linux-kernel - Re: [syzbot] BUG: scheduling while atomic in simple_recursive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YkYSX0tibIE5o0h8@zeniv-ca.linux.org.uk>
Date:   Thu, 31 Mar 2022 20:43:11 +0000
From:   Al Viro <viro@...iv.linux.org.uk>
To:     syzbot <syzbot+2778a29e60b4982065a0@...kaller.appspotmail.com>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, Ming Lei <ming.lei@...hat.com>
Subject: Re: [syzbot] BUG: scheduling while atomic in simple_recursive_removal

On Wed, Mar 30, 2022 at 10:37:22AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d888c83fcec7 fs: fix fd table size alignment properly
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=103e7b53700000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cadd7063134e07bc
> dashboard link: https://syzkaller.appspot.com/bug?extid=2778a29e60b4982065a0
> compiler:       aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: arm64
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2778a29e60b4982065a0@...kaller.appspotmail.com

Very likely to have been caused by commit 0a9a25ca7843 "block: let blkcg_gq
grab request queue's refcnt".

It had added dropping a queue refcount (which is blocking) into blkg_free(),
which is called from __blkg_release().  And that is called via call_rcu()
and thus is not allowed to block at all.