io_uring/tctx: work around xa_store() allocation error issue

syzbot triggered the following WARN_ON:

WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51

which is the

WARN_ON_ONCE(!xa_empty(&tctx->xa));

sanity check in __io_uring_free() when a io_uring_task is going through
its final put. The syzbot test case includes injecting memory allocation
failures, and it very much looks like xa_store() can fail one of its
memory allocations and end up with ->head being non-NULL even though no
entries exist in the xarray.

Until this issue gets sorted out, work around it by attempting to
iterate entries in our xarray, and WARN_ON_ONCE() if one is found.

Reported-by: syzbot+cc36d44ec9f368e443d3@syzkaller.appspotmail.com
Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index 503f3ff8bc4f90e891e3e06b2cd0bed536606be8..adc6e42c14df6c0152b6f97ee908e7797f489b95 100644 (file)
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -47,8 +47,19 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx,
 void __io_uring_free(struct task_struct *tsk)
 {
        struct io_uring_task *tctx = tsk->io_uring;
+       struct io_tctx_node *node;
+       unsigned long index;
 
-       WARN_ON_ONCE(!xa_empty(&tctx->xa));
+       /*
+        * Fault injection forcing allocation errors in the xa_store() path
+        * can lead to xa_empty() returning false, even though no actual
+        * node is stored in the xarray. Until that gets sorted out, attempt
+        * an iteration here and warn if any entries are found.
+        */
+       xa_for_each(&tctx->xa, index, node) {
+               WARN_ON_ONCE(1);
+               break;
+       }
        WARN_ON_ONCE(tctx->io_wq);
        WARN_ON_ONCE(tctx->cached_refs);