linux-kernel - Re: [syzbot] possible deadlock in throtl_pending_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YkPIFKn0osBGOgma@T590>
Date:   Wed, 30 Mar 2022 11:01:40 +0800
From:   Ming Lei <ming.lei@...hat.com>
To:     syzbot <syzbot+934ebb67352c8a490bf3@...kaller.appspotmail.com>
Cc:     axboe@...nel.dk, cgroups@...r.kernel.org,
        linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, tj@...nel.org
Subject: Re: [syzbot] possible deadlock in throtl_pending_timer_fn

On Tue, Mar 29, 2022 at 07:52:57PM -0700, syzbot wrote:
> > On Wed, Mar 30, 2022 at 5:23 AM syzbot
> > <syzbot+934ebb67352c8a490bf3@...kaller.appspotmail.com> wrote:
> >>
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit:    cb7cbaae7fd9 Merge tag 'drm-next-2022-03-25' of git://anon..
> >> git tree:       upstream
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef8b43700000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=7094767cefc58fb9
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=934ebb67352c8a490bf3
> >> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> >>
> >> Unfortunately, I don't have any reproducer for this issue yet.
> >>
> >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >> Reported-by: syzbot+934ebb67352c8a490bf3@...kaller.appspotmail.com
> >
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
> 
> This crash does not have a reproducer. I cannot test it.

This one is triggered in case of memory allocation failure, especially blkg_free()
is called from blkg_alloc() directly. That is why it is hard to reproduce, and it
is one old issue.


Thanks,
Ming