linux-kernel - Re: [PATCH] nbd: defer config put in recv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251110005453.546675-1-lizhi.xu@windriver.com>
Date: Mon, 10 Nov 2025 08:54:53 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <zhengqixing@...weicloud.com>
CC: <axboe@...nel.dk>, <houtao1@...wei.com>, <josef@...icpanda.com>,
        <linan122@...artners.com>, <linux-block@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <nbd@...er.debian.org>,
        <xiubli@...hat.com>, <yangerkun@...wei.com>, <yi.zhang@...wei.com>,
        <zhengqixing@...wei.com>
Subject: Re: [PATCH] nbd: defer config put in recv_work

On Sat,  8 Nov 2025 15:02:02 +0800, Zheng Qixing wrote:
> Reported-by: syzbot+56fbf4c7ddf65e95c7cc@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6907edce.a70a0220.37351b.0014.GAE@google.com/T/
> Fixes: 87aac3a80af5 ("nbd: make the config put is called before the notifying the waiter")
> Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
> Signed-off-by: Zheng Qixing <zhengqixing@...wei.com>
> ---
>  drivers/block/nbd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index a853c65ac65d..215fc18115b7 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -1024,9 +1024,9 @@ static void recv_work(struct work_struct *work)
>  	nbd_mark_nsock_dead(nbd, nsock, 1);
>  	mutex_unlock(&nsock->tx_lock);
> 
> -	nbd_config_put(nbd);
>  	atomic_dec(&config->recv_threads);
>  	wake_up(&config->recv_wq);
> +	nbd_config_put(nbd);
>  	kfree(args);
>  }
This only makes the problem more hidden, and that's far from enough.
I tested the same patch on syzbot on October 3rd before you did; you
can check it out here [1].

[1] https://syzkaller.appspot.com/bug?extid=56fbf4c7ddf65e95c7cc