Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: KASAN: null-ptr-deref Write in io_wq_cancel_all
From:   Jens Axboe <axboe@kernel.dk>
To:     Dmitry Vyukov <dvyukov@google.com>,
        syzbot <syzbot+d958a65633ea70280b23@syzkaller.appspotmail.com>
Cc:     linux-fsdevel <linux-fsdevel@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
        Al Viro <viro@zeniv.linux.org.uk>
References: <000000000000fbbe1e0595bac322@google.com>
 <CACT4Y+Y946C-kyiBSZtyKY7PU4qxrysOfukd42--pXdyTRyjbw@mail.gmail.com>
 <0e1b3410-95b0-f9d9-6838-486eae0bf5d7@kernel.dk>
Message-ID: <e2eec48d-dcf4-58ba-b463-1651fd3d4f5e@kernel.dk>
Date:   Fri, 25 Oct 2019 08:35:39 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.9.0
MIME-Version: 1.0
In-Reply-To: <0e1b3410-95b0-f9d9-6838-486eae0bf5d7@kernel.dk>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 10/25/19 7:50 AM, Jens Axboe wrote:
> On 10/25/19 5:58 AM, Dmitry Vyukov wrote:
>> On Fri, Oct 25, 2019 at 1:51 PM syzbot
>> <syzbot+d958a65633ea70280b23@syzkaller.appspotmail.com> wrote:
>>>
>>> Hello,
>>>
>>> syzbot found the following crash on:
>>>
>>> HEAD commit:    139c2d13 Add linux-next specific files for 20191025
>>> git tree:       linux-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17ab5a70e00000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=28fd7a693df38d29
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=d958a65633ea70280b23
>>> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>>>
>>> Unfortunately, I don't have any reproducer for this crash yet.
>>>
>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>> Reported-by: syzbot+d958a65633ea70280b23@syzkaller.appspotmail.com
>>
>> +Jens
> 
> Let me know if/when you have a reproducer for this one. I initially thought
> this was a basic NULL pointer check, but it doesn't look like it. I wonder
> if the thread handling the request got a signal, and since it had the
> task file_table with the io_uring fd attached, it's triggering an exit.
> 
> I'll poke at it, but don't immediately see the issue.

Ah, I see it, if we run into work needing to get done as the worker
is exiting, we do that work. But that makes us busy, and we can then
exit the thread without having dropped the mm/files associated with
the original task. I've folded in a fix.

-- 
Jens Axboe