* [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
@ 2026-10-19 1:46 kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
0 siblings, 1 reply; 6+ messages in thread
From: kernel test robot @ 2026-10-19 1:46 UTC (permalink / raw)
To: Oleg Nesterov
Cc: oe-lkp, lkp, linux-kernel, Joel Granados, linux-m68k, linux-s390,
linux-fsdevel, netdev, wireguard, yi1.lai, achender
Hello,
kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
in testcase: boot
config: x86_64-randconfig-2300-20261014
compiler: gcc-14
test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <yi1.lai@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
[ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
[ 35.688893][ T1]
[ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
[ 35.688893][ T1] Call Trace:
[ 35.688893][ T1] <TASK>
[ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] print_address_description+0x51/0x300
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] print_report (kasan/report.c:482)
[ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
[ 35.688893][ T1] ? fixup_red_left (slub.c:250)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] kasan_report (kasan/report.c:595)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
[ 35.688893][ T1] ? xa_load (xarray.c:1621)
[ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
[ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
[ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
[ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
[ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
[ 35.688893][ T1] ? rds_init (af_rds.c:?)
[ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
[ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
[ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
[ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
[ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? rds_init (af_rds.c:?)
[ 35.688893][ T1] do_one_initcall (main.c:1347)
[ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
[ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
[ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
[ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
[ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] kernel_init (main.c:1548)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
[ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1] </TASK>
[ 35.688893][ T1]
[ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
[ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
[ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
[ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
[ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
[ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
[ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
[ 35.688893][ T1] rds_init (rds/af_rds.c:961)
[ 35.688893][ T1] do_one_initcall (main.c:1347)
[ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
[ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
[ 35.688893][ T1] kernel_init (main.c:1548)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1]
[ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
[ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
[ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
[ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
[ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
[ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
[ 35.688893][ T1] handle_softirqs (softirq.c:622)
[ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
[ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
[ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
[ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
[ 35.688893][ T1]
[ 35.688893][ T1] Last potentially related work creation:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
[ 35.688893][ T1] __call_rcu_common+0xe6/0x480
[ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
[ 35.688893][ T1] kthread (kthread.c:436)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1]
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1]
[ 35.688893][ T1] The buggy address belongs to the physical page:
[ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
[ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
[ 35.688893][ T1] page_type: f5(slab)
[ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
[ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
[ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
[ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 35.688893][ T1] page dumped because: kasan: bad access detected
[ 35.688893][ T1]
[ 35.688893][ T1] Memory state around the buggy address:
[ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ^
[ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ==================================================================
[ 35.984299][ T1] Disabling lock debugging due to kernel taint
[ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
[ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
[ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
[ 35.988482][ T1] Tainted: [B]=BAD_PAGE
[ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
[ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
All code
========
0: 3b 58 81 cmp -0x7f(%rax),%ebx
3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
1b: 08
1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
21: 31 d2 xor %edx,%edx
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
2d: 48 89 f8 mov %rdi,%rax
30: 83 e0 07 and $0x7,%eax
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
@ 2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
0 siblings, 1 reply; 6+ messages in thread
From: Oleg Nesterov @ 2026-10-19 11:41 UTC (permalink / raw)
To: kernel test robot
Cc: oe-lkp, lkp, linux-kernel, Joel Granados, linux-m68k, linux-s390,
linux-fsdevel, netdev, wireguard, achender
On 10/19, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
>
> commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
I don't think that commit could cause such a problem. Please re-check.
Oleg.
