From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+81b3883093f772addf6d@syzkaller.appspotmail.com,
Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 5.8 01/85] io_uring: always delete double poll wait entry on match
Date: Mon, 5 Oct 2020 17:25:57 +0200 [thread overview]
Message-ID: <20201005142114.805252222@linuxfoundation.org> (raw)
In-Reply-To: <20201005142114.732094228@linuxfoundation.org>
From: Jens Axboe <axboe@kernel.dk>
commit 8706e04ed7d6c95004d42b22a4db97d5b2eb73b2 upstream.
syzbot reports a crash with tty polling, which is using the double poll
handling:
general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
CPU: 0 PID: 6874 Comm: syz-executor749 Not tainted 5.9.0-rc6-next-20200924-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:io_poll_get_single fs/io_uring.c:4778 [inline]
RIP: 0010:io_poll_double_wake+0x51/0x510 fs/io_uring.c:4845
Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9e 03 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5d 08 48 8d 7b 48 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 63 03 00 00 0f b6 6b 48 bf 06 00 00
RSP: 0018:ffffc90001c1fb70 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000004
RDX: 0000000000000009 RSI: ffffffff81d9b3ad RDI: 0000000000000048
RBP: dffffc0000000000 R08: ffff8880a3cac798 R09: ffffc90001c1fc60
R10: fffff52000383f73 R11: 0000000000000000 R12: 0000000000000004
R13: ffff8880a3cac798 R14: ffff8880a3cac7a0 R15: 0000000000000004
FS: 0000000001f98880(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f18886916c0 CR3: 0000000094c5a000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__wake_up_common+0x147/0x650 kernel/sched/wait.c:93
__wake_up_common_lock+0xd0/0x130 kernel/sched/wait.c:123
tty_ldisc_hangup+0x1cf/0x680 drivers/tty/tty_ldisc.c:735
__tty_hangup.part.0+0x403/0x870 drivers/tty/tty_io.c:625
__tty_hangup drivers/tty/tty_io.c:575 [inline]
tty_vhangup+0x1d/0x30 drivers/tty/tty_io.c:698
pty_close+0x3f5/0x550 drivers/tty/pty.c:79
tty_release+0x455/0xf60 drivers/tty/tty_io.c:1679
__fput+0x285/0x920 fs/file_table.c:281
task_work_run+0xdd/0x190 kernel/task_work.c:141
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_user_mode_loop kernel/entry/common.c:165 [inline]
exit_to_user_mode_prepare+0x1e2/0x1f0 kernel/entry/common.c:192
syscall_exit_to_user_mode+0x7a/0x2c0 kernel/entry/common.c:267
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x401210
which is due to a failure in removing the double poll wait entry if we
hit a wakeup match. This can cause multiple invocations of the wakeup,
which isn't safe.
Cc: stable@vger.kernel.org # v5.8
Reported-by: syzbot+81b3883093f772addf6d@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/io_uring.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4310,6 +4310,8 @@ static int io_poll_double_wake(struct wa
if (mask && !(mask & poll->events))
return 0;
+ list_del_init(&wait->entry);
+
if (poll && poll->head) {
bool done;
next prev parent reply other threads:[~2020-10-05 15:38 UTC|newest]
Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-05 15:25 [PATCH 5.8 00/85] 5.8.14-rc1 review Greg Kroah-Hartman
2020-10-05 15:25 ` Greg Kroah-Hartman [this message]
2020-10-05 15:25 ` [PATCH 5.8 02/85] btrfs: fix filesystem corruption after a device replace Greg Kroah-Hartman
2020-10-05 15:25 ` [PATCH 5.8 03/85] mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 04/85] USB: gadget: f_ncm: Fix NDP16 datagram validation Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 05/85] Revert "usbip: Implement a match function to fix usbip" Greg Kroah-Hartman
2020-10-06 13:26 ` M. Vefa Bicakci
2020-10-07 9:13 ` Greg Kroah-Hartman
2020-10-08 8:56 ` M. Vefa Bicakci
2020-10-08 9:25 ` Greg Kroah-Hartman
2020-10-08 9:37 ` M. Vefa Bicakci
2020-10-05 15:26 ` [PATCH 5.8 06/85] usbcore/driver: Fix specific driver selection Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 07/85] usbcore/driver: Fix incorrect downcast Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 08/85] usbcore/driver: Accommodate usbip Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 09/85] gpio: siox: explicitly support only threaded irqs Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 10/85] gpio: mockup: fix resource leak in error path Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 11/85] gpio: tc35894: fix up tc35894 interrupt configuration Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 12/85] gpio: amd-fch: correct logic of GPIO_LINE_DIRECTION Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 13/85] clk: samsung: Keep top BPLL mux on Exynos542x enabled Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 14/85] clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 15/85] scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling getpeername() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 16/85] i2c: i801: Exclude device from suspend direct complete optimization Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 17/85] Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 18/85] iio: adc: qcom-spmi-adc5: fix driver name Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 19/85] ftrace: Move RCU is watching check after recursion check Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 20/85] tracing: Fix trace_find_next_entry() accounting of temp buffer size Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 21/85] memstick: Skip allocating card when removing host Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 22/85] drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 23/85] xen/events: dont use chip_data for legacy IRQs Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 24/85] clocksource/drivers/timer-gx6605s: Fixup counter reload Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 25/85] vboxsf: Fix the check for the old binary mount-arguments struct Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 26/85] mt76: mt7915: use ieee80211_free_txskb to free tx skbs Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 27/85] libbpf: Remove arch-specific include path in Makefile Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 28/85] drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 29/85] Revert "wlcore: Adding suppoprt for IGTK key in wlcore driver" Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 30/85] drm/sun4i: mixer: Extend regmap max_register Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 31/85] hv_netvsc: Cache the current data path to avoid duplicate call and message Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 32/85] net: dec: de2104x: Increase receive ring size