WARNING in __io_uring

WARNING in __io_uring_free

Status: upstream: reported on 2024/11/19 04:38
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+cc36d44ec9f368e443d3@syzkaller.appspotmail.com
Fix commit: 7eb75ce75271 io_uring/tctx: work around xa_store() allocation error issue
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 65d, last: 65d

▶ ▼ Discussions (6)

Title	Replies (including bot)	Last reply
[syzbot] [io-uring?] WARNING in __io_uring_free	5 (6)	2024/12/29 19:42
[PATCH AUTOSEL 6.1 4/4] io_uring/tctx: work around xa_store() allocation error issue	1 (1)	2024/12/04 22:24
[PATCH AUTOSEL 6.6 6/6] io_uring/tctx: work around xa_store() allocation error issue	1 (1)	2024/12/04 22:24
[PATCH AUTOSEL 6.11 7/7] io_uring/tctx: work around xa_store() allocation error issue	1 (1)	2024/12/04 22:23
[PATCH AUTOSEL 6.12 8/8] io_uring/tctx: work around xa_store() allocation error issue	1 (1)	2024/12/04 22:23
[PATCH] io_uring/tctx: work around xa_store() allocation error issue	1 (1)	2024/11/29 14:24

Sample crash report:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc7-syzkaller-00125-gcfaaa7d010d1 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__io_uring_free+0xfa/0x140 io_uring/tctx.c:51
Code: 80 7c 25 00 00 74 08 4c 89 f7 e8 a1 8a 49 fd 49 c7 06 00 00 00 00 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc e8 37 ad df fc 90 <0f> 0b 90 e9 6a ff ff ff e8 29 ad df fc 90 0f 0b 90 eb 84 e8 1e ad
RSP: 0018:ffffc900004279b8 EFLAGS: 00010246
RAX: ffffffff84b53cd9 RBX: ffff88804fc3b8e0 RCX: ffff88801b7e8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88801f058000
RBP: 0000000000000001 R08: ffffffff8154d881 R09: 1ffff11003e0b005
R10: dffffc0000000000 R11: ffffed1003e0b006 R12: dffffc0000000000
R13: 1ffff11003e0b120 R14: ffff88801f058900 R15: ffff88804fc3b800
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005594393ad338 CR3: 000000000e734000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 io_uring_free include/linux/io_uring.h:31 [inline]
 __put_task_struct+0xd5/0x290 kernel/fork.c:975
 put_task_struct include/linux/sched/task.h:144 [inline]
 delayed_put_task_struct+0x125/0x300 kernel/exit.c:228
 rcu_do_batch kernel/rcu/tree.c:2567 [inline]
 rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823
 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
 run_ksoftirqd+0xca/0x130 kernel/softirq.c:927
 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2024/11/15 04:28	upstream	cfaaa7d010d1	f6ede3a3	.config	console log	report				[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	WARNING in __io_uring_free

* ~~Struck through~~ repros no longer work on HEAD.