> [test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
>
> in testcase: boot
>
> config: x86_64-randconfig-2300-20261014
> compiler: gcc-14
> test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <yi1.lai@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
>
>
> [ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
> [ 35.688893][ T1]
> [ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> [ 35.688893][ T1] Call Trace:
> [ 35.688893][ T1] <TASK>
> [ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] print_address_description+0x51/0x300
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] print_report (kasan/report.c:482)
> [ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
> [ 35.688893][ T1] ? fixup_red_left (slub.c:250)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] kasan_report (kasan/report.c:595)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
> [ 35.688893][ T1] ? xa_load (xarray.c:1621)
> [ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
> [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
> [ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
> [ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
> [ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
> [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> [ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
> [ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
> [ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
> [ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
> [ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> [ 35.688893][ T1] do_one_initcall (main.c:1347)
> [ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
> [ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
> [ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
> [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] kernel_init (main.c:1548)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
> [ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1] </TASK>
> [ 35.688893][ T1]
> [ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> [ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
> [ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
> [ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
> [ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
> [ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
> [ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
> [ 35.688893][ T1] rds_init (rds/af_rds.c:961)
> [ 35.688893][ T1] do_one_initcall (main.c:1347)
> [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> [ 35.688893][ T1] kernel_init (main.c:1548)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1]
> [ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> [ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
> [ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
> [ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
> [ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
> [ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
> [ 35.688893][ T1] handle_softirqs (softirq.c:622)
> [ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
> [ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
> [ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
> [ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
> [ 35.688893][ T1]
> [ 35.688893][ T1] Last potentially related work creation:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
> [ 35.688893][ T1] __call_rcu_common+0xe6/0x480
> [ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
> [ 35.688893][ T1] kthread (kthread.c:436)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1]
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1]
> [ 35.688893][ T1] The buggy address belongs to the physical page:
> [ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
> [ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
> [ 35.688893][ T1] page_type: f5(slab)
> [ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> [ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> [ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> [ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> [ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
> [ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> [ 35.688893][ T1] page dumped because: kasan: bad access detected
> [ 35.688893][ T1]
> [ 35.688893][ T1] Memory state around the buggy address:
> [ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ^
> [ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ==================================================================
> [ 35.984299][ T1] Disabling lock debugging due to kernel taint
> [ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
> [ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
> [ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> [ 35.988482][ T1] Tainted: [B]=BAD_PAGE
> [ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
> [ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
> All code
> ========
> 0: 3b 58 81 cmp -0x7f(%rax),%ebx
> 3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
> 7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
> d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
> 14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
> 1b: 08
> 1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
> 21: 31 d2 xor %edx,%edx
> 23: 48 89 fa mov %rdi,%rdx
> 26: 48 c1 ea 03 shr $0x3,%rdx
> 2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
> 2d: 48 89 f8 mov %rdi,%rax
> 30: 83 e0 07 and $0x7,%eax
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
>
>
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 11:41 ` Oleg Nesterov
@ 2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
0 siblings, 1 reply; 6+ messages in thread
From: Joel Granados @ 2026-10-19 13:30 UTC (permalink / raw)
To: Oleg Nesterov
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, achender
[-- Attachment #1: Type: text/plain, Size: 13153 bytes --]
On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> On 10/19, kernel test robot wrote:
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> >
> > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
>
> I don't think that commit could cause such a problem. Please re-check.
>
> Oleg.
That commit might not be the one that introduces the UAF, but it might
be the one that exposes it?
You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
returns -ENOMEM.
If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
already been freed by the failed rds_sysctl_init. Right?
Please let me know if I missed anything.
Best
>
> > [test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
> >
> > in testcase: boot
> >
> > config: x86_64-randconfig-2300-20261014
> > compiler: gcc-14
> > test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
> >
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> >
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <yi1.lai@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
> >
> >
> > [ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> > [ 35.688893][ T1] Call Trace:
> > [ 35.688893][ T1] <TASK>
> > [ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] print_address_description+0x51/0x300
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] print_report (kasan/report.c:482)
> > [ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
> > [ 35.688893][ T1] ? fixup_red_left (slub.c:250)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] kasan_report (kasan/report.c:595)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
> > [ 35.688893][ T1] ? xa_load (xarray.c:1621)
> > [ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
> > [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
> > [ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
> > [ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
> > [ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
> > [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> > [ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
> > [ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
> > [ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
> > [ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
> > [ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> > [ 35.688893][ T1] do_one_initcall (main.c:1347)
> > [ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
> > [ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
> > [ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
> > [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> > [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] kernel_init (main.c:1548)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
> > [ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1] </TASK>
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> > [ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
> > [ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
> > [ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
> > [ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
> > [ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
> > [ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
> > [ 35.688893][ T1] rds_init (rds/af_rds.c:961)
> > [ 35.688893][ T1] do_one_initcall (main.c:1347)
> > [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> > [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> > [ 35.688893][ T1] kernel_init (main.c:1548)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> > [ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
> > [ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
> > [ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
> > [ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
> > [ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
> > [ 35.688893][ T1] handle_softirqs (softirq.c:622)
> > [ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
> > [ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
> > [ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
> > [ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Last potentially related work creation:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
> > [ 35.688893][ T1] __call_rcu_common+0xe6/0x480
> > [ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
> > [ 35.688893][ T1] kthread (kthread.c:436)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] The buggy address belongs to the physical page:
> > [ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
> > [ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > [ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
> > [ 35.688893][ T1] page_type: f5(slab)
> > [ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> > [ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> > [ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> > [ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> > [ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
> > [ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> > [ 35.688893][ T1] page dumped because: kasan: bad access detected
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Memory state around the buggy address:
> > [ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ^
> > [ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ==================================================================
> > [ 35.984299][ T1] Disabling lock debugging due to kernel taint
> > [ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
> > [ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
> > [ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> > [ 35.988482][ T1] Tainted: [B]=BAD_PAGE
> > [ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
> > [ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
> > All code
> > ========
> > 0: 3b 58 81 cmp -0x7f(%rax),%ebx
> > 3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
> > 7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
> > d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
> > 14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
> > 1b: 08
> > 1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
> > 21: 31 d2 xor %edx,%edx
> > 23: 48 89 fa mov %rdi,%rdx
> > 26: 48 c1 ea 03 shr $0x3,%rdx
> > 2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
> > 2d: 48 89 f8 mov %rdi,%rax
> > 30: 83 e0 07 and $0x7,%eax
> >
> >
> > The kernel config and materials to reproduce are available at:
> > https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
> >
> >
> >
> > --
> > 0-DAY CI Kernel Test Service
> > https://github.com/intel/lkp-tests/wiki
> >
> >
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 13:30 ` Joel Granados
@ 2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
0 siblings, 1 reply; 6+ messages in thread
From: Oleg Nesterov @ 2026-10-19 14:49 UTC (permalink / raw)
To: Joel Granados, Allison Henderson
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On 10/19, Joel Granados wrote:
>
> On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> > On 10/19, kernel test robot wrote:
> > >
> > >
> > > Hello,
> > >
> > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> > >
> > > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> >
> > I don't think that commit could cause such a problem. Please re-check.
