linux-kernel - Re: INFO: rcu detected stall in io_playback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+a_Sm6AAK1x1o5p7MQxb+EO3ZDxhNorv98UB4kbWfRscw@mail.gmail.com>
Date:   Sun, 8 Apr 2018 15:09:55 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:     Takashi Iwai <tiwai@...e.com>, Al Viro <viro@...iv.linux.org.uk>,
        syzbot <syzbot+4f2016cf5185da7759dc@...kaller.appspotmail.com>,
        alsa-devel@...a-project.org,
        Dan Carpenter <dan.carpenter@...cle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Takashi Sakamoto <o-takashi@...amocchi.jp>,
        Jaroslav Kysela <perex@...ex.cz>,
        syzkaller-bugs@...glegroups.com
Subject: Re: INFO: rcu detected stall in io_playback_transfer

On Sun, Apr 8, 2018 at 2:58 PM, Tetsuo Handa
<penguin-kernel@...ove.sakura.ne.jp> wrote:
> I manually simplified the reproducer.
>
> It is quite strange that removing unshare() hides this lockup bug.
> Also, explicitly closing by "close()" hides this lockup bug.
> Triggering "fput() from do_exit()" from "different namespace"
> somehow affects this lockup bug?
>
> ----------------------------------------
> #define _GNU_SOURCE
> #include <fcntl.h>
> #include <sched.h>
> #include <unistd.h>
> #include <sys/ioctl.h>
> #include <linux/soundcard.h>
>
> int main(int argc, char *argv[])
> {
>         const int fd = open("/dev/dsp1", O_RDWR);
>         int frag = (0 << 16) | 0;
>         char buf[48] = { };
>         unshare(CLONE_NEWNS);
>         ioctl(fd, SNDCTL_DSP_SETFRAGMENT, &frag);
>         write(fd, buf, sizeof(buf));
>         return 0;
> }
> ----------------------------------------


Takashi has already fixed this. See this thread:
https://groups.google.com/forum/#!searchin/syzkaller-bugs/%22INFO$3A$20rcu$20detected$20stall$20in$20snd_pcm_oss_write3$20(2)%22%7Csort:date/syzkaller-bugs/D2xWV7WTRDk/sCw_gImmCAAJ

The fix commit includes tag this bug:
Reported-by: syzbot+4f2016cf5185da7759dc@...kaller.appspotmail.com
But it's just that it's mentioned in the thread for another bug.