for Tulip Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 33/85] rndis_host: increase sleep time in the query-response loop Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 34/85] nvme-pci: disable the write zeros command for Intel 600P/P3100 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 35/85] nvme-core: get/put ctrl and transport module in nvme_dev_open/release() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 36/85] fuse: fix the ->direct_IO() treatment of iov_iter Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 37/85] drivers/net/wan/lapbether: Make skb->protocol consistent with the header Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 38/85] drivers/net/wan/hdlc: Set skb->protocol before transmitting Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 39/85] mac80211: Fix radiotap header channel flag for 6GHz band Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 40/85] mac80211: do not allow bigger VHT MPDUs than the hardware supports Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 41/85] tracing: Make the space reserved for the pid wider Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 42/85] tools/io_uring: fix compile breakage Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 43/85] io_uring: mark statx/files_update/epoll_ctl as non-SQPOLL Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 44/85] cpuidle: psci: Fix suspicious RCU usage Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 45/85] spi: fsl-espi: Only process interrupts for expected events Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 46/85] net: dsa: felix: fix some key offsets for IP4_TCP_UDP VCAP IS2 entries Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 47/85] nvme-pci: fix NULL req in completion handler Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 48/85] nvme-fc: fail new connections to a deleted host or remote port Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 49/85] scripts/kallsyms: skip ppc compiler stub *.long_branch.* / *.plt_branch.* Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 50/85] gpio: sprd: Clear interrupt when setting the type as edge Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 51/85] phy: ti: am654: Fix a leak in serdes_am654_probe() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 52/85] pinctrl: mvebu: Fix i2c sda definition for 98DX3236 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 53/85] nfs: Fix security label length not being reset Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 54/85] NFSv4.2: fix clients attribute cache management for copy_file_range Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 55/85] pNFS/flexfiles: Ensure we initialise the mirror bsizes correctly on read Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 56/85] clk: tegra: Always program PLL_E when enabled Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 57/85] clk: tegra: Fix missing prototype for tegra210_clk_register_emc() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 58/85] dmaengine: dmatest: Prevent to run on misconfigured channel Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 59/85] clk: samsung: exynos4: mark chipid clock as CLK_IGNORE_UNUSED Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 60/85] scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 61/85] iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 62/85] gpio: pca953x: Fix uninitialized pending variable Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.8 63/85] gpio/aspeed-sgpio: enable access to all 80 input & output sgpios Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 64/85] gpio/aspeed-sgpio: dont enable all interrupts by default Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 65/85] gpio: aspeed: fix ast2600 bank properties Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 66/85] i2c: cpm: Fix i2c_ram structure Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 67/85] i2c: npcm7xx: Clear LAST bit after a failed transaction Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 68/85] Input: trackpoint - enable Synaptics trackpoints Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 69/85] blk-mq: call commit_rqs while list empty but error happen Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 70/85] scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 71/85] autofs: use __kernel_write() for the autofs pipe writing Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 72/85] pinctrl: qcom: sm8250: correct sdc2_clk Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 73/85] pinctrl: mediatek: check mtk_is_virt_gpio input parameter Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 74/85] gpio: pca953x: Correctly initialize registers 6 and 7 for PCA957x Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 75/85] iommu/amd: Fix the overwritten field in IVMD header Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 76/85] pipe: remove pipe_wait() and fix wakeup race with splice Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 77/85] random32: Restore __latent_entropy attribute on net_rand_state Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 78/85] gpiolib: Fix line event handling in syscall compatible mode Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 79/85] drm/i915/gvt: Fix port number for BDW on EDID region setup Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 80/85] scsi: sd: sd_zbc: Fix handling of host-aware ZBC disks Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 81/85] scsi: sd: sd_zbc: Fix ZBC disk initialization Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 82/85] epoll: do not insert into poll queues until all sanity checks are done Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 83/85] epoll: replace ->visited/visited_list with generation count Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 84/85] epoll: EPOLL_CTL_ADD: close the race in decision to take fast path Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.8 85/85] ep_create_wakeup_source(): dentry name can change under you Greg Kroah-Hartman
2020-10-06 0:18 ` [PATCH 5.8 00/85] 5.8.14-rc1 review Shuah Khan
2020-10-07 9:12 ` Greg Kroah-Hartman
2020-10-06 5:27 ` Naresh Kamboju
2020-10-07 9:12 ` Greg Kroah-Hartman
2020-10-06 8:58 ` Jeffrin Jose T
2020-10-06 9:12 ` Jeffrin Jose T
2020-10-06 18:18 ` Guenter Roeck
2020-10-07 9:11 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201005142114.805252222@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+81b3883093f772addf6d@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).