> >
> > Oleg.
>
> That commit might not be the one that introduces the UAF, but it might
> be the one that exposes it?
>
> You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
> Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
> returns -ENOMEM.
>
> If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
> rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
> already been freed by the failed rds_sysctl_init. Right?
>
> Please let me know if I missed anything.
I think you are right...
rds_init() does
rds_threads_init()
rds_wq = create_singlethread_workqueue("krdsd");
rds_sysctl_init()
fails due to CONFIG_SYSCTL=n
out_threads:
destroy_workqueue(rds_wq);
After that any access to rds_wq is wrong.
If rds_rdma_init() runs after that, rds_ib_init() will call
rds_ib_unregister_client() -> flush_workqueue(rds_wq).
And this will equally happen before the blamed commit 8d75c338f0bc,
just you need CONFIG_PROC_SYSCTL=n instead of CONFIG_SYSCTL=n.
But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
rds_sysctl_init(), so to me this looks like a bug in net/rds/.
In any case, I guess net/rds/ init paths should not fail if
CONFIG_SYSCTL=n ?
Oleg.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 14:49 ` Oleg Nesterov
@ 2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
0 siblings, 1 reply; 6+ messages in thread
From: Oleg Nesterov @ 2026-10-19 15:35 UTC (permalink / raw)
To: Joel Granados, Allison Henderson
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On 10/19, Oleg Nesterov wrote:
>
> But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> rds_sysctl_init(), so to me this looks like a bug in net/rds/.
>
>
> In any case, I guess net/rds/ init paths should not fail if
> CONFIG_SYSCTL=n ?
So I think that something like the uncompiled/untested patch below makes
sense anyway even if doesn't fix all the potential problems with rds_wq.
What do you think?
Oleg.
---
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 2af678e71e3c..bccdb5c4df1d 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -36,19 +36,10 @@
#include "ib.h"
-static struct ctl_table_header *rds_ib_sysctl_hdr;
-
unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
-static unsigned long rds_ib_sysctl_max_wr_min = 1;
-/* hardware will fail CQ creation long before this */
-static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
-
unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
-static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
-static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
-
/*
* This sysctl does nothing.
