linux-block.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jens Axboe <axboe@kernel.dk>
To: Bart Van Assche <bvanassche@acm.org>,
	"linux-block@vger.kernel.org" <linux-block@vger.kernel.org>
Subject: Re: v4.20-rc6: Sporadic use-after-free in bt_iter()
Date: Wed, 19 Dec 2018 16:27:55 -0700	[thread overview]
Message-ID: <74c0280c-e557-ad03-cd75-98dd6d868da3@kernel.dk> (raw)
In-Reply-To: <1545261885.185366.488.camel@acm.org>

On 12/19/18 4:24 PM, Bart Van Assche wrote:
> Hello,
> 
> If I run the srp blktests in a loop then I see the below call stack appearing
> sporadically. I have not yet had the time to analyze this but I'm reporting
> this here in case someone else would already have had a look at this.
> 
> Bart.
> 
> ==================================================================
> BUG: KASAN: use-after-free in bt_iter+0x86/0xf0
> Read of size 8 at addr ffff88803b335240 by task fio/21412
> 
> CPU: 0 PID: 21412 Comm: fio Tainted: G        W         4.20.0-rc6-dbg+ #3
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> Call Trace:
>  dump_stack+0x86/0xca
>  print_address_description+0x71/0x239
>  kasan_report.cold.5+0x242/0x301
>  __asan_load8+0x54/0x90
>  bt_iter+0x86/0xf0
>  blk_mq_queue_tag_busy_iter+0x373/0x5e0
>  blk_mq_in_flight+0x96/0xb0
>  part_in_flight+0x40/0x140
>  part_round_stats+0x18e/0x370
>  blk_account_io_start+0x3d7/0x670
>  blk_mq_bio_to_request+0x19c/0x3a0
>  blk_mq_make_request+0x7a9/0xcb0
>  generic_make_request+0x41d/0x960
>  submit_bio+0x9b/0x250
>  do_blockdev_direct_IO+0x435c/0x4c70
>  __blockdev_direct_IO+0x79/0x88
>  ext4_direct_IO+0x46c/0xc00
>  generic_file_direct_write+0x119/0x210
>  __generic_file_write_iter+0x11c/0x280
>  ext4_file_write_iter+0x1b8/0x6f0
>  aio_write+0x204/0x310
>  io_submit_one+0x9d3/0xe80
>  __x64_sys_io_submit+0x115/0x340
>  do_syscall_64+0x71/0x210
>  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x7f02cf043219

I've seen this one before as well, it's not a new thing. As far as I can
tell, it's a false positive. There should be no possibility for a
use-after-free iterating the static tags/requests.

-- 
Jens Axboe


  reply	other threads:[~2018-12-19 23:28 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-19 23:24 v4.20-rc6: Sporadic use-after-free in bt_iter() Bart Van Assche
2018-12-19 23:27 ` Jens Axboe [this message]
2018-12-20  0:16   ` Bart Van Assche
2018-12-20  3:17     ` Jens Axboe
2018-12-20  3:24       ` jianchao.wang
2018-12-20  4:19         ` Jens Axboe
2018-12-20  4:32           ` jianchao.wang
2018-12-20  4:48             ` Jens Axboe
2018-12-20  5:03               ` jianchao.wang
2018-12-20 13:02                 ` Jens Axboe
2018-12-20 13:07                   ` Jens Axboe
2018-12-20 18:01                     ` Bart Van Assche
2018-12-20 18:21                       ` Jens Axboe
2018-12-20 18:33                         ` Jens Axboe
2018-12-20 20:56                           ` Bart Van Assche
2018-12-20 21:00                             ` Jens Axboe
2018-12-20 21:23                               ` Bart Van Assche
2018-12-20 21:26                                 ` Jens Axboe
2018-12-20 21:31                                   ` Bart Van Assche
2018-12-20 21:34                                     ` Jens Axboe
2018-12-20 21:40                                       ` Bart Van Assche
2018-12-20 21:44                                         ` Jens Axboe
2018-12-20 21:48                                           ` Jens Axboe
2018-12-20 22:19                                             ` Bart Van Assche
2018-12-20 22:23                                               ` Jens Axboe
2018-12-20 22:33                                                 ` Jens Axboe
2018-12-20 22:47                                                   ` Jens Axboe
2018-12-20 22:50                                                     ` Jens Axboe
2019-02-14 23:36                                                       ` Bart Van Assche
2019-02-15 18:29                                                         ` Evan Green
2019-02-19 16:48                                                           ` Bart Van Assche
2019-02-21 20:54                                                             ` Evan Green
2019-02-15  2:57                                                       ` jianchao.wang
2018-12-20  4:06 ` Ming Lei

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=74c0280c-e557-ad03-cd75-98dd6d868da3@kernel.dk \
    --to=axboe@kernel.dk \
    --cc=bvanassche@acm.org \
    --cc=linux-block@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).