Re: [syzbot] [io-uring?] WARNING in __io_uring_free

[Matthew Wilcox]

On Fri, Nov 29, 2024 at 12:30:35AM +0100, Jann Horn wrote:
> > ------------[ cut here ]------------
> > WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51
> 
> This warning is a check for WARN_ON_ONCE(!xa_empty(&tctx->xa)); and as
> Jens pointed out, this was triggered after error injection caused a
> memory allocation inside xa_store() to fail.
> 
> Is there maybe an issue where xa_store() can fail midway through while
> allocating memory for the xarray, so that xa_empty() is no longer true
> even though there is nothing in the xarray? (And if yes, is that
> working as intended?)

Yes, that's a known possibility.  We have similar problems when people
use error injection with mapping->i_pages.  The effort to fix it seems
disproportionate to the severity of the problem.