Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote

[syzbot <syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com>]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Write in rht_lock

bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: use-after-free in test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline]
BUG: KASAN: use-after-free in bit_spin_lock include/linux/bit_spinlock.h:40 [inline]
BUG: KASAN: use-after-free in rht_lock_nested include/linux/rhashtable.h:330 [inline]
BUG: KASAN: use-after-free in rht_lock+0x74/0x19c include/linux/rhashtable.h:339
Write of size 8 at addr ffff000139838a68 by task kworker/u8:7/1394

CPU: 1 UID: 0 PID: 1394 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Workqueue: netns cleanup_net
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
 test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline]
 bit_spin_lock include/linux/bit_spinlock.h:40 [inline]
 rht_lock_nested include/linux/rhashtable.h:330 [inline]
 rht_lock+0x74/0x19c include/linux/rhashtable.h:339
 __rhashtable_remove_fast_one include/linux/rhashtable.h:1069 [inline]
 __rhashtable_remove_fast include/linux/rhashtable.h:1150 [inline]
 rhashtable_remove_fast include/linux/rhashtable.h:1179 [inline]
 tipc_sk_remove net/tipc/socket.c:3051 [inline]
 tipc_release+0x54c/0x10d0 net/tipc/socket.c:648
 __sock_release+0xf8/0x1d4 net/socket.c:735
 sock_release+0x24/0x34 net/socket.c:763
 tipc_topsrv_stop net/tipc/topsrv.c:770 [inline]
 tipc_topsrv_exit_net+0x224/0x26c net/tipc/topsrv.c:782
 ops_exit_list net/core/net_namespace.c:200 [inline]
 ops_undo_list+0x3cc/0x81c net/core/net_namespace.c:253
 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:708
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3578
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3659
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x179838
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffdffc4e60e08 fffffdffc4e60e08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff000139838900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff000139838980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff000139838a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                          ^
 ffff000139838a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff000139838b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state


Tested on:

commit:         58c1eb84 arm64: sdei: Preserve the interrupted context..
git tree:       https://github.com/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1356e03d580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a58b6b4d667e7a61
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64

Note: no patches were applied.