From nobody Tue Jul 14 12:55:36 2026 Received: from out28-193.mail.aliyun.com (out28-193.mail.aliyun.com [115.124.28.193]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 753FC1CA89; Mon, 18 Mar 2024 06:40:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.193 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710744053; cv=none; b=cOcsSUDHTOO0W3OCfILPGXqXlzFhzGbaKsY2xZMOOsxh24gJDZe/bpk/6uR3vUVyAaVmuIrJBBaRSUlSh+8bzedw2I6knmg3efywNwzqI6+vc8a5wgJDnMAuw/2xjSVkaa8jrKc9igJj+rYEi43kxSbnpmOMhrGMJqa+ZErl3jI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710744053; c=relaxed/simple; bh=lET+dV2s3vXLx1JgKudTV/IW94Mh55GR7FFuMfyGQe4=; h=Date:From:To:Message-ID:Subject:MIME-Version:References: In-Reply-To:Content-Type; b=Au2GXJXT/NzMxluZFIQC71Yw/9MiuZqBkpdfZko5VpQEYOgyIbsBmLho412jB037umkHbRdx/fYWVfo+EdDVEoqqnJHJsj8TrpWeRAKj0g3fAeJgOZpM62JgtCcOFKOT7dwXzYu+kTCZY+d4pSbfh9doYZTgd0U0dUCzq+7x4Vc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ubisectech.com; spf=pass smtp.mailfrom=ubisectech.com; arc=none smtp.client-ip=115.124.28.193 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ubisectech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ubisectech.com X-Alimail-AntiSpam: AC=CONTINUE;BC=0.0738943|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.00229654-6.04429e-05-0.997643;FP=0|0|0|0|0|-1|-1|-1;HT=ay29a033018047193;MF=bugreport@ubisectech.com;NM=1;PH=DW;RN=3;RT=3;SR=0;TI=W4_0.2.3_v5_21475FC9_1710743712799_o7001c80k; Received: from WS-web (bugreport@ubisectech.com[W4_0.2.3_v5_21475FC9_1710743712799_o7001c80k]) at Mon, 18 Mar 2024 14:35:25 +0800 Date: Mon, 18 Mar 2024 14:35:25 +0800 From: "Ubisectech Sirius" To: "Jens Axboe" , "linux-kernel" , "linux-trace-kernel" Reply-To: "Ubisectech Sirius" Message-ID: <922a9ee9-9da6-4219-9e96-fe7d7198c0b6.bugreport@ubisectech.com> Subject: =?UTF-8?B?5Zue5aSN77yaS0FTQU46IG51bGwtcHRyLWRlcmVmIFdyaXRlIGluIHRjdHhfdGFza193b3Jr?= =?UTF-8?B?X3J1bg==?= X-Mailer: [Alimail-Mailagent revision 13][W4_0.2.3][v5][Chrome] Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <4fb30f6c-cd4c-4fcc-97ad-7132a503f7f7.bugreport@ubisectech.com>,<30d89cd2-7748-4285-a1c5-e1724bf5ec31@kernel.dk> x-aliyun-mail-creator: W4_0.2.3_v5_M3LTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjAuMCBTYWZhcmkvNTM3LjM2vN In-Reply-To: <30d89cd2-7748-4285-a1c5-e1724bf5ec31@kernel.dk> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" > I think you snipped the fault injection that came before this. It looks > like an allocation failure, so we don't get tsk->io_uring setup for the > SQPOLL thread. Not a great way to handle this, but can you try the > below? Would be nicer if we could just prune the task rather than wake > it and have it error. Hi. The issue does not appear again when I apply the patch to the Linux kerne= l. On 3/17/24 6:59 PM, Ubisectech Sirius wrote: > Hello. > We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec.= Recently, our team has discovered a issue in Linux kernel 6.8.0-ge5e038b7a= e9d. Attached to the email were a POC file of the issue. >=20 > Stack dump: >=20 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/= instrumented.h:96 [inline] > BUG: KASAN: null-ptr-deref in llist_del_all include/linux/llist.h:266 [in= line] > BUG: KASAN: null-ptr-deref in tctx_task_work_run+0x7d/0x330 io_uring/io_u= ring.c:1267 > Write of size 8 at addr 00000000000001c0 by task iou-sqp-215603/215604 >=20 > CPU: 0 PID: 215604 Comm: iou-sqp-215603 Not tainted 6.8.0-ge5e038b7ae9d #= 40 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/0= 1/2014 > Call Trace: > > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:114 > kasan_report+0xbd/0xf0 mm/kasan/report.c:601 > check_region_inline mm/kasan/generic.c:183 [inline] > kasan_check_range+0xf4/0x1a0 mm/kasan/generic.c:189 > instrument_atomic_read_write include/linux/instrumented.h:96 [inline] > llist_del_all include/linux/llist.h:266 [inline] > tctx_task_work_run+0x7d/0x330 io_uring/io_uring.c:1267 > io_sq_tw+0x12a/0x1d0 io_uring/sqpoll.c:245 > io_sq_thread+0x8d7/0x18a0 io_uring/sqpoll.c:308 > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > Kernel panic - not syncing: KASAN: panic_on_warn set ... > CPU: 0 PID: 215604 Comm: iou-sqp-215603 Not tainted 6.8.0-ge5e038b7ae9d #= 40 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/0= 1/2014 I think you snipped the fault injection that came before this. It looks like an allocation failure, so we don't get tsk->io_uring setup for the SQPOLL thread. Not a great way to handle this, but can you try the below? Would be nicer if we could just prune the task rather than wake it and have it error. diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c index 363052b4ea76..db7b0fdfe1cb 100644 --- a/io_uring/sqpoll.c +++ b/io_uring/sqpoll.c @@ -274,6 +274,10 @@ static int io_sq_thread(void *data) char buf[TASK_COMM_LEN]; DEFINE_WAIT(wait); =20 + /* offload context creation failed, just exit */ + if (!current->io_uring) { + goto err_out; + snprintf(buf, sizeof(buf), "iou-sqp-%d", sqd->task_pid); set_task_comm(current, buf); =20 @@ -371,7 +375,7 @@ static int io_sq_thread(void *data) atomic_or(IORING_SQ_NEED_WAKEUP, &ctx->rings->sq_flags); io_run_task_work(); mutex_unlock(&sqd->lock); - +err_out: complete(&sqd->exited); do_exit(0); } --=20 Jens Axboe