linux-kernel - Re: INFO: task hung in io_sq_thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 9 Sep 2020 17:32:35 +0200
From:   Stefano Garzarella <sgarzare@...hat.com>
To:     Jens Axboe <axboe@...nel.dk>, Hillf Danton <hdanton@...a.com>
Cc:     syzbot <syzbot+3c23789ea938faaef049@...kaller.appspotmail.com>,
        io-uring@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Pavel Begunkov <asml.silence@...il.com>,
        syzkaller-bugs@...glegroups.com, viro@...iv.linux.org.uk
Subject: Re: INFO: task hung in io_sq_thread_stop

On Wed, Sep 09, 2020 at 08:05:33AM -0600, Jens Axboe wrote:
> On 9/9/20 7:43 AM, Hillf Danton wrote:
> > 
> > On Wed, 9 Sep 2020 12:03:55 +0200 Stefano Garzarella wrote:
> >> On Wed, Sep 09, 2020 at 01:49:22AM -0700, syzbot wrote:
> >>> Hello,
> >>>
> >>> syzbot found the following issue on:
> >>>
> >>> HEAD commit:    dff9f829 Add linux-next specific files for 20200908
> >>> git tree:       linux-next
> >>> console output: https://syzkaller.appspot.com/x/log.txt?x=112f880d900000
> >>> kernel config:  https://syzkaller.appspot.com/x/.config?x=37b3426c77bda44c
> >>> dashboard link: https://syzkaller.appspot.com/bug?extid=3c23789ea938faaef049
> >>> compiler:       gcc (GCC) 10.1.0-syz 20200507
> >>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17c082a5900000
> >>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1474f5f9900000
> >>>
> >>> Bisection is inconclusive: the first bad commit could be any of:
> >>>
> >>> d730b1a2 io_uring: add IOURING_REGISTER_RESTRICTIONS opcode
> >>> 7ec3d1dd io_uring: allow disabling rings during the creation
> >>
> >> I'm not sure it is related, but while rebasing I forgot to update the
> >> right label in the error path.
> >>
> >> Since the check of ring state is after the increase of ctx refcount, we
> >> need to decrease it jumping to 'out' label instead of 'out_fput':
> > 
> > I think we need to fix 6a7bb9ff5744 ("io_uring: remove need for
> > sqd->ctx_lock in io_sq_thread()") because the syzbot report
> > indicates the io_sq_thread has to wake up the kworker before
> > scheduling, and in turn the kworker has the chance to unpark it.
> > 
> > Below is the minimum walkaround I can have because it can't
> > ensure the parker will be waken in every case.
> > 
> > --- a/fs/io_uring.c
> > +++ b/fs/io_uring.c
> > @@ -6834,6 +6834,10 @@ static int io_sq_thread(void *data)
> >  			io_sq_thread_drop_mm();
> >  		}
> >  
> > +		if (kthread_should_park()) {
> > +			/* wake up parker before scheduling */
> > +			continue;
> > +		}
> >  		if (ret & SQT_SPIN) {
> >  			io_run_task_work();
> >  			cond_resched();
> > 
> 
> I think this should go in the slow path:
> 
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 652cc53432d4..1c4fa2a0fd82 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -6839,6 +6839,8 @@ static int io_sq_thread(void *data)
>  		} else if (ret == SQT_IDLE) {
>  			list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
>  				io_ring_set_wakeup_flag(ctx);
> +			if (kthread_should_park())
> +				continue;
>  			schedule();
>  			start_jiffies = jiffies;
>  		}
> 

Yes, I agree since only in this case the kthread is not rescheduled.

Thanks both for the fix :-)
Feel free to add my R-b:

Reviewed-by: Stefano Garzarella <sgarzare@...hat.com>