* KASAN: null-ptr-deref Write in blk_mq_map_swqueue
@ 2020-03-26 19:33 syzbot
2020-03-27 0:19 ` Dongli Zhang
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: syzbot @ 2020-03-26 19:33 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e31ba7e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com
RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
==================================================================
BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline]
BUG: KASAN: null-ptr-deref in bitmap_zero include/linux/bitmap.h:232 [inline]
BUG: KASAN: null-ptr-deref in cpumask_clear include/linux/cpumask.h:406 [inline]
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
Write of size 8 at addr 0000000000000118 by task syz-executor083/7593
CPU: 0 PID: 7593 Comm: syz-executor083 Not tainted 5.6.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
__kasan_report.cold+0x5/0x32 mm/kasan/report.c:510
kasan_report+0xe/0x20 mm/kasan/common.c:641
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x128/0x190 mm/kasan/generic.c:192
memset+0x20/0x40 mm/kasan/common.c:108
memset include/linux/string.h:366 [inline]
bitmap_zero include/linux/bitmap.h:232 [inline]
cpumask_clear include/linux/cpumask.h:406 [inline]
blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
blk_mq_init_allocated_queue+0xf21/0x13c0 block/blk-mq.c:2943
blk_mq_init_queue+0x5c/0xa0 block/blk-mq.c:2733
loop_add+0x2cb/0x8a0 drivers/block/loop.c:2022
loop_control_ioctl drivers/block/loop.c:2175 [inline]
loop_control_ioctl+0x153/0x340 drivers/block/loop.c:2157
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4411c9
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot @ 2020-03-27 0:19 ` Dongli Zhang 2020-03-27 2:52 ` Bart Van Assche 2020-03-27 1:28 ` syzbot 2020-06-25 3:01 ` syzbot 2 siblings, 1 reply; 9+ messages in thread From: Dongli Zhang @ 2020-03-27 0:19 UTC (permalink / raw) To: syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs I think the issue is because of line 2827, that is, the q->nr_hw_queues is updated too earlier. It is still possible the init would fail later. 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, 2810 struct request_queue *q) 2811 { 2812 int i, j, end; 2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx; 2814 2815 if (q->nr_hw_queues < set->nr_hw_queues) { 2816 struct blk_mq_hw_ctx **new_hctxs; 2817 2818 new_hctxs = kcalloc_node(set->nr_hw_queues, 2819 sizeof(*new_hctxs), GFP_KERNEL, 2820 set->numa_node); 2821 if (!new_hctxs) 2822 return; 2823 if (hctxs) 2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues * 2825 sizeof(*hctxs)); 2826 q->queue_hw_ctx = new_hctxs; 2827 q->nr_hw_queues = set->nr_hw_queues; 2828 kfree(hctxs); 2829 hctxs = new_hctxs; 2830 } Let's assume below line 2847 is failed (e.g., blk_mq_alloc_and_init_hctx()->blk_mq_alloc_hctx()->zalloc_cpumask_var_node(&hctx->cpumask, gfp, node)). As a result, we would come to line 2865 and 2866, and q->nr_hw_queues is already set to set->nr_hw_queues at above line 2827. 2832 /* protect against switching io scheduler */ 2833 mutex_lock(&q->sysfs_lock); 2834 for (i = 0; i < set->nr_hw_queues; i++) { 2835 int node; 2836 struct blk_mq_hw_ctx *hctx; 2837 2838 node = blk_mq_hw_queue_to_node(&set->map[HCTX_TYPE_DEFAULT], i); 2839 /* 2840 * If the hw queue has been mapped to another numa node, 2841 * we need to realloc the hctx. If allocation fails, fallback 2842 * to use the previous one. 2843 */ 2844 if (hctxs[i] && (hctxs[i]->numa_node == node)) 2845 continue; 2846 2847 hctx = blk_mq_alloc_and_init_hctx(set, q, i, node); 2848 if (hctx) { 2849 if (hctxs[i]) 2850 blk_mq_exit_hctx(q, set, hctxs[i], i); 2851 hctxs[i] = hctx; 2852 } else { 2853 if (hctxs[i]) 2854 pr_warn("Allocate new hctx on node %d fails,\ 2855 fallback to previous one on node %d\n", 2856 node, hctxs[i]->numa_node); 2857 else 2858 break; 2859 } 2860 } 2861 /* 2862 * Increasing nr_hw_queues fails. Free the newly allocated 2863 * hctxs and keep the previous q->nr_hw_queues. 2864 */ 2865 if (i != set->nr_hw_queues) { 2866 j = q->nr_hw_queues; 2867 end = i; 2868 } else { 2869 j = i; 2870 end = q->nr_hw_queues; 2871 q->nr_hw_queues = set->nr_hw_queues; 2872 } The above would not change q->nr_hw_queues again, although hctx are not allocated successfully. Later we hit fault at line 2501 and line 2502. 