alloc.c:1707
kvfree+0x46/0x50 mm/util.c:649
wg_destruct+0x2f4/0x400 drivers/net/wireguard/device.c:265
netdev_run_todo+0x6bf/0x1100 net/core/dev.c:10352
default_device_exit_batch+0x456/0x590 net/core/dev.c:11349
ops_exit_list+0x125/0x170 net/core/net_namespace.c:174
cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:606

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

Memory state around the buggy address:

ffff888070652800: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888070652880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888070652900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888070652980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888070652a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=151c52a9480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=14f99661480000

[Hillf Danton]

@@ -1421,16 +1427,17 @@ void io_free_batch_list(struct io_ring_c
struct task_struct *task = NULL;
int task_refs = 0;

- do {
- struct io_kiocb *req = container_of(node, struct io_kiocb,
- comp_list);
+ while (node) {
+ struct io_kiocb *req = container_of(node, struct io_kiocb, comp_list);
+ int put = 0;
+
+ node = req->comp_list.next;

if (unlikely(req->flags & IO_REQ_CLEAN_SLOW_FLAGS)) {

- if (req->flags & REQ_F_REFCOUNT) {
- node = req->comp_list.next;
- if (!req_ref_put_and_test(req))
- continue;
- }
+ put = 1;
+ if (!req_ref_put_and_test(req))
+ continue;

+
if ((req->flags & REQ_F_POLLED) && req->apoll) {
struct async_poll *apoll = req->apoll;

@@ -1457,9 +1464,9 @@ void io_free_batch_list(struct io_ring_c
task_refs = 0;
}
task_refs++;
- node = req->comp_list.next;
- io_req_add_to_cache(req, ctx);
- } while (node);
+ if (put == 0 && req_ref_put_and_test(req))
+ io_req_add_to_cache(req, ctx);
+ }

if (task)
io_put_task(task, task_refs);
@@ -2140,6 +2147,7 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
req->rsrc_node = NULL;
req->task = current;

@@ -2728,6 +2736,7 @@ static void io_req_caches_free(struct io

{
int nr = 0;

+ flush_delayed_work(&ctx->fallback_work);
mutex_lock(&ctx->uring_lock);

io_flush_cached_locked_reqs(ctx, &ctx->submit_state);

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_req_caches_free

==================================================================

BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]
BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:356 [inline]

BUG: KASAN: use-after-free in io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2744
Read of size 8 at addr ffff88802990f938 by task kworker/u4:0/9

CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023

Workqueue: events_unbound io_ring_exit_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

wq_stack_extract io_uring/slist.h:126 [inline]
io_alloc_req io_uring/io_uring.h:356 [inline]

io_req_caches_free+0x199/0x1f2 io_uring/io_uring.c:2744
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2976

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>

Allocated by task 5595:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3438

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 9:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x1b5/0x1f2 io_uring/io_uring.c:2746
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2976

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88802990f8c0

which belongs to the cache io_kiocb of size 224

The buggy address is located 120 bytes inside of
224-byte region [ffff88802990f8c0, ffff88802990f9a0)

The buggy address belongs to the physical page:

page:ffffea0000a643c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2990f
memcg:ffff888021c15d01

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88801c3adc80 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888021c15d01

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5595, tgid 5594 (syz-executor.0), ts 89945650593, free_ts 79190938979

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026
__io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1063
io_alloc_req_refill io_uring/io_uring.h:348 [inline]

io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2415
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3438

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]

free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x490 mm/page_alloc.c:3482
__folio_put_small mm/swap.c:106 [inline]
__folio_put+0xc5/0x140 mm/swap.c:129
folio_put include/linux/mm.h:1203 [inline]
put_page include/linux/mm.h:1272 [inline]
anon_pipe_buf_release+0x3fb/0x4c0 fs/pipe.c:138
pipe_buf_release include/linux/pipe_fs_i.h:183 [inline]
pipe_read+0x614/0x1110 fs/pipe.c:324
call_read_iter include/linux/fs.h:1846 [inline]
new_sync_read fs/read_write.c:389 [inline]
vfs_read+0x7fa/0x930 fs/read_write.c:470
ksys_read+0x1ec/0x250 fs/read_write.c:613

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff88802990f800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88802990f880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88802990f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802990f980: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802990fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11ac82b6480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=136278a9480000

[Hillf Danton]

On 12 Jan 2023 23:30:48 -0800
> syzbot found the following issue on:
>
> HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112
> git tree: linux-next
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000

