* [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
@ 2026-10-19 1:46 kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
0 siblings, 1 reply; 7+ messages in thread
From: kernel test robot @ 2026-10-19 1:46 UTC (permalink / raw)
To: Oleg Nesterov
Cc: oe-lkp, lkp, linux-kernel, Joel Granados, linux-m68k, linux-s390,
linux-fsdevel, netdev, wireguard, yi1.lai, achender
Hello,
kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
in testcase: boot
config: x86_64-randconfig-2300-20261014
compiler: gcc-14
test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <yi1.lai@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
[ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
[ 35.688893][ T1]
[ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
[ 35.688893][ T1] Call Trace:
[ 35.688893][ T1] <TASK>
[ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] print_address_description+0x51/0x300
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] print_report (kasan/report.c:482)
[ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
[ 35.688893][ T1] ? fixup_red_left (slub.c:250)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] kasan_report (kasan/report.c:595)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
[ 35.688893][ T1] ? xa_load (xarray.c:1621)
[ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
[ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
[ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
[ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
[ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
[ 35.688893][ T1] ? rds_init (af_rds.c:?)
[ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
[ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
[ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
[ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
[ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? rds_init (af_rds.c:?)
[ 35.688893][ T1] do_one_initcall (main.c:1347)
[ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
[ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
[ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
[ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
[ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] kernel_init (main.c:1548)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
[ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1] </TASK>
[ 35.688893][ T1]
[ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
[ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
[ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
[ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
[ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
[ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
[ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
[ 35.688893][ T1] rds_init (rds/af_rds.c:961)
[ 35.688893][ T1] do_one_initcall (main.c:1347)
[ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
[ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
[ 35.688893][ T1] kernel_init (main.c:1548)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1]
[ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
[ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
[ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
[ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
[ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
[ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
[ 35.688893][ T1] handle_softirqs (softirq.c:622)
[ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
[ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
[ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
[ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
[ 35.688893][ T1]
[ 35.688893][ T1] Last potentially related work creation:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
[ 35.688893][ T1] __call_rcu_common+0xe6/0x480
[ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
[ 35.688893][ T1] kthread (kthread.c:436)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1]
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1]
[ 35.688893][ T1] The buggy address belongs to the physical page:
[ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
[ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
[ 35.688893][ T1] page_type: f5(slab)
[ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
[ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
[ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
[ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 35.688893][ T1] page dumped because: kasan: bad access detected
[ 35.688893][ T1]
[ 35.688893][ T1] Memory state around the buggy address:
[ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ^
[ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ==================================================================
[ 35.984299][ T1] Disabling lock debugging due to kernel taint
[ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
[ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
[ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
[ 35.988482][ T1] Tainted: [B]=BAD_PAGE
[ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
[ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
All code
========
0: 3b 58 81 cmp -0x7f(%rax),%ebx
3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
1b: 08
1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
21: 31 d2 xor %edx,%edx
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
2d: 48 89 f8 mov %rdi,%rax
30: 83 e0 07 and $0x7,%eax
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
@ 2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
0 siblings, 1 reply; 7+ messages in thread
From: Oleg Nesterov @ 2026-10-19 11:41 UTC (permalink / raw)
To: kernel test robot
Cc: oe-lkp, lkp, linux-kernel, Joel Granados, linux-m68k, linux-s390,
linux-fsdevel, netdev, wireguard, achender
On 10/19, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
>
> commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
I don't think that commit could cause such a problem. Please re-check.
Oleg.
