From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
syzbot
<bot+48594378e9851eab70bcd6f99327c7db58c5a28a@syzkaller.appspotmail.com>,
Ming Lei <tom.leiming@gmail.com>,
Dmitry Vyukov <dvyukov@google.com>, Jens Axboe <axboe@fb.com>,
Jens Axboe <axboe@kernel.dk>
Subject: [PATCH 4.9 53/66] block/loop: fix deadlock after loop_set_status
Date: Tue, 17 Apr 2018 17:59:26 +0200 [thread overview]
Message-ID: <20180417155648.189650226@linuxfoundation.org> (raw)
In-Reply-To: <20180417155645.868055442@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit 1e047eaab3bb5564f25b41e9cd3a053009f4e789 upstream.
syzbot is reporting deadlocks at __blkdev_get() [1].
----------------------------------------
[ 92.493919] systemd-udevd D12696 525 1 0x00000000
[ 92.495891] Call Trace:
[ 92.501560] schedule+0x23/0x80
[ 92.502923] schedule_preempt_disabled+0x5/0x10
[ 92.504645] __mutex_lock+0x416/0x9e0
[ 92.510760] __blkdev_get+0x73/0x4f0
[ 92.512220] blkdev_get+0x12e/0x390
[ 92.518151] do_dentry_open+0x1c3/0x2f0
[ 92.519815] path_openat+0x5d9/0xdc0
[ 92.521437] do_filp_open+0x7d/0xf0
[ 92.527365] do_sys_open+0x1b8/0x250
[ 92.528831] do_syscall_64+0x6e/0x270
[ 92.530341] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 92.931922] 1 lock held by systemd-udevd/525:
[ 92.933642] #0: 00000000a2849e25 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x73/0x4f0
----------------------------------------
The reason of deadlock turned out that wait_event_interruptible() in
blk_queue_enter() got stuck with bdev->bd_mutex held at __blkdev_put()
due to q->mq_freeze_depth == 1.
----------------------------------------
[ 92.787172] a.out S12584 634 633 0x80000002
[ 92.789120] Call Trace:
[ 92.796693] schedule+0x23/0x80
[ 92.797994] blk_queue_enter+0x3cb/0x540
[ 92.803272] generic_make_request+0xf0/0x3d0
[ 92.807970] submit_bio+0x67/0x130
[ 92.810928] submit_bh_wbc+0x15e/0x190
[ 92.812461] __block_write_full_page+0x218/0x460
[ 92.815792] __writepage+0x11/0x50
[ 92.817209] write_cache_pages+0x1ae/0x3d0
[ 92.825585] generic_writepages+0x5a/0x90
[ 92.831865] do_writepages+0x43/0xd0
[ 92.836972] __filemap_fdatawrite_range+0xc1/0x100
[ 92.838788] filemap_write_and_wait+0x24/0x70
[ 92.840491] __blkdev_put+0x69/0x1e0
[ 92.841949] blkdev_close+0x16/0x20
[ 92.843418] __fput+0xda/0x1f0
[ 92.844740] task_work_run+0x87/0xb0
[ 92.846215] do_exit+0x2f5/0xba0
[ 92.850528] do_group_exit+0x34/0xb0
[ 92.852018] SyS_exit_group+0xb/0x10
[ 92.853449] do_syscall_64+0x6e/0x270
[ 92.854944] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 92.943530] 1 lock held by a.out/634:
[ 92.945105] #0: 00000000a2849e25 (&bdev->bd_mutex){+.+.}, at: __blkdev_put+0x3c/0x1e0
----------------------------------------
The reason of q->mq_freeze_depth == 1 turned out that loop_set_status()
forgot to call blk_mq_unfreeze_queue() at error paths for
info->lo_encrypt_type != NULL case.
