All of lore.kernel.org
 help / color / mirror / Atom feed
* KASAN: null-ptr-deref Write in blk_mq_map_swqueue
@ 2020-03-26 19:33 syzbot
  2020-03-27  0:19 ` Dongli Zhang
                   ` (2 more replies)
  0 siblings, 3 replies; 9+ messages in thread
From: syzbot @ 2020-03-26 19:33 UTC (permalink / raw)
  To: axboe, linux-block, linux-kernel, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e31ba7e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com

RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
==================================================================
BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline]
BUG: KASAN: null-ptr-deref in bitmap_zero include/linux/bitmap.h:232 [inline]
BUG: KASAN: null-ptr-deref in cpumask_clear include/linux/cpumask.h:406 [inline]
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
Write of size 8 at addr 0000000000000118 by task syz-executor083/7593

CPU: 0 PID: 7593 Comm: syz-executor083 Not tainted 5.6.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 __kasan_report.cold+0x5/0x32 mm/kasan/report.c:510
 kasan_report+0xe/0x20 mm/kasan/common.c:641
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x128/0x190 mm/kasan/generic.c:192
 memset+0x20/0x40 mm/kasan/common.c:108
 memset include/linux/string.h:366 [inline]
 bitmap_zero include/linux/bitmap.h:232 [inline]
 cpumask_clear include/linux/cpumask.h:406 [inline]
 blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
 blk_mq_init_allocated_queue+0xf21/0x13c0 block/blk-mq.c:2943
 blk_mq_init_queue+0x5c/0xa0 block/blk-mq.c:2733
 loop_add+0x2cb/0x8a0 drivers/block/loop.c:2022
 loop_control_ioctl drivers/block/loop.c:2175 [inline]
 loop_control_ioctl+0x153/0x340 drivers/block/loop.c:2157
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
 __do_sys_ioctl fs/ioctl.c:772 [inline]
 __se_sys_ioctl fs/ioctl.c:770 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4411c9
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot
@ 2020-03-27  0:19 ` Dongli Zhang
  2020-03-27  2:52   ` Bart Van Assche
  2020-03-27  1:28 ` syzbot
  2020-06-25  3:01 ` syzbot
  2 siblings, 1 reply; 9+ messages in thread
From: Dongli Zhang @ 2020-03-27  0:19 UTC (permalink / raw)
  To: syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs

I think the issue is because of line 2827, that is, the q->nr_hw_queues is
updated too earlier. It is still possible the init would fail later.

2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
2810                                                 struct request_queue *q)
2811 {
2812         int i, j, end;
2813         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
2814
2815         if (q->nr_hw_queues < set->nr_hw_queues) {
2816                 struct blk_mq_hw_ctx **new_hctxs;
2817
2818                 new_hctxs = kcalloc_node(set->nr_hw_queues,
2819                                        sizeof(*new_hctxs), GFP_KERNEL,
2820                                        set->numa_node);
2821                 if (!new_hctxs)
2822                         return;
2823                 if (hctxs)
2824                         memcpy(new_hctxs, hctxs, q->nr_hw_queues *
2825                                sizeof(*hctxs));
2826                 q->queue_hw_ctx = new_hctxs;
2827                 q->nr_hw_queues = set->nr_hw_queues;
2828                 kfree(hctxs);
2829                 hctxs = new_hctxs;
2830         }


Let's assume below line 2847 is failed (e.g.,
blk_mq_alloc_and_init_hctx()->blk_mq_alloc_hctx()->zalloc_cpumask_var_node(&hctx->cpumask,
gfp, node)).

As a result, we would come to line 2865 and 2866, and q->nr_hw_queues is already
set to set->nr_hw_queues at above line 2827.

2832         /* protect against switching io scheduler  */
2833         mutex_lock(&q->sysfs_lock);
2834         for (i = 0; i < set->nr_hw_queues; i++) {
2835                 int node;
2836                 struct blk_mq_hw_ctx *hctx;
2837
2838                 node =
blk_mq_hw_queue_to_node(&set->map[HCTX_TYPE_DEFAULT], i);
2839                 /*
2840                  * If the hw queue has been mapped to another numa node,
2841                  * we need to realloc the hctx. If allocation fails, fallback
2842                  * to use the previous one.
2843                  */
2844                 if (hctxs[i] && (hctxs[i]->numa_node == node))
2845                         continue;
2846
2847                 hctx = blk_mq_alloc_and_init_hctx(set, q, i, node);
2848                 if (hctx) {
2849                         if (hctxs[i])
2850                                 blk_mq_exit_hctx(q, set, hctxs[i], i);
2851                         hctxs[i] = hctx;
2852                 } else {
2853                         if (hctxs[i])
2854                                 pr_warn("Allocate new hctx on node %d fails,\
2855                                                 fallback to previous one on
node %d\n",
2856                                                 node, hctxs[i]->numa_node);
2857                         else
2858                                 break;
2859                 }
2860         }
2861         /*
2862          * Increasing nr_hw_queues fails. Free the newly allocated
2863          * hctxs and keep the previous q->nr_hw_queues.
2864          */
2865         if (i != set->nr_hw_queues) {
2866                 j = q->nr_hw_queues;
2867                 end = i;
2868         } else {
2869                 j = i;
2870                 end = q->nr_hw_queues;
2871                 q->nr_hw_queues = set->nr_hw_queues;
2872         }

The above would not change q->nr_hw_queues again, although hctx are not
allocated successfully. Later we hit fault at line 2501 and line 2502.

2494 static void blk_mq_map_swqueue(struct request_queue *q)
2495 {
2496         unsigned int i, j, hctx_idx;
2497         struct blk_mq_hw_ctx *hctx;
2498         struct blk_mq_ctx *ctx;
2499         struct blk_mq_tag_set *set = q->tag_set;
2500
2501         queue_for_each_hw_ctx(q, hctx, i) {
2502                 cpumask_clear(hctx->cpumask);
2503                 hctx->nr_ctx = 0;
2504                 hctx->dispatch_from = NULL;
2505         }


I can reproduce on purpose with below patch.

https://github.com/finallyjustice/patchset/blob/master/syzbot%2B313d95e8a7a49263f88d-reproducer.patch

The patch is used to emulate a memory allocation failure for:

blk_mq_alloc_and_init_hctx()
 -> blk_mq_alloc_hctx()
     ->zalloc_cpumask_var_node(&hctx->cpumask, gfp, node)).