> [test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
>
> in testcase: boot
>
> config: x86_64-randconfig-2300-20261014
> compiler: gcc-14
> test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <yi1.lai@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
>
>
> [ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
> [ 35.688893][ T1]
> [ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> [ 35.688893][ T1] Call Trace:
> [ 35.688893][ T1] <TASK>
> [ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] print_address_description+0x51/0x300
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] print_report (kasan/report.c:482)
> [ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
> [ 35.688893][ T1] ? fixup_red_left (slub.c:250)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] kasan_report (kasan/report.c:595)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
> [ 35.688893][ T1] ? xa_load (xarray.c:1621)
> [ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
> [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
> [ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
> [ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
> [ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
> [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> [ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
> [ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
> [ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
> [ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
> [ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> [ 35.688893][ T1] do_one_initcall (main.c:1347)
> [ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
> [ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
> [ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
> [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] kernel_init (main.c:1548)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
> [ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1] </TASK>
> [ 35.688893][ T1]
> [ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> [ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
> [ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
> [ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
> [ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
> [ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
> [ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
> [ 35.688893][ T1] rds_init (rds/af_rds.c:961)
> [ 35.688893][ T1] do_one_initcall (main.c:1347)
> [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> [ 35.688893][ T1] kernel_init (main.c:1548)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1]
> [ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> [ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
> [ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
> [ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
> [ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
> [ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
> [ 35.688893][ T1] handle_softirqs (softirq.c:622)
> [ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
> [ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
> [ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
> [ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
> [ 35.688893][ T1]
> [ 35.688893][ T1] Last potentially related work creation:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
> [ 35.688893][ T1] __call_rcu_common+0xe6/0x480
> [ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
> [ 35.688893][ T1] kthread (kthread.c:436)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1]
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1]
> [ 35.688893][ T1] The buggy address belongs to the physical page:
> [ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
> [ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
> [ 35.688893][ T1] page_type: f5(slab)
> [ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> [ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> [ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> [ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> [ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
> [ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> [ 35.688893][ T1] page dumped because: kasan: bad access detected
> [ 35.688893][ T1]
> [ 35.688893][ T1] Memory state around the buggy address:
> [ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ^
> [ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ==================================================================
> [ 35.984299][ T1] Disabling lock debugging due to kernel taint
> [ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
> [ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
> [ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> [ 35.988482][ T1] Tainted: [B]=BAD_PAGE
> [ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
> [ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
> All code
> ========
> 0: 3b 58 81 cmp -0x7f(%rax),%ebx
> 3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
> 7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
> d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
> 14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
> 1b: 08
> 1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
> 21: 31 d2 xor %edx,%edx
> 23: 48 89 fa mov %rdi,%rdx
> 26: 48 c1 ea 03 shr $0x3,%rdx
> 2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
> 2d: 48 89 f8 mov %rdi,%rax
> 30: 83 e0 07 and $0x7,%eax
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
>
>
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 11:41 ` Oleg Nesterov
@ 2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
0 siblings, 1 reply; 7+ messages in thread
From: Joel Granados @ 2026-10-19 13:30 UTC (permalink / raw)
To: Oleg Nesterov
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, achender
[-- Attachment #1: Type: text/plain, Size: 13153 bytes --]
On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> On 10/19, kernel test robot wrote:
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> >
> > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
>
> I don't think that commit could cause such a problem. Please re-check.
>
> Oleg.
That commit might not be the one that introduces the UAF, but it might
be the one that exposes it?
You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
returns -ENOMEM.
If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
already been freed by the failed rds_sysctl_init. Right?
Please let me know if I missed anything.
Best
>
> > [test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
> >
> > in testcase: boot
> >
> > config: x86_64-randconfig-2300-20261014
> > compiler: gcc-14
> > test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
> >
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> >
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <yi1.lai@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
> >
> >
> > [ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> > [ 35.688893][ T1] Call Trace:
> > [ 35.688893][ T1] <TASK>
> > [ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] print_address_description+0x51/0x300
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] print_report (kasan/report.c:482)
> > [ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
> > [ 35.688893][ T1] ? fixup_red_left (slub.c:250)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] kasan_report (kasan/report.c:595)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
> > [ 35.688893][ T1] ? xa_load (xarray.c:1621)
> > [ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
> > [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
> > [ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
> > [ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
> > [ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
