| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250721015344.2609-1-hdanton@sina.com>
Date: Mon, 21 Jul 2025 09:53:43 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+4bb2305559463e8f6a2a@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [kernfs?] possible deadlock in kernfs_iop_getattr
> Date: Thu, 10 Apr 2025 13:33:29 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 2eb959eeecc6 Merge tag 'for-linus-6.15a-rc2-tag' of git://..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16fdf23f980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4c918722cb7e3d7
> dashboard link: https://syzkaller.appspot.com/bug?extid=4bb2305559463e8f6a2a
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1352b7e4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17499d78580000
#syz test upstream master
--- x/drivers/block/loop.c
+++ y/drivers/block/loop.c
@@ -443,9 +443,8 @@ static void loop_reread_partitions(struc
__func__, lo->lo_number, lo->lo_file_name, rc);
}
-static unsigned int loop_query_min_dio_size(struct loop_device *lo)
+static unsigned int loop_query_min_dio_size(struct file *file)
{
- struct file *file = lo->lo_backing_file;
struct block_device *sb_bdev = file->f_mapping->host->i_sb->s_bdev;
struct kstat st;
@@ -497,7 +496,8 @@ static int loop_validate_file(struct fil
return 0;
}
-static void loop_assign_backing_file(struct loop_device *lo, struct file *file)
+static void loop_assign_backing_file(struct loop_device *lo, struct file *file,
+ unsigned int min_dio_size)
{
lo->lo_backing_file = file;
lo->old_gfp_mask = mapping_gfp_mask(file->f_mapping);
@@ -505,7 +505,7 @@ static void loop_assign_backing_file(str
lo->old_gfp_mask & ~(__GFP_IO | __GFP_FS));
if (lo->lo_backing_file->f_flags & O_DIRECT)
lo->lo_flags |= LO_FLAGS_DIRECT_IO;
- lo->lo_min_dio_size = loop_query_min_dio_size(lo);
+ lo->lo_min_dio_size = min_dio_size;
}
static int loop_check_backing_file(struct file *file)
@@ -532,7 +532,7 @@ static int loop_change_fd(struct loop_de
{
struct file *file = fget(arg);
struct file *old_file;
- unsigned int memflags;
+ unsigned int memflags, blksz;
int error;
bool partscan;
bool is_loop;
@@ -581,9 +581,10 @@ static int loop_change_fd(struct loop_de
/* and ... switch */
disk_force_media_change(lo->lo_disk);
+ blksz = loop_query_min_dio_size(file);
memflags = blk_mq_freeze_queue(lo->lo_queue);
mapping_set_gfp_mask(old_file->f_mapping, lo->old_gfp_mask);
- loop_assign_backing_file(lo, file);
+ loop_assign_backing_file(lo, file, blksz);
loop_update_dio(lo);
blk_mq_unfreeze_queue(lo->lo_queue, memflags);
partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;
@@ -974,6 +975,7 @@ static int loop_configure(struct loop_de
{
struct file *file = fget(config->fd);
struct queue_limits lim;
+ unsigned int blksz;
int error;
loff_t size;
bool partscan;
@@ -1043,8 +1045,9 @@ static int loop_configure(struct loop_de
disk_force_media_change(lo->lo_disk);
set_disk_ro(lo->lo_disk, (lo->lo_flags & LO_FLAGS_READ_ONLY) != 0);
+ blksz = loop_query_min_dio_size(file);
lo->lo_device = bdev;
- loop_assign_backing_file(lo, file);
+ loop_assign_backing_file(lo, file, blksz);
lim = queue_limits_start_update(lo->lo_queue);
loop_update_limits(lo, &lim, config->block_size);
--
Powered by blists - more mailing lists