Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 28 Mar 2023 10:48:06 +0800
From:   Pengfei Xu <pengfei.xu@intel.com>
To:     Jens Axboe <axboe@kernel.dk>
CC:     <stable@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <heng.su@intel.com>, <lkp@intel.com>
Subject: Re: [Syzkaller & bisect] There is "io_poll_remove_entries" NULL
 pointer BUG in v6.3-rc4 kernel
Message-ID: <ZCJVZk4nfosZzA1k@xpf.sh.intel.com>
References: <ZCEy5jA2nT/vaO56@xpf.sh.intel.com>
 <d6818b66-e1c8-e2bf-e54f-73d1f83db020@kernel.dk>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <d6818b66-e1c8-e2bf-e54f-73d1f83db020@kernel.dk>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?4HB4Y/GZXnqoiv4tQEw/tl7Hx6eh5fIZbdV7GBL0SpGIE559eFHl6/0sQVpB?=
 =?us-ascii?Q?SymqGMwXAyNVdzCyDjT7T5466YUFuvygYPzHwiEEk0mTGUgxKMXpZtD/qDQF?=
 =?us-ascii?Q?Oe3CukfV/Lx1QW2Lm73hPr+wesD332oUhK2QrK2iyVfxvVgZhdx1VwbxLTvt?=
 =?us-ascii?Q?pgceRNrLeG7SNpWJCDviw2T3b2/57IVZqk//bRdUcsUqwlKGEGAxIje+Mi2w?=
 =?us-ascii?Q?nzs8nooPUDaF+ywAaqEjulcbY5WoI3M80R0ZlLYL6O8xrWdbZhow1d6Ne8jX?=
 =?us-ascii?Q?7lGUpKy0ybbEBqPCLw5lOWhDQ5ACPIVv5RRRbvtK/sT81Qvd83dbvwWlB9KH?=
 =?us-ascii?Q?1kD2j/InFJ3+pVZ5IUELH014HiPFZYLFY3gzP59OXzN/K8aWlKKlWZLmo3Yt?=
 =?us-ascii?Q?FA1uMp4Hvg8fsmYsFXV4kMsH1I59xFOLRkFiULLkBuFJHnEdZGJWbZS6riX4?=
 =?us-ascii?Q?9G4pog1pNlFSX1OF/BG/MFTW/PYcGnctVurx2YwwKkADOEd9WeIMAlK7abVd?=
 =?us-ascii?Q?uXbZFRu84ZZz1LIqvw+wxNnjgROZDKEzc7EpQ8E0UAg1tP6hxNsOpESltjRO?=
 =?us-ascii?Q?V2dOZt/FOSVTJtHqD7ccZxdaz4X77V6bJHlK0lv0yXV+/dbVnQ2yHmomVJxm?=
 =?us-ascii?Q?F2JyCExmu9Y9utIDqJMVQ6GsO1uejxJgNQv3Ds81xHbQJyTOySTbRIbOCTxQ?=
 =?us-ascii?Q?hy5vmhdQjAOuIKZ7aPDuLyEtBpFbOp/tsRcJjL0SuE3sUjXavkG0T/o1CozB?=
 =?us-ascii?Q?tuwEq7vAC2fyuSY1HiVlXayh8rrixZBX3MokkNyhMxlpSrVJXNl8A1hlW10Q?=
 =?us-ascii?Q?3r/NGTUiyKF13zI4FTnTvQxmK/X7yx8YC/r5/TYzTgOxHVTIkKGjXeAe1k5Y?=
 =?us-ascii?Q?j7K2RAWB7MKWVGDLfwotxPByl6qnUD3EG+jl6gcSi7d6mx2fflV0NmANkGi6?=
 =?us-ascii?Q?+OY5ylBlp7cXKRFOaByJjkFMRssdJt8BiwNh02tjiyVxfDJFo3l6lE5yDrd3?=
 =?us-ascii?Q?qfQywlDbZ5bFs5OFBoxCu/vkkWaiALSAgaRdCveUlvGVaN9rTLXRR2IjcDBn?=
 =?us-ascii?Q?YLF/ZF+tgwUfRV1aobgHfuNqAWVk4Gz+Pe/DlOvJGX6bAoPcEukvbwr7NUfB?=
 =?us-ascii?Q?An3jhzejjN4mLeP0DfrOVDNi1PvKu7yq21bIn/rWns8pIn660fvfp+9wS/Ek?=
 =?us-ascii?Q?B/1ls2Kb+WBqgRTgUhWKlqbmn9g6r2ifGvC+HDuOq0CYPWa2qra8GooezhR1?=
 =?us-ascii?Q?01Qda6kmAelU8T+65xpdrXa5IbKZ9nZF5h7ngYNsYo7BO8LUzcxSzkOsZXFv?=
 =?us-ascii?Q?2WqvmUpQnj1AtDjZd5NHLpIHzDRtMHuipmdmGYAn68ydJu/hhpS0NHjj/rjd?=
 =?us-ascii?Q?ITXM1aZllxeuU8SEDmbdpnckq3+bEh+jnrzHF/YrH6w+XgkC1PYWHVVlfQdm?=
 =?us-ascii?Q?UWeHz3jVDqFxQ5TCV6sudJi/3pgdBaa8s/vCAvuQYsMirlAwfpBW/ulGZbKI?=
 =?us-ascii?Q?j/BTYNSHq10g8snjsfHTYAFdDm+u00Id6CDuwDTGNCMnz5s68D+fXZW8WK1Y?=
 =?us-ascii?Q?4Qpmrd+PWdqZSJTzRi9j5bsqSkQJUZc7s/Ztwnsr?=
X-MS-Exchange-CrossTenant-Network-Message-Id: d3f7cbb0-da13-4f29-e40c-08db2f36a4d4
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4839.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Mar 2023 02:46:34.4508
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NabBJ2jsl+LFdXDWijnNWhP6VZG+WSaLkmBbGlx0NjmOFLVFv+ma0FuxMv+urLxnbuVpRsGeGfjcqEk5c1a5ZQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR11MB5368
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-2.5 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE,
        SPF_NONE autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Jens Axboe,