Dongli Zhang

On 3/26/20 12:33 PM, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
> git tree:       upstream
> console output: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=15e31ba7e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujio9zJzSQ$ 
> kernel config:  https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiOaxMATc$ 
> dashboard link: https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiid_YjTs$ 
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiAWmy3bw$ 
> C reproducer:   https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiMv3YHnM$ 
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com
> 
> RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
> RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
> RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
> R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
> ==================================================================
> BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline]
> BUG: KASAN: null-ptr-deref in bitmap_zero include/linux/bitmap.h:232 [inline]
> BUG: KASAN: null-ptr-deref in cpumask_clear include/linux/cpumask.h:406 [inline]
> BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
> Write of size 8 at addr 0000000000000118 by task syz-executor083/7593
> 
> CPU: 0 PID: 7593 Comm: syz-executor083 Not tainted 5.6.0-rc7-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x188/0x20d lib/dump_stack.c:118
>  __kasan_report.cold+0x5/0x32 mm/kasan/report.c:510
>  kasan_report+0xe/0x20 mm/kasan/common.c:641
>  check_memory_region_inline mm/kasan/generic.c:185 [inline]
>  check_memory_region+0x128/0x190 mm/kasan/generic.c:192
>  memset+0x20/0x40 mm/kasan/common.c:108
>  memset include/linux/string.h:366 [inline]
>  bitmap_zero include/linux/bitmap.h:232 [inline]
>  cpumask_clear include/linux/cpumask.h:406 [inline]
>  blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
>  blk_mq_init_allocated_queue+0xf21/0x13c0 block/blk-mq.c:2943
>  blk_mq_init_queue+0x5c/0xa0 block/blk-mq.c:2733
>  loop_add+0x2cb/0x8a0 drivers/block/loop.c:2022
>  loop_control_ioctl drivers/block/loop.c:2175 [inline]
>  loop_control_ioctl+0x153/0x340 drivers/block/loop.c:2157
>  vfs_ioctl fs/ioctl.c:47 [inline]
>  ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
>  __do_sys_ioctl fs/ioctl.c:772 [inline]
>  __se_sys_ioctl fs/ioctl.c:770 [inline]
>  __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
>  do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294
>  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x4411c9
> Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
> RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
> RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
> R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
> ==================================================================
> 
> 
> ---
> This bug is generated by a bot. It may contain errors.
> See https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhuji0GhH8ds$  for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this bug report. See:
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhuji-FPYYaM$  for how to communicate with syzbot.
> syzbot can test patches for this bug, for details see:
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*testing-patches__;Iw!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujip-J1ifc$ 
> 

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot
  2020-03-27  0:19 ` Dongli Zhang
@ 2020-03-27  1:28 ` syzbot
  2020-03-27  3:00   ` Bart Van Assche
  2020-03-27 15:06   ` Jens Axboe
  2020-06-25  3:01 ` syzbot
  2 siblings, 2 replies; 9+ messages in thread
From: syzbot @ 2020-03-27  1:28 UTC (permalink / raw)
  To: a, axboe, b.a.t.m.a.n, davem, dongli.zhang, linux-block,
	linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw,
	syzkaller-bugs, viro

syzbot has bisected this bug to:

commit 768134d4f48109b90f4248feecbeeb7d684e410c
Author: Jens Axboe <axboe@kernel.dk>
Date:   Mon Nov 11 03:30:53 2019 +0000

    io_uring: don't do flush cancel under inflight_lock

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000
start commit:   1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree:       upstream
final crash:    https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000

Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com
Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-27  0:19 ` Dongli Zhang
@ 2020-03-27  2:52   ` Bart Van Assche
  2020-03-27 13:30     ` Dongli Zhang
  0 siblings, 1 reply; 9+ messages in thread
From: Bart Van Assche @ 2020-03-27  2:52 UTC (permalink / raw)
  To: Dongli Zhang, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs

On 2020-03-26 17:19, Dongli Zhang wrote:
> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
> updated too earlier. It is still possible the init would fail later.
> 
> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
> 2810                                                 struct request_queue *q)
> 2811 {
> 2812         int i, j, end;
> 2813         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
> 2814
> 2815         if (q->nr_hw_queues < set->nr_hw_queues) {
> 2816                 struct blk_mq_hw_ctx **new_hctxs;
> 2817
> 2818                 new_hctxs = kcalloc_node(set->nr_hw_queues,
> 2819                                        sizeof(*new_hctxs), GFP_KERNEL,
> 2820                                        set->numa_node);
> 2821                 if (!new_hctxs)
> 2822                         return;
> 2823                 if (hctxs)
> 2824                         memcpy(new_hctxs, hctxs, q->nr_hw_queues *
> 2825                                sizeof(*hctxs));
> 2826                 q->queue_hw_ctx = new_hctxs;
> 2827                 q->nr_hw_queues = set->nr_hw_queues;
> 2828                 kfree(hctxs);
> 2829                 hctxs = new_hctxs;
> 2830         }

Which kernel tree does this syzbot report refer to? Commit
d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.

