Re: [linus:master] [blk] 22465bbac5: BUG:KASAN:slab-use-after-free_in__cpuhp_state_add_instance_cpuslocked

[Oliver Sang]

hi, Ming,

On Wed, Dec 18, 2024 at 10:00:56AM +0800, Ming Lei wrote:
> On Tue, Dec 17, 2024 at 10:20:47PM +0800, kernel test robot wrote:
> > 
> > 
> > Hello,
> > 
> > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__cpuhp_state_add_instance_cpuslocked" on:
> > 
> > commit: 22465bbac53c821319089016f268a2437de9b00a ("blk-mq: move cpuhp callback registering out of q->sysfs_lock")
> > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> > 
> > [test failed on linus/master      231825b2e1ff6ba799c5eaf396d3ab2354e37c6b]
> > [test failed on linux-next/master 3e42dc9229c5950e84b1ed705f94ed75ed208228]
> > 
> > in testcase: blktests
> > version: blktests-x86_64-3617edd-1_20241105
> > with following parameters:
> > 
> > 	disk: 1SSD
> > 	test: block-group-01
> > 
> > 
> > 
> > config: x86_64-rhel-9.4-func
> > compiler: gcc-12
> > test machine: 4 threads Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz (Skylake) with 32G memory
> > 
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> > 
> > 
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
> > | Closes: https://lore.kernel.org/oe-lkp/202412172217.b906db7c-lkp@xxxxxxxxx
> > 
> > 
> > [ 232.596698][ T3545] BUG: KASAN: slab-use-after-free in __cpuhp_state_add_instance_cpuslocked (include/linux/list.h:1026 kernel/cpu.c:2446)
> 
> Hello,
> 
> Thanks for the report!
> 
> Unfortunately I can't reproduce it in my test VM by running
> 'blktests block/030' with:
> 
> - two numa nodes
> - enable CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION
> 
> 
> But just figured out that one freed hctx still may stay in cpuhp cb list, can
> you test the following patch?

yes, your patch fixed the issue we reported, and 'blktests block/030' can pass
now. thanks!

Tested-by: kernel test robot <oliver.sang@xxxxxxxxx>

BTW, the config built with the patch is same as for 22465bbac5 when we made
original report, so still with CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION.

> 
> 
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index 92e8ddf34575..f655b34efffe 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -4421,7 +4421,8 @@ static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx(
>  	/* reuse dead hctx first */
>  	spin_lock(&q->unused_hctx_lock);
>  	list_for_each_entry(tmp, &q->unused_hctx_list, hctx_list) {
> -		if (tmp->numa_node == node) {
> +		if (tmp->numa_node == node &&
> +				hlist_unhashed(&tmp->cpuhp_online)) {
>  			hctx = tmp;
>  			break;
>  		}
> 
> 
> thanks,
> Ming
>