Bump req->file up to make vfs_poll() safe.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 0a093b2893c7

--- x/io_uring/poll.c
+++ y/io_uring/poll.c
@@ -714,6 +714,8 @@ int io_arm_poll_handler(struct io_kiocb

io_kbuf_recycle(req, issue_flags);

+ get_file(req->file);
+ req->poll_file = req->file;
ret = __io_arm_poll_handler(req, &apoll->poll, &ipt, mask, issue_flags);
if (ret)
return ret > 0 ? IO_APOLL_READY : IO_APOLL_ABORTED;
@@ -943,6 +945,8 @@ int io_poll_add(struct io_kiocb *req, un
if (req->ctx->flags & (IORING_SETUP_SQPOLL|IORING_SETUP_SINGLE_ISSUER))
req->flags |= REQ_F_HASH_LOCKED;

+ get_file(req->file);
+ req->poll_file = req->file;
ret = __io_arm_poll_handler(req, poll, &ipt, poll->events, issue_flags);
if (ret > 0) {
io_req_set_res(req, ipt.result_mask, 0);

--- x/include/linux/io_uring_types.h
+++ y/include/linux/io_uring_types.h
@@ -578,6 +578,8 @@ struct io_kiocb {

struct io_kiocb *link;
/* custom credentials, valid IFF REQ_F_CREDS is set */
const struct cred *creds;
+ struct file *poll_file;

+ int in_free_cache;
struct io_wq_work work;
};

--- x/io_uring/io_uring.h
+++ y/io_uring/io_uring.h
@@ -352,9 +352,13 @@ static inline bool io_alloc_req_refill(s
static inline struct io_kiocb *io_alloc_req(struct io_ring_ctx *ctx)
{
struct io_wq_work_node *node;
+ struct io_kiocb *req;

node = wq_stack_extract(&ctx->submit_state.free_list);
- return container_of(node, struct io_kiocb, comp_list);
+ req = container_of(node, struct io_kiocb, comp_list);
+ BUG_ON(req->in_free_cache == 0);
+ req->in_free_cache = 0;
+ return req;
}

static inline bool io_allowed_defer_tw_run(struct io_ring_ctx *ctx)
--- x/io_uring/io_uring.c
+++ y/io_uring/io_uring.c
@@ -229,6 +229,8 @@ static inline void req_fail_link_node(st

static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx)
{
+ BUG_ON(req->in_free_cache != 0);
+ req->in_free_cache = 1;
wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list);
}

@@ -975,7 +977,8 @@ static void __io_req_complete_post(struc

*/
io_put_kbuf_comp(req);
io_dismantle_req(req);
- io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
ctx->locked_free_nr++;
}

@@ -1024,6 +1027,7 @@ static void io_preinit_req(struct io_kio
req->async_data = NULL;
/* not necessary, but safer to zero */
req->cqe.res = 0;
+ req->in_free_cache = 0;
}

static void io_flush_cached_locked_reqs(struct io_ring_ctx *ctx,
@@ -1099,6 +1103,8 @@ __cold void io_free_req(struct io_kiocb

io_req_put_rsrc(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);

spin_lock(&ctx->completion_lock);
wq_list_add_head(&req->comp_list, &ctx->locked_free_list);

@@ -1296,12 +1302,15 @@ void __io_req_task_work_add(struct io_ki

if (!llist_add(&req->io_task_work.node, &tctx->task_list))
return;

+ if (!(req->flags & REQ_F_REFCOUNT))
+ goto out;
+
if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method)))
return;
-
+out:
io_fallback_tw(tctx);
}

@@ -1421,16 +1430,17 @@ void io_free_batch_list(struct io_ring_c

struct task_struct *task = NULL;
int task_refs = 0;

- do {
- struct io_kiocb *req = container_of(node, struct io_kiocb,
- comp_list);
+ while (node) {
+ struct io_kiocb *req = container_of(node, struct io_kiocb, comp_list);
+ int put = 0;
+
+ node = req->comp_list.next;

if (unlikely(req->flags & IO_REQ_CLEAN_SLOW_FLAGS)) {
- if (req->flags & REQ_F_REFCOUNT) {
- node = req->comp_list.next;
- if (!req_ref_put_and_test(req))
- continue;
- }
+ put = 1;
+ if (!req_ref_put_and_test(req))
+ continue;
+
if ((req->flags & REQ_F_POLLED) && req->apoll) {
struct async_poll *apoll = req->apoll;