Thanks,

Bart.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-27  1:28 ` syzbot
@ 2020-03-27  3:00   ` Bart Van Assche
  2020-03-27 15:06   ` Jens Axboe
  1 sibling, 0 replies; 9+ messages in thread
From: Bart Van Assche @ 2020-03-27  3:00 UTC (permalink / raw)
  To: syzbot, a, axboe, b.a.t.m.a.n, davem, dongli.zhang, linux-block,
	linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw,
	syzkaller-bugs, viro

On 2020-03-26 18:28, syzbot wrote:
> syzbot has bisected this bug to:
> 
> commit 768134d4f48109b90f4248feecbeeb7d684e410c
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Mon Nov 11 03:30:53 2019 +0000
> 
>     io_uring: don't do flush cancel under inflight_lock
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000
> start commit:   1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
> git tree:       upstream
> final crash:    https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
> dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000
> 
> Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com
> Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock")
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection


#syz fix: blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-27  2:52   ` Bart Van Assche
@ 2020-03-27 13:30     ` Dongli Zhang
  0 siblings, 0 replies; 9+ messages in thread
From: Dongli Zhang @ 2020-03-27 13:30 UTC (permalink / raw)
  To: Bart Van Assche; +Cc: syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs



On 3/26/20 7:52 PM, Bart Van Assche wrote:
> On 2020-03-26 17:19, Dongli Zhang wrote:
>> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
>> updated too earlier. It is still possible the init would fail later.
>>
>> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
>> 2810                                                 struct request_queue *q)
>> 2811 {
>> 2812         int i, j, end;
>> 2813         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
>> 2814
>> 2815         if (q->nr_hw_queues < set->nr_hw_queues) {
>> 2816                 struct blk_mq_hw_ctx **new_hctxs;
>> 2817
>> 2818                 new_hctxs = kcalloc_node(set->nr_hw_queues,
>> 2819                                        sizeof(*new_hctxs), GFP_KERNEL,
>> 2820                                        set->numa_node);
>> 2821                 if (!new_hctxs)
>> 2822                         return;
>> 2823                 if (hctxs)
>> 2824                         memcpy(new_hctxs, hctxs, q->nr_hw_queues *
>> 2825                                sizeof(*hctxs));
>> 2826                 q->queue_hw_ctx = new_hctxs;
>> 2827                 q->nr_hw_queues = set->nr_hw_queues;
>> 2828                 kfree(hctxs);
>> 2829                 hctxs = new_hctxs;
>> 2830         }
> 
> Which kernel tree does this syzbot report refer to? Commit
> d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
> blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.
> 

Thank you very much for sharing this. The below is in Jens' tree for 5.7.

commit d0930bb8f46b8fb4a7d429c0bf1c91b3ed00a7cf
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Mon Mar 9 21:26:18 2020 -0700

    blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()

    q->nr_hw_queues must only be updated once it is known that
    blk_mq_realloc_hw_ctxs() has succeeded. Otherwise it can happen that
    reallocation fails and that q->nr_hw_queues is larger than the number of
    allocated hardware queues. This patch fixes the following crash if
    increasing the number of hardware queues fails:

    BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x775/0x810
    Write of size 8 at addr 0000000000000118 by task check/977