----------------------------------------
[ 37.509497] CPU: 2 PID: 634 Comm: a.out Tainted: G W 4.16.0+ #457
[ 37.513608] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017
[ 37.518832] RIP: 0010:blk_freeze_queue_start+0x17/0x40
[ 37.521778] RSP: 0018:ffffb0c2013e7c60 EFLAGS: 00010246
[ 37.524078] RAX: 0000000000000000 RBX: ffff8b07b1519798 RCX: 0000000000000000
[ 37.527015] RDX: 0000000000000002 RSI: ffffb0c2013e7cc0 RDI: ffff8b07b1519798
[ 37.529934] RBP: ffffb0c2013e7cc0 R08: 0000000000000008 R09: 47a189966239b898
[ 37.532684] R10: dad78b99b278552f R11: 9332dca72259d5ef R12: ffff8b07acd73678
[ 37.535452] R13: 0000000000004c04 R14: 0000000000000000 R15: ffff8b07b841e940
[ 37.538186] FS: 00007fede33b9740(0000) GS:ffff8b07b8e80000(0000) knlGS:0000000000000000
[ 37.541168] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 37.543590] CR2: 00000000206fdf18 CR3: 0000000130b30006 CR4: 00000000000606e0
[ 37.546410] Call Trace:
[ 37.547902] blk_freeze_queue+0x9/0x30
[ 37.549968] loop_set_status+0x67/0x3c0 [loop]
[ 37.549975] loop_set_status64+0x3b/0x70 [loop]
[ 37.549986] lo_ioctl+0x223/0x810 [loop]
[ 37.549995] blkdev_ioctl+0x572/0x980
[ 37.550003] block_ioctl+0x34/0x40
[ 37.550006] do_vfs_ioctl+0xa7/0x6d0
[ 37.550017] ksys_ioctl+0x6b/0x80
[ 37.573076] SyS_ioctl+0x5/0x10
[ 37.574831] do_syscall_64+0x6e/0x270
[ 37.576769] entry_SYSCALL_64_after_hwframe+0x42/0xb7
----------------------------------------
[1] https://syzkaller.appspot.com/bug?id=cd662bc3f6022c0979d01a262c318fab2ee9b56f
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <bot+48594378e9851eab70bcd6f99327c7db58c5a28a@syzkaller.appspotmail.com>
Fixes: ecdd09597a572513 ("block/loop: fix race between I/O and set_status")
Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: stable <stable@vger.kernel.org>
Cc: Jens Axboe <axboe@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/loop.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1110,11 +1110,15 @@ loop_set_status(struct loop_device *lo,
if (info->lo_encrypt_type) {
unsigned int type = info->lo_encrypt_type;
- if (type >= MAX_LO_CRYPT)
- return -EINVAL;
+ if (type >= MAX_LO_CRYPT) {
+ err = -EINVAL;
+ goto exit;
+ }
xfer = xfer_funcs[type];
- if (xfer == NULL)
- return -EINVAL;
+ if (xfer == NULL) {
+ err = -EINVAL;
+ goto exit;
+ }
} else
xfer = NULL;
next prev parent reply other threads:[~2018-04-17 15:59 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-17 15:58 [PATCH 4.9 00/66] 4.9.95-stable review Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 01/66] media: v4l2-compat-ioctl32: dont oops on overlay Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 02/66] parisc: Fix out of array access in match_pci_device() Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 03/66] Drivers: hv: vmbus: do not mark HV_PCIE as perf_device Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 04/66] perf intel-pt: Fix overlap detection to identify consecutive buffers correctly Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 05/66] perf intel-pt: Fix sync_switch Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 06/66] perf intel-pt: Fix error recovery from missing TIP packet Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 07/66] perf intel-pt: Fix timestamp following overflow Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 08/66] perf/core: Fix use-after-free in uprobe_perf_close() Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 10/66] arm64: barrier: Add CSDB macros to control data-value prediction Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 11/66] arm64: Implement array_index_mask_nospec() Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 12/66] arm64: move TASK_* definitions to <asm/processor.h> Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 13/66] arm64: Make USER_DS an inclusive limit Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 14/66] arm64: Use pointer masking to limit uaccess speculation Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 15/66] arm64: entry: Ensure branch through syscall table is bounded under speculation Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 16/66] arm64: uaccess: Prevent speculative use of the current addr_limit Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 17/66] arm64: uaccess: Dont bother eliding access_ok checks in __{get, put}_user Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 18/66] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 19/66] arm64: cpufeature: __this_cpu_has_cap() shouldnt stop early Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 20/66] arm64: Run enable method for errata work arounds on late CPUs Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 21/66] arm64: cpufeature: Pass capability structure to ->enable callback Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 22/66] drivers/firmware: Expose psci_get_version through psci_ops structure Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 23/66] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 24/66] arm64: Move post_ttbr_update_workaround to C code Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 25/66] arm64: Add skeleton to harden the branch predictor against