@@ -1457,9 +1467,9 @@ void io_free_batch_list(struct io_ring_c

task_refs = 0;
}
task_refs++;
- node = req->comp_list.next;
- io_req_add_to_cache(req, ctx);
- } while (node);
+ if (put == 0 && req_ref_put_and_test(req))
+ io_req_add_to_cache(req, ctx);
+ }

if (task)
io_put_task(task, task_refs);

@@ -2140,6 +2150,8 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;

+ // req->in_free_cache = 0;

req->rsrc_node = NULL;
req->task = current;

@@ -2728,6 +2740,7 @@ static void io_req_caches_free(struct io

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in io_req_caches_free

==================================================================
BUG: KASAN: use-after-free in wq_stack_extract io_uring/slist.h:126 [inline]

BUG: KASAN: use-after-free in io_alloc_req io_uring/io_uring.h:357 [inline]
BUG: KASAN: use-after-free in io_req_caches_free+0x1a2/0x254 io_uring/io_uring.c:2748
Read of size 8 at addr ffff88801c8dc938 by task kworker/u4:2/41

CPU: 1 PID: 41 Comm: kworker/u4:2 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: events_unbound io_ring_exit_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517
wq_stack_extract io_uring/slist.h:126 [inline]

io_alloc_req io_uring/io_uring.h:357 [inline]
io_req_caches_free+0x1a2/0x254 io_uring/io_uring.c:2748
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2980

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>

Allocated by task 5602:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033

__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1066
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2419
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 41:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x20f/0x254 io_uring/io_uring.c:2750
io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2980

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff88801c8dc8c0
which belongs to the cache io_kiocb of size 232

The buggy address is located 120 bytes inside of

232-byte region [ffff88801c8dc8c0, ffff88801c8dc9a8)

The buggy address belongs to the physical page:

page:ffffea0000723700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c8dc
memcg:ffff888021840981

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff88801bf2ba00 dead000000000122 0000000000000000
raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888021840981

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5602, tgid 5601 (syz-executor.0), ts 88366341970, free_ts 87676511455

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026

__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1066
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2419
__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]

free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234

exec_mmap fs/exec.c:1034 [inline]
begin_new_exec+0x1027/0x2f80 fs/exec.c:1293
load_elf_binary+0x801/0x4ff0 fs/binfmt_elf.c:1001
search_binary_handler fs/exec.c:1736 [inline]
exec_binprm fs/exec.c:1778 [inline]
bprm_execve fs/exec.c:1853 [inline]
bprm_execve+0x7fd/0x1ae0 fs/exec.c:1809
do_execveat_common+0x72c/0x880 fs/exec.c:1960
do_execve fs/exec.c:2034 [inline]
__do_sys_execve fs/exec.c:2110 [inline]
__se_sys_execve fs/exec.c:2105 [inline]
__x64_sys_execve+0x93/0xc0 fs/exec.c:2105

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff88801c8dc800: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
ffff88801c8dc880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88801c8dc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801c8dc980: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff88801c8dca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=110560fa480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1259a9b1480000

[Hillf Danton]

@@ -975,7 +977,10 @@ static void __io_req_complete_post(struc

*/
io_put_kbuf_comp(req);
io_dismantle_req(req);
- io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);

+ BUG_ON(req->in_free_cache != 0);
+ req->in_free_cache = 1;

wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
ctx->locked_free_nr++;
}

@@ -1024,6 +1029,7 @@ static void io_preinit_req(struct io_kio

req->async_data = NULL;
/* not necessary, but safer to zero */
req->cqe.res = 0;
+ req->in_free_cache = 0;
}

static void io_flush_cached_locked_reqs(struct io_ring_ctx *ctx,

@@ -1099,8 +1105,12 @@ __cold void io_free_req(struct io_kiocb

io_req_put_rsrc(req);
io_dismantle_req(req);
io_put_task(req->task, 1);
+ if (req->poll_file)
+ fput(req->poll_file);

spin_lock(&ctx->completion_lock);

+ BUG_ON(req->in_free_cache != 0);
+ req->in_free_cache = 1;

wq_list_add_head(&req->comp_list, &ctx->locked_free_list);
ctx->locked_free_nr++;

spin_unlock(&ctx->completion_lock);
@@ -1421,16 +1431,17 @@ void io_free_batch_list(struct io_ring_c

struct task_struct *task = NULL;
int task_refs = 0;

