Received-SPF: pass (google.com: domain of linux-kernel+bounces-176891-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Precedence: bulk
MIME-Version: 1.0
References: <CABOYnLy5WHJBjk33pzr12w5e7CDGb43LhQ5zQow0on4pCYusjw@mail.gmail.com>
 <20240511233404.2764-1-hdanton@sina.com> <CABOYnLzuu=i42tX-VSbTKJBfU=orsXa3Q5kCELOCsOFZCSdAaQ@mail.gmail.com>
In-Reply-To: <CABOYnLzuu=i42tX-VSbTKJBfU=orsXa3Q5kCELOCsOFZCSdAaQ@mail.gmail.com>
From: lee bruce <xrivendell7@gmail.com>
Date: Sun, 12 May 2024 21:36:56 +0800
Message-ID: <CABOYnLxHfNwD_9WthyVS+9xhczUxFYkpAhRQ0mNugwzqwzZwiw@mail.gmail.com>
Subject: Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in
 kill_orphaned_pgrp (2)
To: Hillf Danton <hdanton@sina.com>
Cc: syzbot+68619f9e9e69accd8e0a@syzkaller.appspotmail.com, 
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, 
	Edward Adam Davis <eadavis@qq.com>, clf700383@gmail.com, michael.christie@oracle.com, 
	mst@redhat.com, luto@kernel.org, peterz@infradead.org, 
	Thomas Gleixner <tglx@linutronix.de>, ebiederm@xmission.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi.

2024=E5=B9=B45=E6=9C=8812=E6=97=A5 09:40=EF=BC=8Clee bruce <xrivendell7@gma=
il.com> =E5=86=99=E9=81=93=EF=BC=9A

Hi.

Hillf Danton <hdanton@sina.com> =E4=BA=8E2024=E5=B9=B45=E6=9C=8812=E6=97=A5=
=E5=91=A8=E6=97=A5 07:34=E5=86=99=E9=81=93=EF=BC=9A


On Sat, 11 May 2024 22:45:06 +0800 lee bruce <xrivendell7@gmail.com>

Hello, I found a reproducer for this bug.

Thanks for your report.

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrivendell7@gmail.com>
Reported-by: lingfei cheng <clf700383@gmail.com>

I use the same kernel as syzbot instance
Kernel Commit: upstream dccb07f2914cdab2ac3a5b6c98406f765acab803
Kernel Config: https://syzkaller.appspot.com/text?tag=3D3DKernelConfig&x=3D=
3D6d14c12b661fb43
with KASAN enabled

Since the same title bug is triggered in
https://syzkaller.appspot.com/bug?id=3D3D70492b96ff47ff70cfc433be1005861193=
10670b.
I make a simple RCA.
In the old-syzbot instance the bug still trigger the title "KASAN:
slab-use-after-free Read in kill_orphaned_pgrp=3DE2=3D80=3D9D and in the la=
stest
syzbot the bug report as

TITLE: WARNING in signal_wake_up_state
------------[ cut here ]------------
WARNING: CPU: 3 PID: 8591 at kernel/signal.c:762
signal_wake_up_state+0xf8/0x130 kernel/signal.c:762
Modules linked in:
CPU: 3 PID: 8591 Comm: file0 Not tainted 6.9.0-rc7-00012-gdccb07f2914c #6


Could you reproduce it in the next tree, because of d558664602d3 ("vhost_ta=
sk:
Handle SIGKILL by flushing work and exiting") adding reaction to signal?

I test the kernel linux-next: d558664602d3906866e604a618dcf67f66d79967
and comfired reproducer and didn=E2=80=99t trigger any crashes.
I notice maybe this bug is duplicated with
https://syzkaller.appspot.com/bug?extid=3D98edc2df894917b3431f and
https://syzkaller.appspot.com/bug?extid=3Dc6d438f2d77f96cae7c2.
Should we need to close or tag duplicated or fix to them?

Ok, I'll try.

Best Regards,
xingwei lee