[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <b29d2635-d640-4b8e-ad43-1aa25c20d7c8@kernel.dk>
Date: Mon, 4 Nov 2024 08:08:24 -0700
From: Jens Axboe <axboe@...nel.dk>
To: Pavel Begunkov <asml.silence@...il.com>,
syzbot <syzbot+e333341d3d985e5173b2@...kaller.appspotmail.com>,
io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-usb@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [io-uring?] [usb?] WARNING in io_get_cqe_overflow (2)
On 11/4/24 6:13 AM, Pavel Begunkov wrote:
> On 11/4/24 11:31, syzbot wrote:
>> syzbot has bisected this issue to:
>>
>> commit 3f1a546444738b21a8c312a4b49dc168b65c8706
>> Author: Jens Axboe <axboe@...nel.dk>
>> Date: Sat Oct 26 01:27:39 2024 +0000
>>
>> io_uring/rsrc: get rid of per-ring io_rsrc_node list
>>
>> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15aaa1f7980000
>> start commit: c88416ba074a Add linux-next specific files for 20241101
>> git tree: linux-next
>> final oops: https://syzkaller.appspot.com/x/report.txt?x=17aaa1f7980000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=13aaa1f7980000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=704b6be2ac2f205f
>> dashboard link: https://syzkaller.appspot.com/bug?extid=e333341d3d985e5173b2
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16ec06a7980000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12c04740580000
>>
>> Reported-by: syzbot+e333341d3d985e5173b2@...kaller.appspotmail.com
>> Fixes: 3f1a54644473 ("io_uring/rsrc: get rid of per-ring io_rsrc_node list")
>>
>> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> Previously all puts were done by requests, which in case of an exiting
> ring were fallback'ed to normal tw. Now, the unregister path posts CQEs,
> while the original task is still alive. Should be fine in general because
> at this point there could be no requests posting in parallel and all
> is synchronised, so it's a false positive, but we need to change the assert
> or something else.
Maybe something ala the below? Also changes these triggers to be
_once(), no point spamming them.
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 00409505bf07..7792ed91469b 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -137,10 +137,11 @@ static inline void io_lockdep_assert_cq_locked(struct io_ring_ctx *ctx)
* Not from an SQE, as those cannot be submitted, but via
* updating tagged resources.
*/
- if (ctx->submitter_task->flags & PF_EXITING)
- lockdep_assert(current_work());
+ if (ctx->submitter_task->flags & PF_EXITING ||
+ percpu_ref_is_dying(&ctx->refs))
+ lockdep_assert_once(current_work());
else
- lockdep_assert(current == ctx->submitter_task);
+ lockdep_assert_once(current == ctx->submitter_task);
}
#endif
}
--
Jens Axboe
Powered by blists - more mailing lists