Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: BUG: unable to handle kernel paging request in io_wq_cancel_all
To:     syzbot <syzbot+221cc24572a2fed23b6b@syzkaller.appspotmail.com>,
        akpm@linux-foundation.org, dan.j.williams@intel.com,
        dhowells@redhat.com, gregkh@linuxfoundation.org,
        hannes@cmpxchg.org, joel@joelfernandes.org,
        linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org, mchehab+samsung@kernel.org,
        mingo@redhat.com, patrick.bellasi@arm.com, rgb@redhat.com,
        rostedt@goodmis.org, syzkaller-bugs@googlegroups.com,
        viro@zeniv.linux.org.uk, yamada.masahiro@socionext.com
References: <00000000000069801e05961be5fb@google.com>
From:   Jens Axboe <axboe@kernel.dk>
Message-ID: <0e2bc2bf-2a7a-73c5-03e2-9d08f89f0ffa@kernel.dk>
Date:   Wed, 30 Oct 2019 08:41:46 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.9.0
MIME-Version: 1.0
In-Reply-To: <00000000000069801e05961be5fb@google.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 10/30/19 1:44 AM, syzbot wrote:
> syzbot has bisected this bug to:
> 
> commit ef0524d3654628ead811f328af0a4a2953a8310f
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Thu Oct 24 13:25:42 2019 +0000
> 
>       io_uring: replace workqueue usage with io-wq
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16acf5d0e00000
> start commit:   c57cf383 Add linux-next specific files for 20191029
> git tree:       linux-next
> final crash:    https://syzkaller.appspot.com/x/report.txt?x=15acf5d0e00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11acf5d0e00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cb86688f30db053d
> dashboard link: https://syzkaller.appspot.com/bug?extid=221cc24572a2fed23b6b
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=168671d4e00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=140f4898e00000
> 
> Reported-by: syzbot+221cc24572a2fed23b6b@syzkaller.appspotmail.com
> Fixes: ef0524d36546 ("io_uring: replace workqueue usage with io-wq")

Good catch, it's a case of NULL vs ERR_PTR() confusion. I'll fold in
the below fix.


diff --git a/fs/io_uring.c b/fs/io_uring.c
index af1937d66aee..76d653085987 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3534,8 +3534,9 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx,
 	/* Do QD, or 4 * CPUS, whatever is smallest */
 	concurrency = min(ctx->sq_entries, 4 * num_online_cpus());
 	ctx->io_wq = io_wq_create(concurrency, ctx->sqo_mm);
-	if (!ctx->io_wq) {
-		ret = -ENOMEM;
+	if (IS_ERR(ctx->io_wq)) {
+		ret = PTR_ERR(ctx->io_wq);
+		ctx->io_wq = NULL;
 		goto err;
 	}
 

-- 
Jens Axboe