The Linux Kernel Mailing List
 help / color / mirror / Atom feed
From: Ming Lei <tom.leiming@gmail.com>
To: Hillf Danton <hdanton@sina.com>
Cc: Qu Wenruo <wqu@suse.com>, Christoph Hellwig <hch@lst.de>,
	Damien Le Moal <dlemoal@kernel.org>,
	Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
	Jens Axboe <axboe@kernel.dk>,
	Bart Van Assche <bvanassche@acm.org>,
	linux-block <linux-block@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	linux-btrfs@vger.kernel.org, David Sterba <dsterba@suse.com>,
	linux-fsdevel@vger.kernel.org,
	Christian Brauner <brauner@kernel.org>
Subject: Re: [PATCH v3] loop: Fix NULL pointer dereference in lo_rw_aio()
Date: Mon, 1 Jun 2026 18:36:19 -0500	[thread overview]
Message-ID: <ah4Xc7OmGle_C5M3@fedora> (raw)
In-Reply-To: <20260601231731.1403-1-hdanton@sina.com>

On Tue, Jun 02, 2026 at 07:17:30AM +0800, Hillf Danton wrote:
> On Mon, 1 Jun 2026 17:14:59 -0500 Ming Lei wrote:
> > On Tue, Jun 02, 2026 at 05:51:26AM +0800, Hillf Danton wrote:
> > > On OnMon, 1 Jun 2026 10:29:25 -0500 Ming Lei wrote:
> > > > syzbot log shows the null-ptr-deref  is on WRITE, instead of DISCARD.
> > > >
> > > > https://syzkaller.appspot.com/bug?extid=cd8a9a308e879a4e2c28
> > > >
> > > > Adding WARN_ON(!lo->lo_backing_file) in loop_queue_rq() might capture
> > > > this bio submission context if this req isn't issued via wq.
> > > >
> > > I suspect this makes $.02 sense given the check of Lo_bound upon queuing rq.
> > 
> > Can't lo->lo_state be updated after the check? It is totally lockless...
> >
> Sounds good hm... do you mean it is UNWISE to not flush the loop workqueue
> when closing disk?

Quite the opposite, it is wise to not flush wq in __loop_clr_fd(), please
see my previous comment.


Thanks,
Ming

  reply	other threads:[~2026-06-01 23:36 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-18  0:02 [syzbot] [block?] general protection fault in lo_rw_aio syzbot
     [not found] ` <e1d824ba-9ac7-4fde-a791-32eeadcd4258@I-love.SAKURA.ne.jp>
2026-05-11 11:43   ` [PATCH] loop: Fix NULL pointer dereference by synchronizing lo_release and loop_queue_rq Tetsuo Handa
2026-05-11 15:58     ` Bart Van Assche
2026-05-11 17:43       ` Tetsuo Handa
2026-05-12 11:46         ` Tetsuo Handa
2026-05-15  1:38           ` [PATCH v2] " Tetsuo Handa
2026-05-19  0:40             ` Andrew Morton
2026-05-19  9:27               ` Tetsuo Handa
2026-05-20  3:06                 ` Ming Lei
2026-05-20  6:36                   ` Tetsuo Handa
2026-05-20  7:49                     ` Ming Lei
2026-05-20  8:20                       ` Tetsuo Handa
2026-05-20  8:54                         ` Ming Lei
2026-05-25  3:40                           ` [PATCH v3] loop: Fix NULL pointer dereference in lo_rw_aio() Tetsuo Handa
2026-05-25 15:19                             ` Ming Lei
2026-05-26  0:25                               ` Tetsuo Handa
2026-05-27  1:20                                 ` Ming Lei
2026-05-27  1:35                                   ` Tetsuo Handa
2026-05-27  3:00                                     ` Ming Lei
2026-05-27 11:29                                       ` Tetsuo Handa
2026-05-27 18:11                                         ` Damien Le Moal
2026-05-28  8:38                                           ` Christoph Hellwig
2026-05-28 10:16                                             ` Qu Wenruo
2026-06-01 14:40                                               ` Christoph Hellwig
2026-06-01 16:29                                                 ` Brian Foster
2026-06-01 22:27                                                   ` Qu Wenruo
2026-06-01 15:29                                               ` Ming Lei
2026-06-01 21:51                                                 ` Hillf Danton
2026-06-01 22:14                                                   ` Ming Lei
2026-06-01 23:17                                                     ` Hillf Danton
2026-06-01 23:36                                                       ` Ming Lei [this message]
2026-06-02  2:02                                                         ` Hillf Danton
2026-05-28  5:43                                       ` Hillf Danton
2026-05-28 23:00                                         ` Hillf Danton
2026-05-29  0:14                                           ` Tetsuo Handa
2026-05-29  7:04                                             ` Hillf Danton
2026-05-29 22:05                                               ` Hillf Danton
2026-05-30 23:57                                                 ` Tetsuo Handa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ah4Xc7OmGle_C5M3@fedora \
    --to=tom.leiming@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=axboe@kernel.dk \
    --cc=brauner@kernel.org \
    --cc=bvanassche@acm.org \
    --cc=dlemoal@kernel.org \
    --cc=dsterba@suse.com \
    --cc=hch@lst.de \
    --cc=hdanton@sina.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=torvalds@linux-foundation.org \
    --cc=wqu@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox