* [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
@ 2026-10-19 1:46 kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
0 siblings, 1 reply; 10+ messages in thread
From: kernel test robot @ 2026-10-19 1:46 UTC (permalink / raw)
To: Oleg Nesterov
Cc: oe-lkp, lkp, linux-kernel, Joel Granados, linux-m68k, linux-s390,
linux-fsdevel, netdev, wireguard, yi1.lai, achender
Hello,
kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
in testcase: boot
config: x86_64-randconfig-2300-20261014
compiler: gcc-14
test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <yi1.lai@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
[ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
[ 35.688893][ T1]
[ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
[ 35.688893][ T1] Call Trace:
[ 35.688893][ T1] <TASK>
[ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] print_address_description+0x51/0x300
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] print_report (kasan/report.c:482)
[ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
[ 35.688893][ T1] ? fixup_red_left (slub.c:250)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] kasan_report (kasan/report.c:595)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
[ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
[ 35.688893][ T1] ? xa_load (xarray.c:1621)
[ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
[ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
[ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
[ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
[ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
[ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
[ 35.688893][ T1] ? rds_init (af_rds.c:?)
[ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
[ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
[ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
[ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
[ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
[ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
[ 35.688893][ T1] ? rds_init (af_rds.c:?)
[ 35.688893][ T1] do_one_initcall (main.c:1347)
[ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
[ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
[ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
[ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
[ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] kernel_init (main.c:1548)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
[ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
[ 35.688893][ T1] ? rest_init (main.c:717)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1] </TASK>
[ 35.688893][ T1]
[ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
[ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
[ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
[ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
[ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
[ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
[ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
[ 35.688893][ T1] rds_init (rds/af_rds.c:961)
[ 35.688893][ T1] do_one_initcall (main.c:1347)
[ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
[ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
[ 35.688893][ T1] kernel_init (main.c:1548)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1]
[ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
[ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
[ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
[ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
[ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
[ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
[ 35.688893][ T1] handle_softirqs (softirq.c:622)
[ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
[ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
[ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
[ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
[ 35.688893][ T1]
[ 35.688893][ T1] Last potentially related work creation:
[ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
[ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
[ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
[ 35.688893][ T1] __call_rcu_common+0xe6/0x480
[ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
[ 35.688893][ T1] kthread (kthread.c:436)
[ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
[ 35.688893][ T1]
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
[ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1] The buggy address is located 360 bytes inside of
[ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
[ 35.688893][ T1]
[ 35.688893][ T1] The buggy address belongs to the physical page:
[ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
[ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
[ 35.688893][ T1] page_type: f5(slab)
[ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
[ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
[ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
[ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 35.688893][ T1] page dumped because: kasan: bad access detected
[ 35.688893][ T1]
[ 35.688893][ T1] Memory state around the buggy address:
[ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ^
[ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 35.688893][ T1] ==================================================================
[ 35.984299][ T1] Disabling lock debugging due to kernel taint
[ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
[ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
[ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
[ 35.988482][ T1] Tainted: [B]=BAD_PAGE
[ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
[ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
All code
========
0: 3b 58 81 cmp -0x7f(%rax),%ebx
3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
1b: 08
1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
21: 31 d2 xor %edx,%edx
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
2d: 48 89 f8 mov %rdi,%rax
30: 83 e0 07 and $0x7,%eax
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
@ 2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
0 siblings, 1 reply; 10+ messages in thread
From: Oleg Nesterov @ 2026-10-19 11:41 UTC (permalink / raw)
To: kernel test robot
Cc: oe-lkp, lkp, linux-kernel, Joel Granados, linux-m68k, linux-s390,
linux-fsdevel, netdev, wireguard, achender
On 10/19, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
>
> commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
I don't think that commit could cause such a problem. Please re-check.
Oleg.
> [test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
>
> in testcase: boot
>
> config: x86_64-randconfig-2300-20261014
> compiler: gcc-14
> test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <yi1.lai@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
>
>
> [ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
> [ 35.688893][ T1]
> [ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> [ 35.688893][ T1] Call Trace:
> [ 35.688893][ T1] <TASK>
> [ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] print_address_description+0x51/0x300
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] print_report (kasan/report.c:482)
> [ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
> [ 35.688893][ T1] ? fixup_red_left (slub.c:250)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] kasan_report (kasan/report.c:595)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> [ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
> [ 35.688893][ T1] ? xa_load (xarray.c:1621)
> [ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
> [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
> [ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
> [ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
> [ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
> [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> [ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
> [ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
> [ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
> [ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
> [ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
> [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> [ 35.688893][ T1] do_one_initcall (main.c:1347)
> [ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
> [ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
> [ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
> [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] kernel_init (main.c:1548)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
> [ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
> [ 35.688893][ T1] ? rest_init (main.c:717)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1] </TASK>
> [ 35.688893][ T1]
> [ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> [ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
> [ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
> [ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
> [ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
> [ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
> [ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
> [ 35.688893][ T1] rds_init (rds/af_rds.c:961)
> [ 35.688893][ T1] do_one_initcall (main.c:1347)
> [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> [ 35.688893][ T1] kernel_init (main.c:1548)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1]
> [ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> [ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
> [ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
> [ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
> [ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
> [ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
> [ 35.688893][ T1] handle_softirqs (softirq.c:622)
> [ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
> [ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
> [ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
> [ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
> [ 35.688893][ T1]
> [ 35.688893][ T1] Last potentially related work creation:
> [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> [ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
> [ 35.688893][ T1] __call_rcu_common+0xe6/0x480
> [ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
> [ 35.688893][ T1] kthread (kthread.c:436)
> [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 35.688893][ T1]
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> [ 35.688893][ T1]
> [ 35.688893][ T1] The buggy address belongs to the physical page:
> [ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
> [ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
> [ 35.688893][ T1] page_type: f5(slab)
> [ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> [ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> [ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> [ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> [ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
> [ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> [ 35.688893][ T1] page dumped because: kasan: bad access detected
> [ 35.688893][ T1]
> [ 35.688893][ T1] Memory state around the buggy address:
> [ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ^
> [ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 35.688893][ T1] ==================================================================
> [ 35.984299][ T1] Disabling lock debugging due to kernel taint
> [ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
> [ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
> [ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> [ 35.988482][ T1] Tainted: [B]=BAD_PAGE
> [ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
> [ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
> All code
> ========
> 0: 3b 58 81 cmp -0x7f(%rax),%ebx
> 3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
> 7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
> d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
> 14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
> 1b: 08
> 1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
> 21: 31 d2 xor %edx,%edx
> 23: 48 89 fa mov %rdi,%rdx
> 26: 48 c1 ea 03 shr $0x3,%rdx
> 2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
> 2d: 48 89 f8 mov %rdi,%rax
> 30: 83 e0 07 and $0x7,%eax
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
>
>
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 11:41 ` Oleg Nesterov
@ 2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
0 siblings, 1 reply; 10+ messages in thread
From: Joel Granados @ 2026-10-19 13:30 UTC (permalink / raw)
To: Oleg Nesterov
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, achender
[-- Attachment #1: Type: text/plain, Size: 13153 bytes --]
On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> On 10/19, kernel test robot wrote:
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> >
> > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
>
> I don't think that commit could cause such a problem. Please re-check.
