MIME-Version: 1.0
References: <00000000000097fc2305f1ce87d9@google.com> <0000000000001497d605f6e9b6e6@google.com>
In-Reply-To: <0000000000001497d605f6e9b6e6@google.com>
From:   Aleksandr Nogikh <nogikh@google.com>
Date:   Wed, 15 Mar 2023 13:17:23 +0100
Message-ID: <CANp29Y4WhUTNjUF1BPKDcSzUFx4Jb2uMHRsuezSewWZ9czWwtA@mail.gmail.com>
Subject: Re: [syzbot] [io-uring?] KASAN: use-after-free Read in io_worker_get
To:     syzbot <syzbot+55cc59267340fad29512@syzkaller.appspotmail.com>
Cc:     asml.silence@gmail.com, axboe@kernel.dk, io-uring@vger.kernel.org,
        linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Looks reasonable

#syz fix: io_uring/io-wq: only free worker if it was allocated for creation


On Wed, Mar 15, 2023 at 6:35=E2=80=AFAM syzbot
<syzbot+55cc59267340fad29512@syzkaller.appspotmail.com> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit e6db6f9398dadcbc06318a133d4c44a2d3844e61
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Sun Jan 8 17:39:17 2023 +0000
>
>     io_uring/io-wq: only free worker if it was allocated for creation
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=3D108bc2e2c8=
0000
> start commit:   a689b938df39 Merge tag 'block-2023-01-06' of git://git.ke=
r..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3D33ad6720950f9=
96d
> dashboard link: https://syzkaller.appspot.com/bug?extid=3D55cc59267340fad=
29512
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D1532ef72480=
000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D10b43f3a48000=
0
>
> If the result looks correct, please mark the issue as fixed by replying w=
ith:
>
> #syz fix: io_uring/io-wq: only free worker if it was allocated for creati=
on
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisect=
ion
>