On 2023-03-27 at 07:35:59 -0600, Jens Axboe wrote:
> On 3/27/23 12:08?AM, Pengfei Xu wrote:
> > Hi Jens Axboe and kernel experts,
> > 
> > Platform: x86 platforms
> > There is "io_poll_remove_entries" NULL pointer BUG in v6.3-rc4 kernel.
> > 
> > All detailed log: https://github.com/xupengfe/syzkaller_logs/tree/main/230327_041425_io_poll_remove_entries
> > Syzkaller reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/230327_041425_io_poll_remove_entries/repro.c
> > Syzkaller analysis report0: https://github.com/xupengfe/syzkaller_logs/blob/main/230327_041425_io_poll_remove_entries/report0
> > Syzkaller analysis status: https://github.com/xupengfe/syzkaller_logs/blob/main/230327_041425_io_poll_remove_entries/repro.stats
> > v6.3-rc4 issue dmesg: https://github.com/xupengfe/syzkaller_logs/blob/main/230327_041425_io_poll_remove_entries/v63rc4_reproduce_dmesg.log
> > Kconfig: https://github.com/xupengfe/syzkaller_logs/blob/main/230327_041425_io_poll_remove_entries/kconfig_origin
> > Bisect info: https://github.com/xupengfe/syzkaller_logs/blob/main/230327_041425_io_poll_remove_entries/bisect_info.log
> > 
> > It could be reproduced in v6.3-rc3 and v6.3-rc4 kernel, and bisected between
> > v6.3-rc3 and v5.11 kernel, bad commit was:
> > "
> > c16bda37594f83147b167d381d54c010024efecf
> > io_uring/poll: allow some retries for poll triggering spuriously
> > "
> > After reverted above commit on top of v6.3-rc3 kernel, this issue was gone.
> 
> This should probably fix it, though I do wonder why this can only
> trigger after that patch. Seems like it would've been possible before
> too.
> 
> 
> diff --git a/io_uring/poll.c b/io_uring/poll.c
> index 795facbd0e9f..90555a22a900 100644
> --- a/io_uring/poll.c
> +++ b/io_uring/poll.c
> @@ -600,7 +600,8 @@ static int __io_arm_poll_handler(struct io_kiocb *req,
>  	mask = vfs_poll(req->file, &ipt->pt) & poll->events;
>  
>  	if (unlikely(ipt->error || !ipt->nr_entries)) {
> -		io_poll_remove_entries(req);
> +		if (ipt->nr_entries)
> +			io_poll_remove_entries(req);
>  
>  		if (!io_poll_can_finish_inline(req, ipt)) {
>  			io_poll_mark_cancelled(req);
> 
  Thanks for your fixed patch in short time!

  After receiving this email, I saw one of your newly improved fixed patch.
  I will verify the new one soon.

  Thanks!
  BR.
  -Pengfei

> -- 
> Jens Axboe
>