>
> Oleg.
That commit might not be the one that introduces the UAF, but it might
be the one that exposes it?
You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
returns -ENOMEM.
If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
already been freed by the failed rds_sysctl_init. Right?
Please let me know if I missed anything.
Best
>
> > [test failed on linux-next/master b810335a0699d1810683796b0e3ffe8827ddfe6c]
> >
> > in testcase: boot
> >
> > config: x86_64-randconfig-2300-20261014
> > compiler: gcc-14
> > test machine: qemu-system-x86_64 -enable-kvm -cpu Haswell-noTSX,enforce -smp 4 -m 16G
> >
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> >
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <yi1.lai@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
> >
> >
> > [ 35.688893][ T1] BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] Read of size 8 at addr ffff8881259a2968 by task swapper/0/1
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> > [ 35.688893][ T1] Call Trace:
> > [ 35.688893][ T1] <TASK>
> > [ 35.688893][ T1] dump_stack_lvl (dump_stack.c:94 dump_stack.c:120)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] print_address_description+0x51/0x300
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] print_report (kasan/report.c:482)
> > [ 35.688893][ T1] ? kmem_cache_debug_flags (slab.h:503)
> > [ 35.688893][ T1] ? fixup_red_left (slub.c:250)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] kasan_report (kasan/report.c:595)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] touch_wq_lockdep_map (workqueue.c:4031 (discriminator 1))
> > [ 35.688893][ T1] __flush_workqueue (workqueue.c:4079)
> > [ 35.688893][ T1] ? xa_load (xarray.c:1621)
> > [ 35.688893][ T1] ? tracer_preempt_on (trace/trace_irqsoff.c:686 (discriminator 1))
> > [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? preempt_count_sub (sched/core.c:6019)
> > [ 35.688893][ T1] ? touch_wq_lockdep_map (workqueue.c:4043)
> > [ 35.688893][ T1] ? __up_write (locking/rwsem.c:1422 (discriminator 4))
> > [ 35.688893][ T1] rds_ib_init (rds/ib.c:618)
> > [ 35.688893][ T1] rds_rdma_init (rds/rdma_transport.c:300)
> > [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> > [ 35.688893][ T1] ? __raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:179 (discriminator 4))
> > [ 35.688893][ T1] ? add_device_randomness (linux/spinlock.h:408 char/random.c:936)
> > [ 35.688893][ T1] ? random_get_entropy (x86/include/asm/timex.h:11)
> > [ 35.688893][ T1] ? sctp_diag_init (diag.c:?)
> > [ 35.688893][ T1] ? rds_init (rds/af_rds.c:977)
> > [ 35.688893][ T1] ? rcu_is_watching (rcu/tree.c:753 (discriminator 3))
> > [ 35.688893][ T1] ? rds_init (af_rds.c:?)
> > [ 35.688893][ T1] do_one_initcall (main.c:1347)
> > [ 35.688893][ T1] ? trace_initcall_finish_cb (main.c:1289 (discriminator 1))
> > [ 35.688893][ T1] ? __kmalloc_noprof (slub.c:5363 slub.c:5387)
> > [ 35.688893][ T1] ? do_initcalls (linux/slab.h:973 linux/slab.h:1290 main.c:1418)
> > [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> > [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] kernel_init (main.c:1548)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ? exit_thread (x86/kernel/process.c:138)
> > [ 35.688893][ T1] ? __switch_to (x86/kernel/process_64.c:674)
> > [ 35.688893][ T1] ? rest_init (main.c:717)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1] </TASK>
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Allocated by task 1 on cpu 1 at 35.661878s:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> > [ 35.688893][ T1] __kasan_kmalloc (kasan/common.c:415)
> > [ 35.688893][ T1] __kmalloc_noprof (linux/kasan.h:263 slub.c:5362 slub.c:5387)
> > [ 35.688893][ T1] __alloc_workqueue (workqueue.c:5827)
> > [ 35.688893][ T1] alloc_workqueue_va (workqueue.c:5946)
> > [ 35.688893][ T1] alloc_workqueue_noprof (workqueue.c:5962)
> > [ 35.688893][ T1] rds_threads_init (rds/threads.c:259 (discriminator 2))
> > [ 35.688893][ T1] rds_init (rds/af_rds.c:961)
> > [ 35.688893][ T1] do_one_initcall (main.c:1347)
> > [ 35.688893][ T1] do_initcalls (main.c:1409 (discriminator 1) main.c:1425 (discriminator 1))
> > [ 35.688893][ T1] kernel_init_freeable (main.c:1445 main.c:1658)
> > [ 35.688893][ T1] kernel_init (main.c:1548)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Freed by task 0 on cpu 3 at 35.674112s:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_save_track (kasan/common.c:78)
> > [ 35.688893][ T1] kasan_save_free_info (kasan/generic.c:584)
> > [ 35.688893][ T1] __kasan_slab_free (kasan/common.c:285)
> > [ 35.688893][ T1] kfree (linux/kasan.h:235 slub.c:2705 slub.c:6405 slub.c:6720)
> > [ 35.688893][ T1] rcu_do_batch (rcu/tree.c:2645)
> > [ 35.688893][ T1] rcu_core (rcu/tree.c:2897)
> > [ 35.688893][ T1] handle_softirqs (softirq.c:622)
> > [ 35.688893][ T1] __irq_exit_rcu (softirq.c:496 softirq.c:735)
> > [ 35.688893][ T1] irq_exit_rcu (softirq.c:752)
> > [ 35.688893][ T1] sysvec_apic_timer_interrupt (x86/kernel/apic/apic.c:1062 (discriminator 35) x86/kernel/apic/apic.c:1062 (discriminator 35))
> > [ 35.688893][ T1] asm_sysvec_apic_timer_interrupt (x86/include/asm/idtentry.h:546)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Last potentially related work creation:
> > [ 35.688893][ T1] stack_trace_save (stacktrace.c:122 (discriminator 1))
> > [ 35.688893][ T1] kasan_save_stack (kasan/common.c:57)
> > [ 35.688893][ T1] kasan_record_aux_stack (kasan/generic.c:556)
> > [ 35.688893][ T1] __call_rcu_common+0xe6/0x480
> > [ 35.688893][ T1] kthread_worker_fn (kthread.c:1025)
> > [ 35.688893][ T1] kthread (kthread.c:436)
> > [ 35.688893][ T1] ret_from_fork (x86/kernel/process.c:158)
> > [ 35.688893][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address belongs to the object at ffff8881259a2800