    CPU: 3 PID: 977 Comm: check Not tainted 5.6.0-rc1-dbg+ #8
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    Call Trace:
     dump_stack+0xa5/0xe6
     __kasan_report.cold+0x65/0x99
     kasan_report+0x16/0x20
     check_memory_region+0x140/0x1b0
     memset+0x28/0x40
     blk_mq_map_swqueue+0x775/0x810
     blk_mq_update_nr_hw_queues+0x468/0x710
     nullb_device_submit_queues_store+0xf7/0x1a0 [null_blk]
     configfs_write_file+0x1c4/0x250 [configfs]
     __vfs_write+0x4c/0x90
     vfs_write+0x145/0x2c0
     ksys_write+0xd7/0x180
     __x64_sys_write+0x47/0x50
     do_syscall_64+0x6f/0x2f0
     entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Fixes: ac0d6b926e74 ("block: Reduce the amount of memory required per
request queue")
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Ming Lei <ming.lei@redhat.com>
    Cc: Keith Busch <kbusch@kernel.org>
    Cc: Johannes Thumshirn <jth@kernel.org>
    Cc: Hannes Reinecke <hare@suse.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/blk-mq.c b/block/blk-mq.c
index d4bd9b961726..37ff8dfb8ab9 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2824,7 +2824,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
                        memcpy(new_hctxs, hctxs, q->nr_hw_queues *
                               sizeof(*hctxs));
                q->queue_hw_ctx = new_hctxs;
-               q->nr_hw_queues = set->nr_hw_queues;
                kfree(hctxs);
                hctxs = new_hctxs;
        }


That should be the reason why "init_hctx() fault injection" was introduced.

Thank you very much!

Dongli Zhang

^ permalink raw reply related	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-27  1:28 ` syzbot
  2020-03-27  3:00   ` Bart Van Assche
@ 2020-03-27 15:06   ` Jens Axboe
  1 sibling, 0 replies; 9+ messages in thread
From: Jens Axboe @ 2020-03-27 15:06 UTC (permalink / raw)
  To: syzbot, a, b.a.t.m.a.n, davem, dongli.zhang, linux-block,
	linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw,
	syzkaller-bugs, viro

On 3/26/20 7:28 PM, syzbot wrote:
> syzbot has bisected this bug to:
> 
> commit 768134d4f48109b90f4248feecbeeb7d684e410c
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Mon Nov 11 03:30:53 2019 +0000
> 
>     io_uring: don't do flush cancel under inflight_lock

This is definitely an utterly bogus bisect, not related at all.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot
  2020-03-27  0:19 ` Dongli Zhang
  2020-03-27  1:28 ` syzbot
@ 2020-06-25  3:01 ` syzbot
  2020-06-25  4:05   ` Bart Van Assche
  2 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2020-06-25  3:01 UTC (permalink / raw)
  To: a, axboe, b.a.t.m.a.n, bvanassche, davem, dongli.zhang, hdanton,
	jianchao.w.wang, linux-block, linux-fsdevel, linux-kernel,
	mareklindner, netdev, sven, sw, syzkaller-bugs, viro

This bug is marked as fixed by commit:
blk-mq: Fix a recently introduced regression in
But I can't find it in any tested tree for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and
new crashes with the same signature are ignored.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue
  2020-06-25  3:01 ` syzbot
@ 2020-06-25  4:05   ` Bart Van Assche
  0 siblings, 0 replies; 9+ messages in thread
From: Bart Van Assche @ 2020-06-25  4:05 UTC (permalink / raw)
  To: syzbot, a, axboe, b.a.t.m.a.n, davem, dongli.zhang, hdanton,
	jianchao.w.wang, linux-block, linux-fsdevel, linux-kernel,
	mareklindner, netdev, sven, sw, syzkaller-bugs, viro

On 2020-06-24 20:01, syzbot wrote:
> This bug is marked as fixed by commit:
> blk-mq: Fix a recently introduced regression in
> But I can't find it in any tested tree for more than 90 days.
> Is it a correct commit? Please update it by replying:
> #syz fix: exact-commit-title
> Until then the bug is still considered open and
> new crashes with the same signature are ignored.

#syz fix: blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()



^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2020-06-25  4:05 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot
2020-03-27  0:19 ` Dongli Zhang
2020-03-27  2:52   ` Bart Van Assche
2020-03-27 13:30     ` Dongli Zhang
2020-03-27  1:28 ` syzbot
2020-03-27  3:00   ` Bart Van Assche
2020-03-27 15:06   ` Jens Axboe
2020-06-25  3:01 ` syzbot
2020-06-25  4:05   ` Bart Van Assche

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.