linux-kernel - Re: [syzbot] [block?] WARNING in dd_exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2d5e17d7-53a5-4c4e-b961-96a23abfed9f@acm.org>
Date: Mon, 25 Nov 2024 14:58:55 -0800
From: Bart Van Assche <bvanassche@....org>
To: syzbot <syzbot+f53c29806b4b263165f3@...kaller.appspotmail.com>,
 axboe@...nel.dk, linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com, Christoph Hellwig <hch@....de>,
 Damien Le Moal <dlemoal@...nel.org>, Ming Lei <ming.lei@...hat.com>
Subject: Re: [syzbot] [block?] WARNING in dd_exit_sched

On 11/24/24 11:08 PM, syzbot wrote:
> statistics for priority 0: i 8 m 0 d 8 c 0
> WARNING: CPU: 0 PID: 7130 at block/mq-deadline.c:562 dd_exit_sched+0x2a8/0x3a0 block/mq-deadline.c:559
> Modules linked in:
> CPU: 0 UID: 0 PID: 7130 Comm: kworker/u8:10 Not tainted 6.12.0-syzkaller-03657-g43fb83c17ba2 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
> Workqueue: nbd-del nbd_dev_remove_work
> RIP: 0010:dd_exit_sched+0x2a8/0x3a0 block/mq-deadline.c:559
> Call Trace:
>   <TASK>
>   blk_mq_exit_sched+0x2ce/0x4a0 block/blk-mq-sched.c:547
>   elevator_exit+0x5e/0x80 block/elevator.c:159
>   del_gendisk+0x7a8/0x930 block/genhd.c:735
>   nbd_dev_remove drivers/block/nbd.c:264 [inline]
>   nbd_dev_remove_work+0x47/0xe0 drivers/block/nbd.c:280
>   process_one_work kernel/workqueue.c:3229 [inline]
>   process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
>   worker_thread+0x870/0xd30 kernel/workqueue.c:3391
>   kthread+0x2f0/0x390 kernel/kthread.c:389
>   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>   </TASK>

All ongoing I/O requests should have completed before elevator_exit() is
called. del_gendisk() calls __blk_freeze_queue_start() indirectly before
it calls elevator_exit() but it doesn't wait for the queue freeze
operation to complete. Isn't that a bug in del_gendisk()?

Thanks,

Bart.