> > [ 35.688893][ T1] which belongs to the cache kmalloc-1k of size 1024
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1] The buggy address is located 360 bytes inside of
> > [ 35.688893][ T1] freed 1024-byte region [ffff8881259a2800, ffff8881259a2c00)
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] The buggy address belongs to the physical page:
> > [ 35.688893][ T1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1259a0
> > [ 35.688893][ T1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > [ 35.688893][ T1] flags: 0x4000000000000040(head|zone=2)
> > [ 35.688893][ T1] page_type: f5(slab)
> > [ 35.688893][ T1] raw: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> > [ 35.688893][ T1] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> > [ 35.688893][ T1] head: 4000000000000040 ffff888100042dc0 dead000000000100 dead000000000122
> > [ 35.688893][ T1] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
> > [ 35.688893][ T1] head: 4000000000000003 ffffea0004966801 00000000ffffffff 00000000ffffffff
> > [ 35.688893][ T1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> > [ 35.688893][ T1] page dumped because: kasan: bad access detected
> > [ 35.688893][ T1]
> > [ 35.688893][ T1] Memory state around the buggy address:
> > [ 35.688893][ T1] ffff8881259a2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ffff8881259a2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] >ffff8881259a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ^
> > [ 35.688893][ T1] ffff8881259a2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ffff8881259a2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > [ 35.688893][ T1] ==================================================================
> > [ 35.984299][ T1] Disabling lock debugging due to kernel taint
> > [ 35.987548][ T1] Oops: general protection fault, probably for non-canonical address 0xe0a07c0ec0000008: 0000 [#1] SMP KASAN
> > [ 35.988482][ T1] KASAN: maybe wild-memory-access in range [0x0504007600000040-0x0504007600000047]
> > [ 35.988482][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G B 7.2.0-rc2-00010-g8d75c338f0bc #1 PREEMPT
> > [ 35.988482][ T1] Tainted: [B]=BAD_PAGE
> > [ 35.988482][ T1] RIP: 0010:do_raw_spin_lock (locking/spinlock_debug.c:86 (discriminator 2) locking/spinlock_debug.c:115 (discriminator 2))
> > [ 35.988482][ T1] Code: 3b 58 81 49 8d 14 04 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 65 48 8b 15 f0 53 f7 08 48 89 54 24 60 31 d2 48 89 fa 48 c1 ea 03 <8a> 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 39
> > All code
> > ========
> > 0: 3b 58 81 cmp -0x7f(%rax),%ebx
> > 3: 49 8d 14 04 lea (%r12,%rax,1),%rdx
> > 7: c7 02 f1 f1 f1 f1 movl $0xf1f1f1f1,(%rdx)
> > d: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
> > 14: 65 48 8b 15 f0 53 f7 mov %gs:0x8f753f0(%rip),%rdx # 0x8f7540c
> > 1b: 08
> > 1c: 48 89 54 24 60 mov %rdx,0x60(%rsp)
> > 21: 31 d2 xor %edx,%edx
> > 23: 48 89 fa mov %rdi,%rdx
> > 26: 48 c1 ea 03 shr $0x3,%rdx
> > 2a:* 8a 14 02 mov (%rdx,%rax,1),%dl <-- trapping instruction
> > 2d: 48 89 f8 mov %rdi,%rax
> > 30: 83 e0 07 and $0x7,%eax
> >
> >
> > The kernel config and materials to reproduce are available at:
> > https://download.01.org/0day-ci/archive/20261019/202610190310.9737b2e3-lkp@intel.com
> >
> >
> >
> > --
> > 0-DAY CI Kernel Test Service
> > https://github.com/intel/lkp-tests/wiki
> >
> >
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 13:30 ` Joel Granados
@ 2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
2026-10-20 7:55 ` Joel Granados
0 siblings, 2 replies; 10+ messages in thread
From: Oleg Nesterov @ 2026-10-19 14:49 UTC (permalink / raw)
To: Joel Granados, Allison Henderson
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On 10/19, Joel Granados wrote:
>
> On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> > On 10/19, kernel test robot wrote:
> > >
> > >
> > > Hello,
> > >
> > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> > >
> > > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> >
> > I don't think that commit could cause such a problem. Please re-check.
> >
> > Oleg.
>
> That commit might not be the one that introduces the UAF, but it might
> be the one that exposes it?
>
> You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
> Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
> returns -ENOMEM.
>
> If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
> rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
> already been freed by the failed rds_sysctl_init. Right?
>
> Please let me know if I missed anything.
I think you are right...
rds_init() does
rds_threads_init()
rds_wq = create_singlethread_workqueue("krdsd");
rds_sysctl_init()
fails due to CONFIG_SYSCTL=n
out_threads:
destroy_workqueue(rds_wq);
After that any access to rds_wq is wrong.
If rds_rdma_init() runs after that, rds_ib_init() will call
rds_ib_unregister_client() -> flush_workqueue(rds_wq).
And this will equally happen before the blamed commit 8d75c338f0bc,
just you need CONFIG_PROC_SYSCTL=n instead of CONFIG_SYSCTL=n.
But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
rds_sysctl_init(), so to me this looks like a bug in net/rds/.
In any case, I guess net/rds/ init paths should not fail if
CONFIG_SYSCTL=n ?
Oleg.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 14:49 ` Oleg Nesterov
@ 2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
2026-10-20 9:06 ` Joel Granados
2026-10-20 7:55 ` Joel Granados
1 sibling, 2 replies; 10+ messages in thread
From: Oleg Nesterov @ 2026-10-19 15:35 UTC (permalink / raw)
To: Joel Granados, Allison Henderson
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On 10/19, Oleg Nesterov wrote:
>
> But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> rds_sysctl_init(), so to me this looks like a bug in net/rds/.
