syzbot


KASAN: use-after-free Write in __io_free_req
Status: upstream: reported syz repro on 2021/10/29 14:34
Reported-by: syzbot+78b76ebc91042904f34e@syzkaller.appspotmail.com
First crash: 38d, last: 38d

Cause bisection: introduced by (bisect log) :
commit 34ced75ca1f63fac6148497971212583aa0f7a87
Author: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Date: Mon Oct 25 05:38:48 2021 +0000

  io_uring: reduce frequent add_wait_queue() overhead for multi-shot poll request

Crash: INFO: task hung in io_uring_try_cancel_requests (log)
Repro: syz .config
Patch testing requests:
Created Duration User Patch Repo Result
2021/12/01 13:59 15m phind.uet@gmail.com upstream OK
2021/12/01 13:47 9m phind.uet@gmail.com linux-next error
2021/10/29 21:21 11m asml.silence@gmail.com https://github.com/isilence/linux.git syz-test-iofree report log
2021/10/29 18:00 0m asml.silence@gmail.com git://git.kernel.dk/linux-block 3ecd20a9c77c632a5afe4e134781e1629936adab error
2021/10/29 14:47 16m asml.silence@gmail.com git://git.kernel.dk/linux-block 3884b83dff245e41def99ceacca8ed2056baf0a8 OK
2021/10/29 14:46 15m asml.silence@gmail.com git://git.kernel.dk/linux-block for-5.16/io_uring OK

Sample crash report:

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2021/10/29 14:05 linux-next bdcc9f6a5682 2353a3ec .config log report syz KASAN: use-after-free Write in __io_free_req