Re: [PATCH] io_uring/io-wq: save worker type before dropping its reference

[Jens Axboe]

On 10/29/26 10:21 PM, Kyle Zeng wrote:
> io_wq_cancel_tw_create() inspects cb->func after calling
> io_worker_cancel_cb(). For an existing worker, that call can drop the
> last worker reference and wake io_worker_exit(). If the canceling task
> is preempted, the worker can be unlinked and freed by kfree_rcu() before
> the callback function is inspected. KASAN reports a slab-use-after-free
> read in this path.
> 
> Save whether the callback belongs to an unpublished continuation worker
> while its reference is still held, then use the saved result for the
> conditional free. This preserves the existing accounting and frees only
> the worker allocated for the canceled continuation.

This is already posted and queued up:

https://lore.kernel.org/io-uring/20261028164732.1264069-10-axboe@xxxxxxxxx/T/#u

-- 
Jens Axboe