>
>
> In any case, I guess net/rds/ init paths should not fail if
> CONFIG_SYSCTL=n ?
So I think that something like the uncompiled/untested patch below makes
sense anyway even if doesn't fix all the potential problems with rds_wq.
What do you think?
Oleg.
---
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 2af678e71e3c..bccdb5c4df1d 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -36,19 +36,10 @@
#include "ib.h"
-static struct ctl_table_header *rds_ib_sysctl_hdr;
-
unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
-static unsigned long rds_ib_sysctl_max_wr_min = 1;
-/* hardware will fail CQ creation long before this */
-static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
-
unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
-static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
-static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
-
/*
* This sysctl does nothing.
*
@@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
*/
unsigned int rds_ib_sysctl_flow_control = 0;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_ib_sysctl_max_wr_min = 1;
+/* hardware will fail CQ creation long before this */
+static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
+
+static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
+static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
+
static struct ctl_table rds_ib_sysctl_table[] = {
{
.procname = "max_send_wr",
@@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
},
};
+static struct ctl_table_header *rds_ib_sysctl_hdr;
+
void rds_ib_sysctl_exit(void)
{
if (rds_ib_sysctl_hdr)
@@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_ib_sysctl_exit(void)
+{
+}
+
+int rds_ib_sysctl_init(void)
+{
+ return 0;
+}
+#endif
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 025f518a4349..a0673a41633a 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -36,11 +36,6 @@
#include "rds.h"
-static struct ctl_table_header *rds_sysctl_reg_table;
-
-static unsigned long rds_sysctl_reconnect_min = 1;
-static unsigned long rds_sysctl_reconnect_max = ~0UL;
-
unsigned long rds_sysctl_reconnect_min_jiffies;
unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
@@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
unsigned int rds_sysctl_ping_enable = 1;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_sysctl_reconnect_min = 1;
+static unsigned long rds_sysctl_reconnect_max = ~0UL;
+
static struct ctl_table rds_sysctl_rds_table[] = {
{
.procname = "reconnect_min_delay_ms",
@@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
},
};
+static struct ctl_table_header *rds_sysctl_reg_table;
+
void rds_sysctl_exit(void)
{
unregister_net_sysctl_table(rds_sysctl_reg_table);
@@ -107,3 +108,15 @@ int rds_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_sysctl_exit(void)
+{
+}
+
+int rds_sysctl_init(void)
+{
+ return 0;
+}
+#endif
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 15:35 ` Oleg Nesterov
@ 2026-10-19 19:52 ` Allison Henderson
2026-10-20 9:12 ` Oleg Nesterov
2026-10-20 9:06 ` Joel Granados
1 sibling, 1 reply; 10+ messages in thread
From: Allison Henderson @ 2026-10-19 19:52 UTC (permalink / raw)
To: Oleg Nesterov, Joel Granados
Cc: kernel test robot, oe-lkp, lkp, linux-kernel, linux-m68k,
linux-s390, linux-fsdevel, netdev, wireguard, rds-devel
On Mon, 2026-10-19 at 17:35 +0200, Oleg Nesterov wrote:
> On 10/19, Oleg Nesterov wrote:
Hi Oleg, Joel,
Thanks for running this down. Agreed we shouldn't just fail to init because
sysctl is off. Some comments below:
> >
> > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> >
Yes that's a separate bug, so I'll send a separate fix for that.
> >
> > In any case, I guess net/rds/ init paths should not fail if
> > CONFIG_SYSCTL=n ?
>
> So I think that something like the uncompiled/untested patch below makes
> sense anyway even if doesn't fix all the potential problems with rds_wq.
>
> What do you think?
>
> Oleg.
> ---
>
> diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> index 2af678e71e3c..bccdb5c4df1d 100644
> --- a/net/rds/ib_sysctl.c
> +++ b/net/rds/ib_sysctl.c
> @@ -36,19 +36,10 @@
>
> #include "ib.h"
>
> -static struct ctl_table_header *rds_ib_sysctl_hdr;
> -
> unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
> unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
> unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> -/* hardware will fail CQ creation long before this */
> -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> -
> unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> -
> /*
> * This sysctl does nothing.
> *
> @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> */
> unsigned int rds_ib_sysctl_flow_control = 0;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> +/* hardware will fail CQ creation long before this */
> +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> +
> +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> +
> static struct ctl_table rds_ib_sysctl_table[] = {
> {
> .procname = "max_send_wr",
> @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_ib_sysctl_hdr;
> +
> void rds_ib_sysctl_exit(void)
> {
> if (rds_ib_sysctl_hdr)
> @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
The real rds_sysctl_init() also does the runtime setup of
rds_sysctl_reconnect_min_jiffies (msecs_to_jiffies(1)). Without
it, the reconnect back off is lost.
Also, if register_net_sysctl_sz() returns NULL in rds_tcp_init_net(),
it fails as an -ENOMEM. So RDS/TCP would still fail to come up with
CONFIG_SYSCTL=n. A simpler fix might be to just handle the NULL at the
three call sites, e.g.:
rds_sysctl_reg_table =
register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
return -ENOMEM;
And same for rds_ib_sysctl_init() and rds_tcp_init_net(). The exit
paths are ok, since unregister_net_sysctl_table() is already a
no-op stub when sysctl is off.
Let me know if you want to respin or if you'd rather I send it.
Either way is fine with me.