- do {
- struct io_kiocb *req = container_of(node, struct io_kiocb,
- comp_list);
+ while (node) {
+ struct io_kiocb *req = container_of(node, struct io_kiocb, comp_list);
+ int put = 0;
+
+ node = req->comp_list.next;

if (unlikely(req->flags & IO_REQ_CLEAN_SLOW_FLAGS)) {
- if (req->flags & REQ_F_REFCOUNT) {
- node = req->comp_list.next;
- if (!req_ref_put_and_test(req))
- continue;
- }
+ put = 1;
+ if (!req_ref_put_and_test(req))
+ continue;
+
if ((req->flags & REQ_F_POLLED) && req->apoll) {
struct async_poll *apoll = req->apoll;

@@ -1457,9 +1468,9 @@ void io_free_batch_list(struct io_ring_c

task_refs = 0;
}
task_refs++;
- node = req->comp_list.next;
- io_req_add_to_cache(req, ctx);
- } while (node);

+ if (put || req_ref_put_and_test(req))

+ io_req_add_to_cache(req, ctx);
+ }

if (task)
io_put_task(task, task_refs);

@@ -2140,6 +2151,8 @@ static int io_init_req(struct io_ring_ct

req->flags = sqe_flags = READ_ONCE(sqe->flags);
req->cqe.user_data = READ_ONCE(sqe->user_data);
req->file = NULL;
+ req->poll_file = NULL;
+ // req->in_free_cache = 0;
req->rsrc_node = NULL;
req->task = current;

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in io_fallback_req_func

==================================================================
BUG: KASAN: use-after-free in io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:253
Read of size 8 at addr ffff8880271e8948 by task kworker/0:5/5578

CPU: 0 PID: 5578 Comm: kworker/0:5 Not tainted 6.2.0-rc3-next-20230112-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023

Workqueue: events io_fallback_req_func

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:417
kasan_report+0xc0/0xf0 mm/kasan/report.c:517

io_fallback_req_func+0xc7/0x204 io_uring/io_uring.c:253

process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>

Allocated by task 5603:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook mm/slab.h:769 [inline]
kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033

__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2420

__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 2822:

kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0xec/0x4e0 mm/slub.c:3809

io_req_caches_free+0x203/0x248 io_uring/io_uring.c:2750

io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2980
process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
worker_thread+0x669/0x1090 kernel/workqueue.c:2440
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

The buggy address belongs to the object at ffff8880271e88c0

which belongs to the cache io_kiocb of size 232

The buggy address is located 136 bytes inside of
232-byte region [ffff8880271e88c0, ffff8880271e89a8)

The buggy address belongs to the physical page:

page:ffffea00009c7a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x271e8
memcg:ffff888017b98f01

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffff888146255140 dead000000000122 0000000000000000
raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888017b98f01

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5603, tgid 5602 (syz-executor.0), ts 91755579199, free_ts 91135623998

prep_new_page mm/page_alloc.c:2549 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281
alloc_slab_page mm/slub.c:1851 [inline]
allocate_slab+0x25f/0x350 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3193
__kmem_cache_alloc_bulk mm/slub.c:3951 [inline]
kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026

__io_alloc_req_refill+0xcc/0x434 io_uring/io_uring.c:1068
io_alloc_req_refill io_uring/io_uring.h:348 [inline]
io_submit_sqes.cold+0xd/0xc2 io_uring/io_uring.c:2420

__do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3442
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1451 [inline]
free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3528
release_pages+0xcb1/0x1330 mm/swap.c:1072
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x202/0x7c0 mm/mmap.c:3100
__mmput+0x128/0x4c0 kernel/fork.c:1212
mmput+0x60/0x70 kernel/fork.c:1234

exit_mm kernel/exit.c:563 [inline]
do_exit+0x9ac/0x2a90 kernel/exit.c:854
do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
__do_sys_exit_group kernel/exit.c:1023 [inline]
__se_sys_exit_group kernel/exit.c:1021 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1021

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:

ffff8880271e8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
ffff8880271e8880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff8880271e8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880271e8980: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
ffff8880271e8a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 0a093b28 Add linux-next specific files for 20230112
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

console output: https://syzkaller.appspot.com/x/log.txt?x=11ffb3b3480000

kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5
dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=15114c2e480000

[Hillf Danton]

On Wed, 01 Feb 2023 08:41:20 -0800

> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: use-after-free Read in io_fallback_req_func

See if it is an issue only in the next tree.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+e29d28...@syzkaller.appspotmail.com

Tested on:

commit: 9f266cca Merge tag 'for_linus' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1288afb3480000
kernel config: https://syzkaller.appspot.com/x/.config?x=94f93727847d4d81

dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.