* BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270
@ 2023-01-02 11:45 Oleksandr Natalenko
2023-01-02 11:49 ` Oleksandr Natalenko
0 siblings, 1 reply; 2+ messages in thread
From: Oleksandr Natalenko @ 2023-01-02 11:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Paolo Valente, Jens Axboe, linux-block
Hello.
This is a sudden splash I've got while just using my workstation:
==================================================================
BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270
Use-after-free read at 0x00000000e57c579c (in kfence-#173):
bfq_exit_icq_bfqq+0x132/0x270
bfq_exit_icq+0x5e/0x80
exit_io_context+0x88/0xb0
do_exit+0x66c/0xb80
kthread_exit+0x29/0x30
kthread+0xbd/0x110
ret_from_fork+0x22/0x30
kfence-#173: 0x000000005d7be631-0x000000006ad0b684, size=568, cache=bfq_queue
allocated by task 40147 on cpu 16 at 13975.114285s:
bfq_get_queue+0xdf/0x4e0
bfq_get_bfqq_handle_split+0x75/0x170
bfq_insert_requests+0x832/0x2580
blk_mq_sched_insert_requests+0x63/0x150
blk_mq_flush_plug_list+0x122/0x360
__blk_flush_plug+0x106/0x160
blk_finish_plug+0x29/0x40
dm_bufio_prefetch+0x108/0x4d0 [dm_bufio]
dm_tm_issue_prefetches+0x44/0x70 [dm_persistent_data]
dm_pool_issue_prefetches+0x39/0x43 [dm_thin_pool]
do_worker+0x4c/0xd60 [dm_thin_pool]
process_one_work+0x258/0x410
worker_thread+0x55/0x4c0
kthread+0xde/0x110
ret_from_fork+0x22/0x30
freed by task 40147 on cpu 20 at 14500.096700s:
bfq_put_queue+0x185/0x2d0
bfq_exit_icq_bfqq+0x129/0x270
bfq_exit_icq+0x5e/0x80
exit_io_context+0x88/0xb0
do_exit+0x66c/0xb80
kthread_exit+0x29/0x30
kthread+0xbd/0x110
ret_from_fork+0x22/0x30
CPU: 20 PID: 40147 Comm: kworker/dying Tainted: G W 6.1.0-pf2 #1 ff5dbde5ea280110a73397797e059b8558cda111
Hardware name: ASUS System Product Name/Pro WS X570-ACE, BIOS 4304 12/12/2022
==================================================================
I'm using v6.1.2, never experienced this before and cannot reproduce it at will. This kernel does not have any extra patches for the block layer on top of v6.1.2.
In case you know what's going on, please let me know.
Thanks!
--
Oleksandr Natalenko (post-factum)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270
2023-01-02 11:45 BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270 Oleksandr Natalenko
@ 2023-01-02 11:49 ` Oleksandr Natalenko
0 siblings, 0 replies; 2+ messages in thread
From: Oleksandr Natalenko @ 2023-01-02 11:49 UTC (permalink / raw)
To: linux-kernel; +Cc: Paolo Valente, Jens Axboe, linux-block
On pondělí 2. ledna 2023 12:45:30 CET Oleksandr Natalenko wrote:
> This is a sudden splash I've got while just using my workstation:
>
> ==================================================================
> BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270
> Use-after-free read at 0x00000000e57c579c (in kfence-#173):
> bfq_exit_icq_bfqq+0x132/0x270
> bfq_exit_icq+0x5e/0x80
> exit_io_context+0x88/0xb0
> do_exit+0x66c/0xb80
> kthread_exit+0x29/0x30
> kthread+0xbd/0x110
> ret_from_fork+0x22/0x30
>
> kfence-#173: 0x000000005d7be631-0x000000006ad0b684, size=568, cache=bfq_queue
> allocated by task 40147 on cpu 16 at 13975.114285s:
> bfq_get_queue+0xdf/0x4e0
> bfq_get_bfqq_handle_split+0x75/0x170
> bfq_insert_requests+0x832/0x2580
> blk_mq_sched_insert_requests+0x63/0x150
> blk_mq_flush_plug_list+0x122/0x360
> __blk_flush_plug+0x106/0x160
> blk_finish_plug+0x29/0x40
> dm_bufio_prefetch+0x108/0x4d0 [dm_bufio]
> dm_tm_issue_prefetches+0x44/0x70 [dm_persistent_data]
> dm_pool_issue_prefetches+0x39/0x43 [dm_thin_pool]
> do_worker+0x4c/0xd60 [dm_thin_pool]
> process_one_work+0x258/0x410
> worker_thread+0x55/0x4c0
> kthread+0xde/0x110
> ret_from_fork+0x22/0x30
>
> freed by task 40147 on cpu 20 at 14500.096700s:
> bfq_put_queue+0x185/0x2d0
> bfq_exit_icq_bfqq+0x129/0x270
> bfq_exit_icq+0x5e/0x80
> exit_io_context+0x88/0xb0
> do_exit+0x66c/0xb80
> kthread_exit+0x29/0x30
> kthread+0xbd/0x110
> ret_from_fork+0x22/0x30
>
> CPU: 20 PID: 40147 Comm: kworker/dying Tainted: G W 6.1.0-pf2 #1 ff5dbde5ea280110a73397797e059b8558cda111
> Hardware name: ASUS System Product Name/Pro WS X570-ACE, BIOS 4304 12/12/2022
> ==================================================================
>
> I'm using v6.1.2, never experienced this before and cannot reproduce it at will. This kernel does not have any extra patches for the block layer on top of v6.1.2.
>
> In case you know what's going on, please let me know.
I assume 246cf66e30 ("block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq") may have fixed the issue. This commit is pending for upcoming v6.1.3.
--
Oleksandr Natalenko (post-factum)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-01-02 11:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-02 11:45 BUG: KFENCE: use-after-free read in bfq_exit_icq_bfqq+0x132/0x270 Oleksandr Natalenko
2023-01-02 11:49 ` Oleksandr Natalenko
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.