Thanks
Allison
> +
> +#else
> +
> +void rds_ib_sysctl_exit(void)
> +{
> +}
> +
> +int rds_ib_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
> diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> index 025f518a4349..a0673a41633a 100644
> --- a/net/rds/sysctl.c
> +++ b/net/rds/sysctl.c
> @@ -36,11 +36,6 @@
>
> #include "rds.h"
>
> -static struct ctl_table_header *rds_sysctl_reg_table;
> -
> -static unsigned long rds_sysctl_reconnect_min = 1;
> -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> -
> unsigned long rds_sysctl_reconnect_min_jiffies;
> unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
>
> @@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
>
> unsigned int rds_sysctl_ping_enable = 1;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_sysctl_reconnect_min = 1;
> +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> +
> static struct ctl_table rds_sysctl_rds_table[] = {
> {
> .procname = "reconnect_min_delay_ms",
> @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_sysctl_reg_table;
> +
> void rds_sysctl_exit(void)
> {
> unregister_net_sysctl_table(rds_sysctl_reg_table);
> @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
> +
> +#else
> +
> +void rds_sysctl_exit(void)
> +{
> +}
> +
> +int rds_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
@ 2026-10-20 7:55 ` Joel Granados
1 sibling, 0 replies; 10+ messages in thread
From: Joel Granados @ 2026-10-20 7:55 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Allison Henderson, kernel test robot, oe-lkp, lkp, linux-kernel,
linux-m68k, linux-s390, linux-fsdevel, netdev, wireguard,
rds-devel
[-- Attachment #1: Type: text/plain, Size: 2431 bytes --]
On Mon, Oct 19, 2026 at 04:49:55PM +0200, Oleg Nesterov wrote:
> On 10/19, Joel Granados wrote:
> >
> > On Mon, Oct 19, 2026 at 01:41:05PM +0200, Oleg Nesterov wrote:
> > > On 10/19, kernel test robot wrote:
> > > >
> > > >
> > > > Hello,
> > > >
> > > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map" on:
> > > >
> > > > commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> > >
> > > I don't think that commit could cause such a problem. Please re-check.
> > >
> > > Oleg.
> >
> > That commit might not be the one that introduces the UAF, but it might
> > be the one that exposes it?
> >
> > You have CONFIG_SYSCTL=n & CONFIG_RDS=y & CONFIG_RDS_RDMA=y.
> > Therefore rds_sysctl_init() returns -ENOMEM and rds_ib_sysctl_init
> > returns -ENOMEM.
> >
> > If rds_ib_sysctl_init is called after a failed rds_sysctl_init, then
> > rds_ib_sysctl_init would call a flush_workqueue on a rds_wq that has
> > already been freed by the failed rds_sysctl_init. Right?
> >
> > Please let me know if I missed anything.
>
> I think you are right...
>
> rds_init() does
>
> rds_threads_init()
> rds_wq = create_singlethread_workqueue("krdsd");
>
> rds_sysctl_init()
> fails due to CONFIG_SYSCTL=n
>
> out_threads:
> destroy_workqueue(rds_wq);
>
> After that any access to rds_wq is wrong.
>
> If rds_rdma_init() runs after that, rds_ib_init() will call
> rds_ib_unregister_client() -> flush_workqueue(rds_wq).
>
> And this will equally happen before the blamed commit 8d75c338f0bc,
> just you need CONFIG_PROC_SYSCTL=n instead of CONFIG_SYSCTL=n.
>
>
> But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> rds_sysctl_init(), so to me this looks like a bug in net/rds/.
>
>
> In any case, I guess net/rds/ init paths should not fail if
> CONFIG_SYSCTL=n ?
That is up to net/rds.
The question is: do you have to fail if a sysctl registration fails? Or
another way to ask it is: Can't it (net/rds or others) run while not
being tuned or queried through sysctl?
If the answer to these questions is that the sysctl path is necessary,
then the failure is reasonable. But if they can work without the sysctl,
the failure is an overreaction (IMO).
Best
>
> Oleg.
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
@ 2026-10-20 9:06 ` Joel Granados
2026-10-20 9:24 ` Oleg Nesterov
1 sibling, 1 reply; 10+ messages in thread
From: Joel Granados @ 2026-10-20 9:06 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Allison Henderson, kernel test robot, oe-lkp, lkp, linux-kernel,
linux-m68k, linux-s390, linux-fsdevel, netdev, wireguard,
rds-devel
[-- Attachment #1: Type: text/plain, Size: 5344 bytes --]
On Mon, Oct 19, 2026 at 05:35:54PM +0200, Oleg Nesterov wrote:
> On 10/19, Oleg Nesterov wrote:
> >
> > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> >
> >
> > In any case, I guess net/rds/ init paths should not fail if
> > CONFIG_SYSCTL=n ?
>
> So I think that something like the uncompiled/untested patch below makes
> sense anyway even if doesn't fix all the potential problems with rds_wq.
>
> What do you think?
That is a good option. I also did not compile not test it, but guarding
the error inside an ifdef would work and is a pattern that is used
elsewhere.
You can also do this (also untested and not compiled):
diff --git i/net/rds/ib_sysctl.c w/net/rds/ib_sysctl.c
index 2af678e71e3c6..bc97a3eecad69 100644
--- i/net/rds/ib_sysctl.c
+++ w/net/rds/ib_sysctl.c
@@ -114,7 +114,7 @@ void rds_ib_sysctl_exit(void)
int rds_ib_sysctl_init(void)
{
rds_ib_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/ib", rds_ib_sysctl_table);
- if (!rds_ib_sysctl_hdr)
+ if (!rds_ib_sysctl_hdr && IS_ENABLED(CONFIG_SYSCTL))
return -ENOMEM;
return 0;
}
diff --git i/net/rds/sysctl.c w/net/rds/sysctl.c
index 025f518a43495..41c65b98c94bd 100644
--- i/net/rds/sysctl.c
+++ w/net/rds/sysctl.c
@@ -93,7 +93,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
void rds_sysctl_exit(void)
{
- unregister_net_sysctl_table(rds_sysctl_reg_table);
+ if (rds_sysctl_reg_table)
+ unregister_net_sysctl_table(rds_sysctl_reg_table);
}
int rds_sysctl_init(void)
@@ -103,7 +104,7 @@ int rds_sysctl_init(void)
rds_sysctl_reg_table =
register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
- if (!rds_sysctl_reg_table)
+ if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
return -ENOMEM;
return 0;
}
Both are ok IMO.
Best
>
> Oleg.
> ---
>
> diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> index 2af678e71e3c..bccdb5c4df1d 100644
> --- a/net/rds/ib_sysctl.c
> +++ b/net/rds/ib_sysctl.c
> @@ -36,19 +36,10 @@
>
> #include "ib.h"
>
> -static struct ctl_table_header *rds_ib_sysctl_hdr;
> -
> unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
> unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
> unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> -/* hardware will fail CQ creation long before this */
> -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> -
> unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> -
> /*
> * This sysctl does nothing.
> *
> @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> */
> unsigned int rds_ib_sysctl_flow_control = 0;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> +/* hardware will fail CQ creation long before this */
> +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> +
> +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> +
> static struct ctl_table rds_ib_sysctl_table[] = {
> {
> .procname = "max_send_wr",
> @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_ib_sysctl_hdr;
> +
> void rds_ib_sysctl_exit(void)
> {
> if (rds_ib_sysctl_hdr)
> @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
> +
> +#else
> +
> +void rds_ib_sysctl_exit(void)
> +{
> +}
> +
> +int rds_ib_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
> diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> index 025f518a4349..a0673a41633a 100644
> --- a/net/rds/sysctl.c
> +++ b/net/rds/sysctl.c
> @@ -36,11 +36,6 @@
>
> #include "rds.h"
>
> -static struct ctl_table_header *rds_sysctl_reg_table;
> -
> -static unsigned long rds_sysctl_reconnect_min = 1;
> -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> -
> unsigned long rds_sysctl_reconnect_min_jiffies;
> unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
>
> @@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
>
> unsigned int rds_sysctl_ping_enable = 1;
>
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_sysctl_reconnect_min = 1;
> +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> +
> static struct ctl_table rds_sysctl_rds_table[] = {
> {
> .procname = "reconnect_min_delay_ms",
> @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
> },
> };
>
> +static struct ctl_table_header *rds_sysctl_reg_table;
> +
> void rds_sysctl_exit(void)
> {
> unregister_net_sysctl_table(rds_sysctl_reg_table);
> @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
> return -ENOMEM;
> return 0;
> }
> +
> +#else
> +
> +void rds_sysctl_exit(void)
> +{
> +}
> +
> +int rds_sysctl_init(void)
> +{
> + return 0;
> +}
> +#endif
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-19 19:52 ` Allison Henderson
@ 2026-10-20 9:12 ` Oleg Nesterov
0 siblings, 0 replies; 10+ messages in thread
From: Oleg Nesterov @ 2026-10-20 9:12 UTC (permalink / raw)
To: Allison Henderson
Cc: Joel Granados, kernel test robot, oe-lkp, lkp, linux-kernel,
linux-m68k, linux-s390, linux-fsdevel, netdev, wireguard,
rds-devel
Hi Allison,
On 10/19, Allison Henderson wrote:
>
> The real rds_sysctl_init() also does the runtime setup of
> rds_sysctl_reconnect_min_jiffies (msecs_to_jiffies(1)). Without
> it, the reconnect back off is lost.
Yes, thanks, I missed that.
> Also, if register_net_sysctl_sz() returns NULL in rds_tcp_init_net(),
> it fails as an -ENOMEM. So RDS/TCP would still fail to come up with
> CONFIG_SYSCTL=n.
Yes, I didn't even try to grep other files.
Hmm. I am m just curious how difficult it is to create a "complete" patch
which puts all the sysctl-related code under ifdef(SYSCTL)... May be something
like below but I don't understand net/rds, most probably it is wrong and I am
not sure it makes a lot of sense. Plus I have not idea how to test it.
> A simpler fix might be to just handle the NULL at the
> three call sites, e.g.:
>
> rds_sysctl_reg_table =
> register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
> if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
> return -ENOMEM;
Yes, I thought about a simpler patch too. Perhaps just
--- x/net/rds/Kconfig
+++ x/net/rds/Kconfig
@@ -2,7 +2,7 @@
config RDS
tristate "The Reliable Datagram Sockets Protocol"
- depends on INET
+ depends on INET && SYSCTL
help
The RDS (Reliable Datagram Sockets) protocol provides reliable,
sequenced delivery of datagrams over Infiniband or TCP.
for the start? CONFIG_SYSCTL=n is not a common case.
> Let me know if you want to respin or if you'd rather I send it.
> Either way is fine with me.
Allison, up to you. Whatever you prefer.
Oleg.
---
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index 2af678e71e3c..bccdb5c4df1d 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -36,19 +36,10 @@
#include "ib.h"
-static struct ctl_table_header *rds_ib_sysctl_hdr;
-
unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
-static unsigned long rds_ib_sysctl_max_wr_min = 1;
-/* hardware will fail CQ creation long before this */
-static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
-
unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
-static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
-static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
-
/*
* This sysctl does nothing.
*
@@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
*/
unsigned int rds_ib_sysctl_flow_control = 0;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_ib_sysctl_max_wr_min = 1;
+/* hardware will fail CQ creation long before this */
+static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
+
+static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
+static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
+
static struct ctl_table rds_ib_sysctl_table[] = {
{
.procname = "max_send_wr",
@@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
},
};
+static struct ctl_table_header *rds_ib_sysctl_hdr;
+
void rds_ib_sysctl_exit(void)
{
if (rds_ib_sysctl_hdr)
@@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+void rds_ib_sysctl_exit(void)
+{
+}
+
+int rds_ib_sysctl_init(void)
+{
+ return 0;
+}
+#endif
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index 025f518a4349..47e8782b1aa3 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -36,11 +36,6 @@
#include "rds.h"
-static struct ctl_table_header *rds_sysctl_reg_table;
-
-static unsigned long rds_sysctl_reconnect_min = 1;
-static unsigned long rds_sysctl_reconnect_max = ~0UL;
-
unsigned long rds_sysctl_reconnect_min_jiffies;
unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
@@ -49,6 +44,10 @@ unsigned int rds_sysctl_max_unacked_bytes = (16 << 20);
unsigned int rds_sysctl_ping_enable = 1;
+#ifdef CONFIG_SYSCTL
+static unsigned long rds_sysctl_reconnect_min = 1;
+static unsigned long rds_sysctl_reconnect_max = ~0UL;
+
static struct ctl_table rds_sysctl_rds_table[] = {
{
.procname = "reconnect_min_delay_ms",
@@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
},
};
+static struct ctl_table_header *rds_sysctl_reg_table;
+
void rds_sysctl_exit(void)
{
unregister_net_sysctl_table(rds_sysctl_reg_table);
@@ -107,3 +108,16 @@ int rds_sysctl_init(void)
return -ENOMEM;
return 0;
}
+
+#else
+
+int rds_sysctl_init(void)
+{
+ rds_sysctl_reconnect_min_jiffies = msecs_to_jiffies(1);
+ return 0;
+}
+
+void rds_sysctl_exit(void)
+{
+}
+#endif
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 774a71f88d37..372899a2ec81 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -53,13 +53,71 @@ static atomic_t rds_tcp_unloading = ATOMIC_INIT(0);
static struct kmem_cache *rds_tcp_conn_slab;
+#ifdef CONFIG_SYSCTL
+static int rds_tcp_min_sndbuf = SOCK_MIN_SNDBUF;
+static int rds_tcp_min_rcvbuf = SOCK_MIN_RCVBUF;
+
+/* when sysctl is used to modify some kernel socket parameters,this
+ * function resets the RDS connections in that netns so that we can
+ * restart with new parameters. The assumption is that such reset
+ * events are few and far-between.
