syzbot


KASAN: use-after-free Write in io_queue_worker_create
Status: upstream: reported C repro on 2021/12/06 06:43
Reported-by: syzbot+b60c982cb0efc5e05a47@syzkaller.appspotmail.com
Fix commit: 71a85387546e io-wq: check for wq exit after adding new worker task_work e47498afeca9 io-wq: remove spurious bit clear on task_work addition
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 50d, last: 39d

Cause bisection: introduced by (bisect log) [no-op commit]:
commit 360d1b65449356f56287e49d1b3d7579e758ca29
Author: Ian Chen <ian.chen@amd.com>
Date: Thu Jun 24 02:48:43 2021 +0000

  drm/amd/display: Extend dmub_cmd_psr_copy_settings_data struct

Crash: BUG: sleeping function called from invalid context in lock_sock_nested (log)
Repro: C syz .config
Patch testing requests:
Created Duration User Patch Repo Result
2021/12/10 15:33 18m axboe@kernel.dk git://git.kernel.dk/linux-block io_uring-5.16 OK
2021/12/10 05:26 17m axboe@kernel.dk git://git.kernel.dk/linux-block io_uring-5.16 report log

Sample crash report:

Crashes (132):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2021/12/10 10:14 upstream c741e49150db 4d4ce9bc .config log report syz C KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 05:20 upstream c741e49150db 4d4ce9bc .config log report syz C KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/12 05:48 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-selinux-root 2021/12/12 03:21 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/12 00:02 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/11 19:50 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/11 14:07 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/11 12:50 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/11 11:30 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/11 08:27 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce 2021/12/11 06:34 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce 2021/12/11 04:23 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/11 00:04 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce 2021/12/10 22:44 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-selinux-root 2021/12/10 20:58 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce 2021/12/10 19:35 upstream c741e49150db 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 17:51 upstream c741e49150db 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 16:35 upstream c741e49150db 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-selinux-root 2021/12/10 15:45 upstream c741e49150db 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-qemu-upstream 2021/12/10 14:34 upstream c741e49150db fc17c959 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/10 07:57 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/10 06:24 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-selinux-root 2021/12/10 04:47 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 03:44 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/10 03:39 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 02:35 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 02:31 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/10 01:59 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-qemu-upstream 2021/12/10 01:32 upstream ded746bfc943 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-root 2021/12/10 00:54 upstream c741e49150db b54aa474 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce 2021/12/10 00:53 upstream c741e49150db b54aa474 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/10 00:30 upstream c741e49150db b54aa474 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce 2021/12/10 00:15 upstream c741e49150db b54aa474 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-selinux-root 2021/12/10 00:05 upstream c741e49150db b54aa474 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-smack-root 2021/12/10 00:02 upstream c741e49150db b54aa474 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-qemu-upstream 2021/12/06 02:58 upstream 944207047ca4 a617004c .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-qemu-upstream 2021/12/04 18:41 upstream bbef3c7a63d2 a617004c .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-qemu-upstream-386 2021/12/11 17:32 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-386 2021/12/11 16:28 upstream 6f513529296f 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-386 2021/12/11 09:27 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-386 2021/12/10 21:37 upstream b8a98b6bf66a 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-kasan-gce-386 2021/12/10 03:31 upstream c741e49150db 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-qemu-upstream-386 2021/12/10 01:16 upstream ded746bfc943 4d4ce9bc .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/15 18:09 linux-next ea922272cbe5 572bcb40 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/15 05:21 linux-next ea922272cbe5 f752fb53 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/14 21:50 linux-next ea922272cbe5 d018dd31 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/14 10:04 linux-next ea922272cbe5 5d14b1ea .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/13 22:02 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/13 18:23 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/13 14:42 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/13 12:42 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/13 00:40 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/12 09:27 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/11 05:29 linux-next ea922272cbe5 49ca1f59 .config log report info KASAN: use-after-free Write in io_queue_worker_create
ci-upstream-linux-next-kasan-gce-root 2021/12/12 16:10 linux-next ea922272cbe5 49ca1f59 .config log report info KFENCE: use-after-free in io_queue_worker_create