aliasing attacks Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 26/66] arm64: Move BP hardening to check_and_switch_context Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 27/66] mm: Introduce lm_alias Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 28/66] arm64: KVM: Use per-CPU vector when BP hardening is enabled Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 29/66] arm64: entry: Apply BP hardening for high-priority synchronous exceptions Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 30/66] arm64: entry: Apply BP hardening for suspicious interrupts from EL0 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 31/66] arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 32/66] arm64: cpu_errata: Allow an erratum to be match for all revisions of a core Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 33/66] arm64: Implement branch predictor hardening for affected Cortex-A CPUs Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 34/66] arm64: Branch predictor hardening for Cavium ThunderX2 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 35/66] arm64: KVM: Increment PC after handling an SMC trap Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 36/66] arm/arm64: KVM: Consolidate the PSCI include files Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 37/66] arm/arm64: KVM: Add PSCI_VERSION helper Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 38/66] arm/arm64: KVM: Add smccc accessors to PSCI code Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 39/66] arm/arm64: KVM: Implement PSCI 1.0 support Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 40/66] arm/arm64: KVM: Advertise SMCCC v1.1 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 41/66] arm64: KVM: Make PSCI_VERSION a fast path Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 42/66] arm/arm64: KVM: Turn kvm_psci_version into a static inline Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 43/66] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 44/66] arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 45/66] firmware/psci: Expose PSCI conduit Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 46/66] firmware/psci: Expose SMCCC version through psci_ops Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 47/66] arm/arm64: smccc: Make function identifiers an unsigned quantity Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 48/66] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 49/66] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 50/66] arm64: Kill PSCI_GET_VERSION as a variant-2 workaround Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 51/66] sunrpc: remove incorrect HMAC request initialization Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 52/66] Revert "perf tests: Decompress kernel module before objdump" Greg Kroah-Hartman
2018-09-05 18:50 ` Florian Fainelli
2018-09-05 19:29 ` Greg Kroah-Hartman
2018-09-05 20:08 ` Florian Fainelli
2018-04-17 15:59 ` Greg Kroah-Hartman [this message]
2018-04-17 15:59 ` [PATCH 4.9 54/66] nfit: fix region registration vs block-data-window ranges Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 55/66] s390/qdio: dont retry EQBS after CCQ 96 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 56/66] s390/qdio: dont merge ERROR output buffers Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 57/66] s390/ipl: ensure loadparm valid flag is set Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 58/66] getname_kernel() needs to make sure that ->name != ->iname in long case Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 59/66] Bluetooth: Fix connection if directed advertising and privacy is used Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 60/66] rtl8187: Fix NULL pointer dereference in priv->conf_mutex Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 61/66] hwmon: (ina2xx) Fix access to uninitialized mutex Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 62/66] cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 63/66] rds: MP-RDS may use an invalid c_path Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 64/66] slip: Check if rstate is initialized before uncompressing Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 65/66] vhost: fix vhost_vq_access_ok() log check Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 66/66] lan78xx: Correctly indicate invalid OTP Greg Kroah-Hartman
2018-04-17 21:04 ` [PATCH 4.9 00/66] 4.9.95-stable review Shuah Khan
2018-04-18 15:38 ` Guenter Roeck
2018-04-18 17:42 ` Dan Rue
2018-04-19 7:56 ` Greg Kroah-Hartman
2018-04-19 11:12 ` Naresh Kamboju
2018-04-19 12:09 ` Ben Hutchings
2018-04-19 12:30 ` Naresh Kamboju
2018-04-19 13:21 ` Dan Rue
2018-04-19 14:03 ` Greg Kroah-Hartman
2018-04-19 20:04 ` Dan Rue
2018-04-20 6:27 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180417155648.189650226@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@fb.com \
--cc=axboe@kernel.dk \
--cc=bot+48594378e9851eab70bcd6f99327c7db58c5a28a@syzkaller.appspotmail.com \
--cc=dvyukov@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=stable@vger.kernel.org \
--cc=tom.leiming@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).