Re: [syzbot] KASAN: use-after-free Read in add_wait_queue

From: syzbot
Date: Thu Apr 28 2022 - 11:34:18 EST


syzbot suspects this issue was fixed by commit:

commit d89a4fac0fbc6fe5fc24d1c9a889440dcf410368
Author: Jens Axboe <axboe@xxxxxxxxx>
Date: Tue Mar 22 19:11:28 2022 +0000

io_uring: fix assuming triggered poll waitqueue is the single poll

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17b70e42f00000
start commit: b47d5a4f6b8d Merge tag 'audit-pr-20220321' of git://git.ke..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=63af44f0631a5c3a
dashboard link: https://syzkaller.appspot.com/bug?extid=950cee6d91e62329be2c
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14506ddb700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139b2093700000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: io_uring: fix assuming triggered poll waitqueue is the single poll

For information about bisection process see: https://goo.gl/tpsmEJ#bisection