2494 static void blk_mq_map_swqueue(struct request_queue *q) 2495 { 2496 unsigned int i, j, hctx_idx; 2497 struct blk_mq_hw_ctx *hctx; 2498 struct blk_mq_ctx *ctx; 2499 struct blk_mq_tag_set *set = q->tag_set; 2500 2501 queue_for_each_hw_ctx(q, hctx, i) { 2502 cpumask_clear(hctx->cpumask); 2503 hctx->nr_ctx = 0; 2504 hctx->dispatch_from = NULL; 2505 } I can reproduce on purpose with below patch. https://github.com/finallyjustice/patchset/blob/master/syzbot%2B313d95e8a7a49263f88d-reproducer.patch The patch is used to emulate a memory allocation failure for: blk_mq_alloc_and_init_hctx() -> blk_mq_alloc_hctx() ->zalloc_cpumask_var_node(&hctx->cpumask, gfp, node)). Dongli Zhang On 3/26/20 12:33 PM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g.. > git tree: upstream > console output: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=15e31ba7e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujio9zJzSQ$ > kernel config: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiOaxMATc$ > dashboard link: https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiid_YjTs$ > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiAWmy3bw$ > C reproducer: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiMv3YHnM$ > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com > > RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9 > RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 > RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff > R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000 > ================================================================== > BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline] > BUG: KASAN: null-ptr-deref in bitmap_zero include/linux/bitmap.h:232 [inline] > BUG: KASAN: null-ptr-deref in cpumask_clear include/linux/cpumask.h:406 [inline] > BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502 > Write of size 8 at addr 0000000000000118 by task syz-executor083/7593 > > CPU: 0 PID: 7593 Comm: syz-executor083 Not tainted 5.6.0-rc7-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x188/0x20d lib/dump_stack.c:118 > __kasan_report.cold+0x5/0x32 mm/kasan/report.c:510 > kasan_report+0xe/0x20 mm/kasan/common.c:641 > check_memory_region_inline mm/kasan/generic.c:185 [inline] > check_memory_region+0x128/0x190 mm/kasan/generic.c:192 > memset+0x20/0x40 mm/kasan/common.c:108 > memset include/linux/string.h:366 [inline] > bitmap_zero include/linux/bitmap.h:232 [inline] > cpumask_clear include/linux/cpumask.h:406 [inline] > blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502 > blk_mq_init_allocated_queue+0xf21/0x13c0 block/blk-mq.c:2943 > blk_mq_init_queue+0x5c/0xa0 block/blk-mq.c:2733 > loop_add+0x2cb/0x8a0 drivers/block/loop.c:2022 > loop_control_ioctl drivers/block/loop.c:2175 [inline] > loop_control_ioctl+0x153/0x340 drivers/block/loop.c:2157 > vfs_ioctl fs/ioctl.c:47 [inline] > ksys_ioctl+0x11a/0x180 fs/ioctl.c:763 > __do_sys_ioctl fs/ioctl.c:772 [inline] > __se_sys_ioctl fs/ioctl.c:770 [inline] > __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770 > do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x4411c9 > Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00 > RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9 > RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003 > RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff > R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000 > ================================================================== > > > --- > This bug is generated by a bot. It may contain errors. > See https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhuji0GhH8ds$ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhuji-FPYYaM$ for how to communicate with syzbot. > syzbot can test patches for this bug, for details see: > https://urldefense.com/v3/__https://goo.gl/tpsmEJ*testing-patches__;Iw!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujip-J1ifc$ > ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-27 0:19 ` Dongli Zhang @ 2020-03-27 2:52 ` Bart Van Assche 2020-03-27 13:30 ` Dongli Zhang 0 siblings, 1 reply; 9+ messages in thread From: Bart Van Assche @ 2020-03-27 2:52 UTC (permalink / raw) To: Dongli Zhang, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs On 2020-03-26 17:19, Dongli Zhang wrote: > I think the issue is because of line 2827, that is, the q->nr_hw_queues is > updated too earlier. It is still possible the init would fail later. > > 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, > 2810 struct request_queue *q) > 2811 { > 2812 int i, j, end; > 2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx; > 2814 > 2815 if (q->nr_hw_queues < set->nr_hw_queues) { > 2816 struct blk_mq_hw_ctx **new_hctxs; > 2817 > 2818 new_hctxs = kcalloc_node(set->nr_hw_queues, > 2819 sizeof(*new_hctxs), GFP_KERNEL, > 2820 set->numa_node); > 2821 if (!new_hctxs) > 2822 return; > 2823 if (hctxs) > 2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues * > 2825 sizeof(*hctxs)); > 2826 q->queue_hw_ctx = new_hctxs; > 2827 q->nr_hw_queues = set->nr_hw_queues; > 2828 kfree(hctxs); > 2829 hctxs = new_hctxs; > 2830 } Which kernel tree does this syzbot report refer to? Commit d0930bb8f46b ("blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above. Thanks, Bart. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-27 2:52 ` Bart Van Assche @ 2020-03-27 13:30 ` Dongli Zhang 0 siblings, 0 replies; 9+ messages in thread From: Dongli Zhang @ 2020-03-27 13:30 UTC (permalink / raw) To: Bart Van Assche; +Cc: syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs On 3/26/20 7:52 PM, Bart Van Assche wrote: > On 2020-03-26 17:19, Dongli Zhang wrote: >> I think the issue is because of line 2827, that is, the q->nr_hw_queues is >> updated too earlier. It is still possible the init would fail later. >> >> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, >> 2810 struct request_queue *q) >> 2811 { >> 2812 int i, j, end; >> 2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx; >> 2814 >> 2815 if (q->nr_hw_queues < set->nr_hw_queues) { >> 2816 struct blk_mq_hw_ctx **new_hctxs; >> 2817 >> 2818 new_hctxs = kcalloc_node(set->nr_hw_queues, >> 2819 sizeof(*new_hctxs), GFP_KERNEL, >> 2820 set->numa_node); >> 2821 if (!new_hctxs) >> 2822 return; >> 2823 if (hctxs) >> 2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues * >> 2825 sizeof(*hctxs)); >> 2826 q->queue_hw_ctx = new_hctxs; >> 2827 q->nr_hw_queues = set->nr_hw_queues; >> 2828 kfree(hctxs); >> 2829 hctxs = new_hctxs; >> 2830 } > > Which kernel tree does this syzbot report refer to? Commit > d0930bb8f46b ("blk-mq: Fix a recently introduced regression in > blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above. > Thank you very much for sharing this. The below is in Jens' tree for 5.7. commit d0930bb8f46b8fb4a7d429c0bf1c91b3ed00a7cf Author: Bart Van Assche <bvanassche@acm.org> Date: Mon Mar 9 21:26:18 2020 -0700 blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs() q->nr_hw_queues must only be updated once it is known that blk_mq_realloc_hw_ctxs() has succeeded. Otherwise it can happen that reallocation fails and that q->nr_hw_queues is larger than the number of allocated hardware queues. This patch fixes the following crash if increasing the number of hardware queues fails: BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x775/0x810 Write of size 8 at addr 0000000000000118 by task check/977 CPU: 3 PID: 977 Comm: check Not tainted 5.6.0-rc1-dbg+ #8 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0xa5/0xe6 __kasan_report.cold+0x65/0x99 kasan_report+0x16/0x20 check_memory_region+0x140/0x1b0 memset+0x28/0x40 blk_mq_map_swqueue+0x775/0x810 blk_mq_update_nr_hw_queues+0x468/0x710 nullb_device_submit_queues_store+0xf7/0x1a0 [null_blk] configfs_write_file+0x1c4/0x250 [configfs] __vfs_write+0x4c/0x90 vfs_write+0x145/0x2c0 ksys_write+0xd7/0x180 __x64_sys_write+0x47/0x50 do_syscall_64+0x6f/0x2f0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: ac0d6b926e74 ("block: Reduce the amount of memory required per request queue") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Ming Lei <ming.lei@redhat.com> Cc: Keith Busch <kbusch@kernel.org> Cc: Johannes Thumshirn <jth@kernel.org> Cc: Hannes Reinecke <hare@suse.com> Cc: Christoph Hellwig <hch@infradead.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> diff --git a/block/blk-mq.c b/block/blk-mq.c index d4bd9b961726..37ff8dfb8ab9 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2824,7 +2824,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, memcpy(new_hctxs, hctxs, q->nr_hw_queues * sizeof(*hctxs)); q->queue_hw_ctx = new_hctxs; - q->nr_hw_queues = set->nr_hw_queues; kfree(hctxs); hctxs = new_hctxs; } That should be the reason why "init_hctx() fault injection" was introduced. Thank you very much! Dongli Zhang ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot 2020-03-27 0:19 ` Dongli Zhang @ 2020-03-27 1:28 ` syzbot 2020-03-27 3:00 ` Bart Van Assche 2020-03-27 15:06 ` Jens Axboe 2020-06-25 3:01 ` syzbot 2 siblings, 2 replies; 9+ messages in thread From: syzbot @ 2020-03-27 1:28 UTC (permalink / raw) To: a, axboe, b.a.t.m.a.n, davem, dongli.zhang, linux-block, linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw, syzkaller-bugs, viro syzbot has