> > [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> > [ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
> > [ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
> > [ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
> > [ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
> > [ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> > [ 35.688893][ T1] do_one_initcall (main.c:1347)
> > [ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
> > [ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
> > [ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
> > [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> > [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] kernel_init (main.c:1548)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
> > [ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1] </TASK>
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> > [ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
> > [ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
> > [ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
> > [ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
> > [ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
> > [ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
> > [ 35.688893][ T1] rds_init (rds/af_rds.c:961)
> > [ 35.688893][ T1] do_one_initcall (main.c:1347)
> > [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> > [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> > [ 35.688893][ T1] kernel_init (main.c:1548)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> > [ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
> > [ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
> > [ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
> > [ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
> > [ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
> > [ 35.688893][ T1] handle_softirqs (softirq.c:622)
> > [ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
> > [ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
> > [ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
> > [ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Last potentially related work creation:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
> > [ 35.688893][ T1] __call_rcu_common+0xe6/0x480
> > [ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
> > [ 35.688893][ T1] kthread (kthread.c:436)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] The buggy address belongs to the physical page:
> > [ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
> > [ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > [ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
> > [ 35.688893][ T1] page_type: f5(slab)
> > [ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> > [ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> > [ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> > [ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> > [ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
> > [ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> > [ 35.688893][ T1] page dumped because: kasan: bad access detected
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Memory state around the buggy address:
> > [ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ^
> > [ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ==================================================================
> > [ 35.984299][ T1] Disabling lock debugging due to kernel taint
> > [ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
> > [ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
> > [ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> > [ 35.988482][ T1] Tainted: [B]=BAD_PAGE
> > [ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
> > [ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
> > All code
> > ========
> > 0: 3b 58 81 cmp -0x7f(%rax),%ebx
> > 3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
> > 7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
> > d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
> > 14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
> > 1b: 08
> > 1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
> > 21: 31 d2 xor %edx,%edx
> > 23: 48 89 fa mov %rdi,%rdx
> > 26: 48 c1 ea 03 shr $0x3,%rdx
> > 2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
> > 2d: 48 89 f8 mov %rdi,%rax
> > 30: 83 e0 07 and $0x7,%eax
> >
> >
> > The kernel config and materials to reproduce are available at:
> > https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
> >
> >
> >
> > --
> > 0-DAY CI Kernel Test Service
> > https://github.com/intel/lkp-tests/wiki
> >
> >
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 13:30 ` Joel Granados
@ 2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
2026-10-20 7:55 ` Joel Granados
0 siblings, 2 replies; 7+ messages in thread
From: Oleg Nesterov @ 2026-10-19 14:49 UTC (permalink / raw)
To: Joel Granados, Allison Henderson
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On 10/19, Joel Granados wrote:
>
> On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> > On 10/19, kernel test robot wrote:
> > >
> > >
> > > Hello,
> > >
> > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> > >
> > > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> >
> > I don't think that commit could cause such a problem. Please re-check.
> >
> > Oleg.
>
> That commit might not be the one that introduces the UAF, but it might
> be the one that exposes it?
>
> You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
> Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
> returns -ENOMEM.
>
> If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
> rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
> already been freed by the failed rds_sysctl_init. Right?
>
> Please let me know if I missed anything.
I think you are right...
rds_init() does
rds_threads_init()
rds_wq = create_singlethread_workqueue("krdsd");
rds_sysctl_init()
fails due to CONFIG_SYSCTL=n
out_threads:
destroy_workqueue(rds_wq);
After that any access to rds_wq is wrong.
If rds_rdma_init() runs after that, rds_ib_init() will call
rds_ib_unregister_client() -> flush_workqueue(rds_wq).
And this will equally happen before the blamed commit 8d75c338f0bc,
just you need CONFIG_PROC_SYSCTL=n instead of CONFIG_SYSCTL=n.
But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
rds_sysctl_init(), so to me this looks like a bug in net/rds/.
In any case, I guess net/rds/ init paths should not fail if
CONFIG_SYSCTL=n ?
Oleg.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 14:49 ` Oleg Nesterov
@ 2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
2026-10-20 7:55 ` Joel Granados
1 sibling, 1 reply; 7+ messages in thread
From: Oleg Nesterov @ 2026-10-19 15:35 UTC (permalink / raw)
To: Joel Granados, Allison Henderson
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On 10/19, Oleg Nesterov wrote:
>
> But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> rds_sysctl_init(), so to me this looks like a bug in net/rds/.
>
>
> In any case, I guess net/rds/ init paths should not fail if
> CONFIG_SYSCTL=n ?
So I think that something like the uncompiled/untested patch below makes
sense anyway even if doesn't fix all the potential problems with rds_wq.
What do you think?
Oleg.
---
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 2af678e71e3c..bccdb5c4df1d 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -36,19 +36,10 @@
#include "ib.h"
-static struct ctl_table_header *rds_ib_sysctl_hdr;
-
unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
-static unsigned long rds_ib_sysctl_max_wr_min = 1;
-/* hardware will fail CQ creation long before this */
-static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
-
unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
-static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
-static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
-
/*
* This sysctl does nothing.