+ */
+static void rds_tcp_sysctl_reset(struct net *net)
+{
+ struct rds_tcp_connection *tc, *_tc;
+
+ spin_lock_irq(&rds_tcp_conn_lock);
+ list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+ struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+
+ if (net != c_net || !tc->t_sock)
+ continue;
+
+ /* reconnect with new parameters */
+ rds_conn_path_drop(tc->t_cpath, false);
+ }
+ spin_unlock_irq(&rds_tcp_conn_lock);
+}
+
+static int rds_tcp_skbuf_handler(struct rds_tcp_net *rtn,
+ const struct ctl_table *ctl, int write,
+ void *buffer, size_t *lenp, loff_t *fpos)
+{
+ int err;
+
+ err = proc_dointvec_minmax(ctl, write, buffer, lenp, fpos);
+ if (err < 0) {
+ pr_warn("Invalid input. Must be >= %d\n",
+ *(int *)(ctl->extra1));
+ return err;
+ }
+
+ if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) {
+ struct net *net = sock_net(rtn->rds_tcp_listen_sock->sk);
+
+ rds_tcp_sysctl_reset(net);
+ }
+
+ return 0;
+}
+
static int rds_tcp_sndbuf_handler(const struct ctl_table *ctl, int write,
- void *buffer, size_t *lenp, loff_t *fpos);
+ void *buffer, size_t *lenp, loff_t *fpos)
+{
+ struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net,
+ sndbuf_size);
+
+ return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos);
+}
+
static int rds_tcp_rcvbuf_handler(const struct ctl_table *ctl, int write,
- void *buffer, size_t *lenp, loff_t *fpos);
+ void *buffer, size_t *lenp, loff_t *fpos)
+{
+ struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net,
+ rcvbuf_size);
-static int rds_tcp_min_sndbuf = SOCK_MIN_SNDBUF;
-static int rds_tcp_min_rcvbuf = SOCK_MIN_RCVBUF;
+ return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos);
+}
static struct ctl_table rds_tcp_sysctl_table[] = {
#define RDS_TCP_SNDBUF 0
@@ -82,6 +140,61 @@ static struct ctl_table rds_tcp_sysctl_table[] = {
},
};
+static __net_init int rds_tcp_init_net_sysctl(struct net *net)
+{
+ struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
+ struct ctl_table *tbl;
+
+ /* {snd, rcv}buf_size default to 0, which implies we let the
+ * stack pick the value, and permit auto-tuning of buffer size.
+ */
+ if (net == &init_net) {
+ tbl = rds_tcp_sysctl_table;
+ } else {
+ tbl = kmemdup(rds_tcp_sysctl_table,
+ sizeof(rds_tcp_sysctl_table), GFP_KERNEL);
+ if (!tbl) {
+ pr_warn("could not set allocate sysctl table\n");
+ return -ENOMEM;
+ }
+ rtn->ctl_table = tbl;
+ }
+ tbl[RDS_TCP_SNDBUF].data = &rtn->sndbuf_size;
+ tbl[RDS_TCP_RCVBUF].data = &rtn->rcvbuf_size;
+ rtn->rds_tcp_sysctl = register_net_sysctl_sz(net, "net/rds/tcp", tbl,
+ ARRAY_SIZE(rds_tcp_sysctl_table));
+ if (!rtn->rds_tcp_sysctl) {
+ pr_warn("could not register sysctl\n");
+ if (net != &init_net)
+ kfree(tbl);
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
+static void __net_exit rds_tcp_exit_net_sysctl(struct net *net)
+{
+ struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
+
+ if (rtn->rds_tcp_sysctl) {
+ unregister_net_sysctl_table(rtn->rds_tcp_sysctl);
+ rtn->rds_tcp_sysctl = NULL;
+ }
+
+ if (net != &init_net)
+ kfree(rtn->ctl_table);
+}
+#else
+static inline int rds_tcp_init_net_sysctl(struct net *net)
+{
+ return 0;
+}
+static inline void rds_tcp_exit_net_sysctl(struct net *net)
+{
+}
+#endif
+
u32 rds_tcp_write_seq(struct rds_tcp_connection *tc)
{
/* seq# of the last byte of data in tcp send buffer */
@@ -612,36 +725,15 @@ void rds_tcp_accept_work(struct rds_tcp_net *rtn)
static __net_init int rds_tcp_init_net(struct net *net)
{
struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
- struct ctl_table *tbl;
int err = 0;
memset(rtn, 0, sizeof(*rtn));
mutex_init(&rtn->rds_tcp_accept_lock);
- /* {snd, rcv}buf_size default to 0, which implies we let the
- * stack pick the value, and permit auto-tuning of buffer size.