bisected this bug to: commit 768134d4f48109b90f4248feecbeeb7d684e410c Author: Jens Axboe <axboe@kernel.dk> Date: Mon Nov 11 03:30:53 2019 +0000 io_uring: don't do flush cancel under inflight_lock bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000 start commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692 dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000 Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-27 1:28 ` syzbot @ 2020-03-27 3:00 ` Bart Van Assche 2020-03-27 15:06 ` Jens Axboe 1 sibling, 0 replies; 9+ messages in thread From: Bart Van Assche @ 2020-03-27 3:00 UTC (permalink / raw) To: syzbot, a, axboe, b.a.t.m.a.n, davem, dongli.zhang, linux-block, linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw, syzkaller-bugs, viro On 2020-03-26 18:28, syzbot wrote: > syzbot has bisected this bug to: > > commit 768134d4f48109b90f4248feecbeeb7d684e410c > Author: Jens Axboe <axboe@kernel.dk> > Date: Mon Nov 11 03:30:53 2019 +0000 > > io_uring: don't do flush cancel under inflight_lock > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000 > start commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g.. > git tree: upstream > final crash: https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000 > console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692 > dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000 > > Reported-by: syzbot+313d95e8a7a49263f88d@syzkaller.appspotmail.com > Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock") > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection #syz fix: blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs() ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-27 1:28 ` syzbot 2020-03-27 3:00 ` Bart Van Assche @ 2020-03-27 15:06 ` Jens Axboe 1 sibling, 0 replies; 9+ messages in thread From: Jens Axboe @ 2020-03-27 15:06 UTC (permalink / raw) To: syzbot, a, b.a.t.m.a.n, davem, dongli.zhang, linux-block, linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw, syzkaller-bugs, viro On 3/26/20 7:28 PM, syzbot wrote: > syzbot has bisected this bug to: > > commit 768134d4f48109b90f4248feecbeeb7d684e410c > Author: Jens Axboe <axboe@kernel.dk> > Date: Mon Nov 11 03:30:53 2019 +0000 > > io_uring: don't do flush cancel under inflight_lock This is definitely an utterly bogus bisect, not related at all. -- Jens Axboe ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot 2020-03-27 0:19 ` Dongli Zhang 2020-03-27 1:28 ` syzbot @ 2020-06-25 3:01 ` syzbot 2020-06-25 4:05 ` Bart Van Assche 2 siblings, 1 reply; 9+ messages in thread From: syzbot @ 2020-06-25 3:01 UTC (permalink / raw) To: a, axboe, b.a.t.m.a.n, bvanassche, davem, dongli.zhang, hdanton, jianchao.w.wang, linux-block, linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw, syzkaller-bugs, viro This bug is marked as fixed by commit: blk-mq: Fix a recently introduced regression in But I can't find it in any tested tree for more than 90 days. Is it a correct commit? Please update it by replying: #syz fix: exact-commit-title Until then the bug is still considered open and new crashes with the same signature are ignored. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KASAN: null-ptr-deref Write in blk_mq_map_swqueue 2020-06-25 3:01 ` syzbot @ 2020-06-25 4:05 ` Bart Van Assche 0 siblings, 0 replies; 9+ messages in thread From: Bart Van Assche @ 2020-06-25 4:05 UTC (permalink / raw) To: syzbot, a, axboe, b.a.t.m.a.n, davem, dongli.zhang, hdanton, jianchao.w.wang, linux-block, linux-fsdevel, linux-kernel, mareklindner, netdev, sven, sw, syzkaller-bugs, viro On 2020-06-24 20:01, syzbot wrote: > This bug is marked as fixed by commit: > blk-mq: Fix a recently introduced regression in > But I can't find it in any tested tree for more than 90 days. > Is it a correct commit? Please update it by replying: > #syz fix: exact-commit-title > Until then the bug is still considered open and > new crashes with the same signature are ignored. #syz fix: blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs() ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2020-06-25 4:05 UTC | newest] Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-03-26 19:33 KASAN: null-ptr-deref Write in blk_mq_map_swqueue syzbot 2020-03-27 0:19 ` Dongli Zhang 2020-03-27 2:52 ` Bart Van Assche 2020-03-27 13:30 ` Dongli Zhang 2020-03-27 1:28 ` syzbot 2020-03-27 3:00 ` Bart Van Assche 2020-03-27 15:06 ` Jens Axboe 2020-06-25 3:01 ` syzbot 2020-06-25 4:05 ` Bart Van Assche
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).