*
@@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
*/
unsigned int rds_ib_sysctl_flow_control = 0;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_ib_sysctl_max_wr_min = 1;
+/* hardware will fail CQ creation long before this */
+static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
+
+static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
+static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
+
static struct ctl_table rds_ib_sysctl_table[] = {
{
.procname = "max_send_wr",
@@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
},
};
+static struct ctl_table_header *rds_ib_sysctl_hdr;
+
void rds_ib_sysctl_exit(void)
{
if (rds_ib_sysctl_hdr)
@@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_ib_sysctl_exit(void)
+{
+}
+
+int rds_ib_sysctl_init(void)
+{
+ return 0;
+}
+#endif
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 025f518a4349..a0673a41633a 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -36,11 +36,6 @@
#include "rds.h"
-static struct ctl_table_header *rds_sysctl_reg_table;
-
-static unsigned long rds_sysctl_reconnect_min = 1;
-static unsigned long rds_sysctl_reconnect_max = ~0UL;
-
unsigned long rds_sysctl_reconnect_min_jiffies;
unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
@@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
unsigned int rds_sysctl_ping_enable = 1;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_sysctl_reconnect_min = 1;
+static unsigned long rds_sysctl_reconnect_max = ~0UL;
+
static struct ctl_table rds_sysctl_rds_table[] = {
{
.procname = "reconnect_min_delay_ms",
@@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
},
};
+static struct ctl_table_header *rds_sysctl_reg_table;
+
void rds_sysctl_exit(void)
{
unregister_net_sysctl_table(rds_sysctl_reg_table);
@@ -107,3 +108,15 @@ int rds_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_sysctl_exit(void)
+{
+}
+
+int rds_sysctl_init(void)
+{
+ return 0;
+}
+#endif
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 15:35 ` Oleg Nesterov
@ 2026-10-19 19:52 ` Allison Henderson
0 siblings, 0 replies; 7+ messages in thread
From: Allison Henderson @ 2026-10-19 19:52 UTC (permalink / raw)
To: Oleg Nesterov, Joel Granados
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On Mon, 2026-10-19 at 17:35 +0200, Oleg Nesterov wrote:
> On 10/19, Oleg Nesterov wrote:
Hi Oleg, Joel,
Thanks for running this down. Agreed we shouldn't just fail to init because
sysctl is off. Some comments below:
> >
> > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> >
Yes that's a separate bug, so I'll send a separate fix for that.
> >
> > In any case, I guess net/rds/ init paths should not fail if
> > CONFIG_SYSCTL=n ?
>
> So I think that something like the uncompiled/untested patch below makes
> sense anyway even if doesn't fix all the potential problems with rds_wq.
>
> What do you think?
>
> Oleg.
> ---
>
> diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> index 2af678e71e3c..bccdb5c4df1d 100644
> --- a/net/rds/ib_sysctl.c
> +++ b/net/rds/ib_sysctl.c
> @@ -36,19 +36,10 @@
>
> #include "ib.h"
>
> -static struct ctl_table_header *rds_ib_sysctl_hdr;
> -
> unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
> unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
> unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> -/* hardware will fail CQ creation long before this */
> -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> -
> unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> -
> /*
> * This sysctl does nothing.
> *
> @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> */
> unsigned int rds_ib_sysctl_flow_control = 0;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> +/* hardware will fail CQ creation long before this */
> +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> +
> +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> +
> static struct ctl_table rds_ib_sysctl_table[] = {
> {
> .procname = "max_send_wr",
> @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_ib_sysctl_hdr;
> +
> void rds_ib_sysctl_exit(void)
> {
> if (rds_ib_sysctl_hdr)
> @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
The real rds_sysctl_init() also does the runtime setup of
rds_sysctl_reconnect_min_jiffies (msecs_to_jiffies(1)). Without
it, the reconnect back off is lost.