*
@@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
*/
unsigned int rds_ib_sysctl_flow_control = 0;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_ib_sysctl_max_wr_min = 1;
+/* hardware will fail CQ creation long before this */
+static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
+
+static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
+static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
+
static struct ctl_table rds_ib_sysctl_table[] = {
{
.procname = "max_send_wr",
@@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
},
};
+static struct ctl_table_header *rds_ib_sysctl_hdr;
+
void rds_ib_sysctl_exit(void)
{
if (rds_ib_sysctl_hdr)
@@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_ib_sysctl_exit(void)
+{
+}
+
+int rds_ib_sysctl_init(void)
+{
+ return 0;
+}
+#endif
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 025f518a4349..a0673a41633a 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -36,11 +36,6 @@
#include "rds.h"
-static struct ctl_table_header *rds_sysctl_reg_table;
-
-static unsigned long rds_sysctl_reconnect_min = 1;
-static unsigned long rds_sysctl_reconnect_max = ~0UL;
-
unsigned long rds_sysctl_reconnect_min_jiffies;
unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
@@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
unsigned int rds_sysctl_ping_enable = 1;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_sysctl_reconnect_min = 1;
+static unsigned long rds_sysctl_reconnect_max = ~0UL;
+
static struct ctl_table rds_sysctl_rds_table[] = {
{
.procname = "reconnect_min_delay_ms",
@@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
},
};
+static struct ctl_table_header *rds_sysctl_reg_table;
+
void rds_sysctl_exit(void)
{
unregister_net_sysctl_table(rds_sysctl_reg_table);
@@ -107,3 +108,15 @@ int rds_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_sysctl_exit(void)
+{
+}
+
+int rds_sysctl_init(void)
+{
+ return 0;
+}
+#endif
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 15:35 ` Oleg Nesterov
@ 2026-10-19 19:52 ` Allison Henderson
0 siblings, 0 replies; 6+ messages in thread
From: Allison Henderson @ 2026-10-19 19:52 UTC (permalink / raw)
To: Oleg Nesterov, Joel Granados
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On Mon, 2026-10-19 at 17:35 +0200, Oleg Nesterov wrote:
> On 10/19, Oleg Nesterov wrote:
Hi Oleg, Joel,
Thanks for running this down. Agreed we shouldn't just fail to init because
sysctl is off. Some comments below:
> >
> > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> >
Yes that's a separate bug, so I'll send a separate fix for that.
> >
> > In any case, I guess net/rds/ init paths should not fail if
> > CONFIG_SYSCTL=n ?
>
> So I think that something like the uncompiled/untested patch below makes
> sense anyway even if doesn't fix all the potential problems with rds_wq.
>
> What do you think?
>
> Oleg.
> ---
>
> diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> index 2af678e71e3c..bccdb5c4df1d 100644
> --- a/net/rds/ib_sysctl.c
> +++ b/net/rds/ib_sysctl.c
> @@ -36,19 +36,10 @@
>
> #include "ib.h"
>
> -static struct ctl_table_header *rds_ib_sysctl_hdr;
> -
> unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
> unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
> unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> -/* hardware will fail CQ creation long before this */
> -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> -
> unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> -
> /*
> * This sysctl does nothing.
> *
> @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> */
> unsigned int rds_ib_sysctl_flow_control = 0;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> +/* hardware will fail CQ creation long before this */
> +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> +
> +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> +
> static struct ctl_table rds_ib_sysctl_table[] = {
> {
> .procname = "max_send_wr",
> @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_ib_sysctl_hdr;
> +
> void rds_ib_sysctl_exit(void)
> {
> if (rds_ib_sysctl_hdr)
> @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
The real rds_sysctl_init() also does the runtime setup of
rds_sysctl_reconnect_min_jiffies (msecs_to_jiffies(1)). Without
it, the reconnect back off is lost.
Also, if register_net_sysctl_sz() returns NULL in rds_tcp_init_net(),
it fails as an -ENOMEM. So RDS/TCP would still fail to come up with
CONFIG_SYSCTL=n. A simpler fix might be to just handle the NULL at the
three call sites, e.g.:
rds_sysctl_reg_table =
register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
return -ENOMEM;
And same for rds_ib_sysctl_init() and rds_tcp_init_net(). The exit
paths are ok, since unregister_net_sysctl_table() is already a
no-op stub when sysctl is off.
Let me know if you want to respin or if you'd rather I send it.
Either way is fine with me.
Thanks
Allison
> +
> +#else
> +
> +void rds_ib_sysctl_exit(void)
> +{
> +}
> +
> +int rds_ib_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
> diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> index 025f518a4349..a0673a41633a 100644
> --- a/net/rds/sysctl.c
> +++ b/net/rds/sysctl.c
> @@ -36,11 +36,6 @@
>
> #include "rds.h"
>
> -static struct ctl_table_header *rds_sysctl_reg_table;
> -
> -static unsigned long rds_sysctl_reconnect_min = 1;
> -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> -
> unsigned long rds_sysctl_reconnect_min_jiffies;
> unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
>
> @@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
>
> unsigned int rds_sysctl_ping_enable = 1;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_sysctl_reconnect_min = 1;
> +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> +
> static struct ctl_table rds_sysctl_rds_table[] = {
> {
> .procname = "reconnect_min_delay_ms",
> @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_sysctl_reg_table;
> +
> void rds_sysctl_exit(void)
> {
> unregister_net_sysctl_table(rds_sysctl_reg_table);
> @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
> +
> +#else
> +
> +void rds_sysctl_exit(void)
> +{
> +}
> +
> +int rds_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-19 19:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®