- */
- if (net == &init_net) {
- tbl = rds_tcp_sysctl_table;
- } else {
- tbl = kmemdup(rds_tcp_sysctl_table,
- sizeof(rds_tcp_sysctl_table), GFP_KERNEL);
- if (!tbl) {
- pr_warn("could not set allocate sysctl table\n");
- return -ENOMEM;
- }
- rtn->ctl_table = tbl;
- }
- tbl[RDS_TCP_SNDBUF].data = &rtn->sndbuf_size;
- tbl[RDS_TCP_RCVBUF].data = &rtn->rcvbuf_size;
- rtn->rds_tcp_sysctl = register_net_sysctl_sz(net, "net/rds/tcp", tbl,
- ARRAY_SIZE(rds_tcp_sysctl_table));
- if (!rtn->rds_tcp_sysctl) {
- pr_warn("could not register sysctl\n");
- err = -ENOMEM;
- goto fail;
- }
+ err = rds_tcp_init_net_sysctl(net);
+ if (err)
+ return err;
#if IS_ENABLED(CONFIG_IPV6)
rtn->rds_tcp_listen_sock = rds_tcp_listen_init(net, true);
@@ -656,21 +748,14 @@ static __net_init int rds_tcp_init_net(struct net *net)
rtn->rds_tcp_listen_sock = rds_tcp_listen_init(net, false);
if (!rtn->rds_tcp_listen_sock) {
#endif
- unregister_net_sysctl_table(rtn->rds_tcp_sysctl);
- rtn->rds_tcp_sysctl = NULL;
- err = -EAFNOSUPPORT;
- goto fail;
+ rds_tcp_exit_net_sysctl(net);
+ return -EAFNOSUPPORT;
#if IS_ENABLED(CONFIG_IPV6)
}
#endif
}
INIT_WORK(&rtn->rds_tcp_accept_w, rds_tcp_accept_worker);
return 0;
-
-fail:
- if (net != &init_net)
- kfree(tbl);
- return err;
}
static void rds_tcp_kill_sock(struct net *net)
@@ -704,14 +789,7 @@ static void rds_tcp_kill_sock(struct net *net)
static void __net_exit rds_tcp_exit_net(struct net *net)
{
- struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
-
- if (rtn->rds_tcp_sysctl)
- unregister_net_sysctl_table(rtn->rds_tcp_sysctl);
-
- if (net != &init_net)
- kfree(rtn->ctl_table);
-
+ rds_tcp_exit_net_sysctl(net);
rds_tcp_kill_sock(net);
}
@@ -733,68 +811,6 @@ void *rds_tcp_listen_sock_def_readable(struct net *net)
return lsock->sk->sk_user_data;
}
-/* when sysctl is used to modify some kernel socket parameters,this
- * function resets the RDS connections in that netns so that we can
- * restart with new parameters. The assumption is that such reset
- * events are few and far-between.
- */
-static void rds_tcp_sysctl_reset(struct net *net)
-{
- struct rds_tcp_connection *tc, *_tc;
-
- spin_lock_irq(&rds_tcp_conn_lock);
- list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
- struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
-
- if (net != c_net || !tc->t_sock)
- continue;
-
- /* reconnect with new parameters */
- rds_conn_path_drop(tc->t_cpath, false);
- }
- spin_unlock_irq(&rds_tcp_conn_lock);
-}
-
-static int rds_tcp_skbuf_handler(struct rds_tcp_net *rtn,
- const struct ctl_table *ctl, int write,
- void *buffer, size_t *lenp, loff_t *fpos)
-{
- int err;
-
- err = proc_dointvec_minmax(ctl, write, buffer, lenp, fpos);
- if (err < 0) {
- pr_warn("Invalid input. Must be >= %d\n",
- *(int *)(ctl->extra1));
- return err;
- }
-
- if (write && rtn->rds_tcp_listen_sock && rtn->rds_tcp_listen_sock->sk) {
- struct net *net = sock_net(rtn->rds_tcp_listen_sock->sk);
-
- rds_tcp_sysctl_reset(net);
- }
-
- return 0;
-}
-
-static int rds_tcp_sndbuf_handler(const struct ctl_table *ctl, int write,
- void *buffer, size_t *lenp, loff_t *fpos)
-{
- struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net,
- sndbuf_size);
-
- return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos);
-}
-
-static int rds_tcp_rcvbuf_handler(const struct ctl_table *ctl, int write,
- void *buffer, size_t *lenp, loff_t *fpos)
-{
- struct rds_tcp_net *rtn = container_of(ctl->data, struct rds_tcp_net,
- rcvbuf_size);
-
- return rds_tcp_skbuf_handler(rtn, ctl, write, buffer, lenp, fpos);
-}
-
static void rds_tcp_exit(void)
{
rds_tcp_set_unloading();
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 39c86347188c..12b58d76c089 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -13,8 +13,10 @@ struct rds_tcp_net {
struct socket *rds_tcp_listen_sock;
struct socket *rds_tcp_accepted_sock;
struct work_struct rds_tcp_accept_w;
+#ifdef CONFIG_SYSCTL
struct ctl_table_header *rds_tcp_sysctl;
const struct ctl_table *ctl_table;
+#endif
int sndbuf_size;
int rcvbuf_size;
};
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
2026-10-20 9:06 ` Joel Granados
@ 2026-10-20 9:24 ` Oleg Nesterov
0 siblings, 0 replies; 10+ messages in thread
From: Oleg Nesterov @ 2026-10-20 9:24 UTC (permalink / raw)
To: Joel Granados
Cc: Allison Henderson, kernel test robot, oe-lkp, lkp, linux-kernel,
linux-m68k, linux-s390, linux-fsdevel, netdev, wireguard,
rds-devel
On 10/20, Joel Granados wrote:
>
> You can also do this (also untested and not compiled):
>
> diff --git i/net/rds/ib_sysctl.c w/net/rds/ib_sysctl.c
> index 2af678e71e3c6..bc97a3eecad69 100644
> --- i/net/rds/ib_sysctl.c
> +++ w/net/rds/ib_sysctl.c
> @@ -114,7 +114,7 @@ void rds_ib_sysctl_exit(void)
> int rds_ib_sysctl_init(void)
> {
> rds_ib_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/ib", rds_ib_sysctl_table);
> - if (!rds_ib_sysctl_hdr)
> + if (!rds_ib_sysctl_hdr && IS_ENABLED(CONFIG_SYSCTL))
> return -ENOMEM;
> return 0;
> }
> diff --git i/net/rds/sysctl.c w/net/rds/sysctl.c
> index 025f518a43495..41c65b98c94bd 100644
> --- i/net/rds/sysctl.c
> +++ w/net/rds/sysctl.c
> @@ -93,7 +93,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
>
> void rds_sysctl_exit(void)
> {
> - unregister_net_sysctl_table(rds_sysctl_reg_table);
> + if (rds_sysctl_reg_table)
> + unregister_net_sysctl_table(rds_sysctl_reg_table);
Yes, this is what Allison suggested too. But he also pointed out that
the changes in _exit() are not strictly needed, unregister_net_sysctl_table
is nop if !CONFIG_SYSCTL. Plus we also need to change rds_tcp_init_net()
the same way, see register_net_sysctl_sz().
So, let me repeat, I agree in advance with anything you and Allison prefer.
Oleg.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-10-20 9:24 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
2026-10-20 9:12 ` Oleg Nesterov
2026-10-20 9:06 ` Joel Granados
2026-10-20 9:24 ` Oleg Nesterov
2026-10-20 7:55 ` Joel Granados
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®