Also, if register_net_sysctl_sz() returns NULL in rds_tcp_init_net(),
it fails as an -ENOMEM. So RDS/TCP would still fail to come up with
CONFIG_SYSCTL=n. A simpler fix might be to just handle the NULL at the
three call sites, e.g.:
rds_sysctl_reg_table =
register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
return -ENOMEM;
And same for rds_ib_sysctl_init() and rds_tcp_init_net(). The exit
paths are ok, since unregister_net_sysctl_table() is already a
no-op stub when sysctl is off.
Let me know if you want to respin or if you'd rather I send it.
Either way is fine with me.
Thanks
Allison
> +
> +#else
> +
> +void rds_ib_sysctl_exit(void)
> +{
> +}
> +
> +int rds_ib_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
> diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> index 025f518a4349..a0673a41633a 100644
> --- a/net/rds/sysctl.c
> +++ b/net/rds/sysctl.c
> @@ -36,11 +36,6 @@
>
> #include "rds.h"
>
> -static struct ctl_table_header *rds_sysctl_reg_table;
> -
> -static unsigned long rds_sysctl_reconnect_min = 1;
> -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> -
> unsigned long rds_sysctl_reconnect_min_jiffies;
> unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
>
> @@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
>
> unsigned int rds_sysctl_ping_enable = 1;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_sysctl_reconnect_min = 1;
> +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> +
> static struct ctl_table rds_sysctl_rds_table[] = {
> {
> .procname = "reconnect_min_delay_ms",
> @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_sysctl_reg_table;
> +
> void rds_sysctl_exit(void)
> {
> unregister_net_sysctl_table(rds_sysctl_reg_table);
> @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
> +
> +#else
> +
> +void rds_sysctl_exit(void)
> +{
> +}
> +
> +int rds_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
@ 2026-10-20 7:55 ` Joel Granados
1 sibling, 0 replies; 7+ messages in thread
From: Joel Granados @ 2026-10-20 7:55 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Allison Henderson, kernel test robot, oe-lkp, lkp, linux-kernel,
linux-m68k, linux-s390, linux-fsdevel, netdev, wireguard,
rds-devel
[-- Attachment #1: Type: text/plain, Size: 2431 bytes --]
On Mon, Oct 19, 2026 at 04:49:55PM +0200, Oleg Nesterov wrote:
> On 10/19, Joel Granados wrote:
> >
> > On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> > > On 10/19, kernel test robot wrote:
> > > >
> > > >
> > > > Hello,
> > > >
> > > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> > > >
> > > > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> > >
> > > I don't think that commit could cause such a problem. Please re-check.
> > >
> > > Oleg.
> >
> > That commit might not be the one that introduces the UAF, but it might
> > be the one that exposes it?
> >
> > You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
> > Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
> > returns -ENOMEM.
> >
> > If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
> > rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
> > already been freed by the failed rds_sysctl_init. Right?
> >
> > Please let me know if I missed anything.
>
> I think you are right...
>
> rds_init() does
>
> rds_threads_init()
> rds_wq = create_singlethread_workqueue("krdsd");
>
> rds_sysctl_init()
> fails due to CONFIG_SYSCTL=n
>
> out_threads:
> destroy_workqueue(rds_wq);
>
> After that any access to rds_wq is wrong.
>
> If rds_rdma_init() runs after that, rds_ib_init() will call
> rds_ib_unregister_client() -> flush_workqueue(rds_wq).
>
> And this will equally happen before the blamed commit 8d75c338f0bc,
> just you need CONFIG_PROC_SYSCTL=n instead of CONFIG_SYSCTL=n.
>
>
> But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> rds_sysctl_init(), so to me this looks like a bug in net/rds/.
>
>
> In any case, I guess net/rds/ init paths should not fail if
> CONFIG_SYSCTL=n ?
That is up to net/rds.
The question is: do you have to fail if a sysctl registration fails? Or
another way to ask it is: Can't it (net/rds or others) run while not
being tuned or queried through sysctl?
If the answer to these questions is that the sysctl path is necessary,
then the failure is reasonable. But if they can work without the sysctl,
the failure is an overreaction (IMO).
Best
>
> Oleg.
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-10-20 7:55 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
2026-10-20 7:55 ` Joel Granados
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®