From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754128AbdBHKsX (ORCPT <rfc822;w@1wt.eu>);
        Wed, 8 Feb 2017 05:48:23 -0500
Received: from mail-vk0-f68.google.com ([209.85.213.68]:33443 "EHLO
        mail-vk0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753153AbdBHKsE (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 8 Feb 2017 05:48:04 -0500
MIME-Version: 1.0
In-Reply-To: <CACT4Y+bV5zq_nkiWEYQ_0UK=FhdWsN2rz9X95s1KDG99rHoZ+g@mail.gmail.com>
References: <CACT4Y+bV5zq_nkiWEYQ_0UK=FhdWsN2rz9X95s1KDG99rHoZ+g@mail.gmail.com>
From: Ming Lei <tom.leiming@gmail.com>
Date: Wed, 8 Feb 2017 18:39:41 +0800
Message-ID: <CACVXFVPYbfBJXg1j3gt6Umv3Bqqva2wzATrnzN7d4NWiRvDgiA@mail.gmail.com>
Subject: Re: loop: divide error in transfer_xor
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Jens Axboe <axboe@fb.com>, Hannes Reinecke <hare@suse.com>,
        Mike Christie <mchristi@redhat.com>, Petr Mladek <pmladek@suse.com>,
        Omar Sandoval <osandov@fb.com>, LKML <linux-kernel@vger.kernel.org>,
        syzkaller <syzkaller@googlegroups.com>
Content-Type: multipart/mixed; boundary=001a114e1ce27acc910548027b26
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--001a114e1ce27acc910548027b26
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 8, 2017 at 5:32 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers divide error in transfer_xor:
> https://gist.githubusercontent.com/dvyukov/bed5c929410b5619ff491c7ab22ae3=
f8/raw/69756a281ea0057799943412e60b8256b9f1af73/gistfile1.txt
>
> divide error: 0000 [#1] SMP KASAN
> CPU: 0 PID: 2935 Comm: loop7 Not tainted 4.10.0-rc7+ #213
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2=
011
> task: ffff88006ba1e840 task.stack: ffff880067338000
> RIP: 0010:transfer_xor+0x1d1/0x440 drivers/block/loop.c:110
> RSP: 0018:ffff88006733f108 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff8800688d7000 RCX: 0000000000000059
> RDX: 0000000000000000 RSI: 1ffff1000d743f43 RDI: ffff880068891c08
> RBP: ffff88006733f160 R08: ffff8800688d7001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800688d7000
> R13: ffff880067b7d000 R14: dffffc0000000000 R15: 0000000000000000
> FS:  0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000=
000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000006c17e0 CR3: 0000000066e3b000 CR4: 00000000001406f0
> Call Trace:
>  lo_do_transfer drivers/block/loop.c:251 [inline]
>  lo_read_transfer drivers/block/loop.c:392 [inline]
>  do_req_filebacked drivers/block/loop.c:541 [inline]
>  loop_handle_cmd drivers/block/loop.c:1677 [inline]
>  loop_queue_work+0xda0/0x49b0 drivers/block/loop.c:1689
>  kthread_worker_fn+0x4c3/0xa30 kernel/kthread.c:630
>  kthread+0x326/0x3f0 kernel/kthread.c:227
>  ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
> Code: 03 83 e2 07 41 29 df 42 0f b6 04 30 4d 8d 44 24 01 38 d0 7f 08
> 84 c0 0f 85 62 02 00 00 44 89 f8 41 0f b6 48 ff 25 ff 01 00 00 99 <f7>
> 7d c8 48 63 d2 48 03 55 d0 48 89 d0 48 89 d7 48 c1 e8 03 83
> RIP: transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: ffff88006733f=
108
> ---[ end trace 0166f7bd3b0c0933 ]---
>
> On commit 8b1b41ee74f9712c355d66dc105bbea663ae0afd

Looks a race between set status and I/O, could you test the attached
patch to see if this oops can be fixed?


Thanks=EF=BC=8C
Ming Lei

--001a114e1ce27acc910548027b26
Content-Type: text/x-patch; charset=US-ASCII; 
	name="0001-block-loop-fix-race-between-I-O-and-set_status.patch"
Content-Disposition: attachment; 
	filename="0001-block-loop-fix-race-between-I-O-and-set_status.patch"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_iywtpbox0

RnJvbSAzOGZjNGZkYWJmYjM0MmMxY2ExMGJhY2MwOTVhNDBiYTVjNzI5YWNjIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBNaW5nIExlaSA8dG9tLmxlaW1pbmdAZ21haWwuY29tPgpEYXRl
OiBXZWQsIDggRmViIDIwMTcgMTg6MDg6NDYgKzA4MDAKU3ViamVjdDogW1BBVENIXSBibG9jay9s
b29wOiBmaXggcmFjZSBiZXR3ZWVuIEkvTyBhbmQgc2V0X3N0YXR1cwoKRHVyaW5nIHNldCBzdGF0
dXMsIHRyYW5zZmVyIHdpbGwgYmUgc2V0dXAgYWdhaW4sIHNvCndlIG5lZWQgdG8gZHJhaW4gSU8g
YmVmb3JlIHRoZSB0cmFuc2l0aW9uLCBvdGhlcndpc2UKb29wcyBtYXkgYmUgdHJpZ2dlcmVkIGxp
a2UgdGhlIGZvbGxvd2luZzoKCglkaXZpZGUgZXJyb3I6IDAwMDAgWyMxXSBTTVAgS0FTQU4KCUNQ
VTogMCBQSUQ6IDI5MzUgQ29tbTogbG9vcDcgTm90IHRhaW50ZWQgNC4xMC4wLXJjNysgIzIxMwoJ
SGFyZHdhcmUgbmFtZTogUUVNVSBTdGFuZGFyZCBQQyAoaTQ0MEZYICsgUElJWCwgMTk5NiksIEJJ
T1MgQm9jaHMKCTAxLzAxLzIwMTEKCXRhc2s6IGZmZmY4ODAwNmJhMWU4NDAgdGFzay5zdGFjazog
ZmZmZjg4MDA2NzMzODAwMAoJUklQOiAwMDEwOnRyYW5zZmVyX3hvcisweDFkMS8weDQ0MCBkcml2
ZXJzL2Jsb2NrL2xvb3AuYzoxMTAKCVJTUDogMDAxODpmZmZmODgwMDY3MzNmMTA4IEVGTEFHUzog
MDAwMTAyNDYKCVJBWDogMDAwMDAwMDAwMDAwMDAwMCBSQlg6IGZmZmY4ODAwNjg4ZDcwMDAgUkNY
OiAwMDAwMDAwMDAwMDAwMDU5CglSRFg6IDAwMDAwMDAwMDAwMDAwMDAgUlNJOiAxZmZmZjEwMDBk
NzQzZjQzIFJESTogZmZmZjg4MDA2ODg5MWMwOAoJUkJQOiBmZmZmODgwMDY3MzNmMTYwIFIwODog
ZmZmZjg4MDA2ODhkNzAwMSBSMDk6IDAwMDAwMDAwMDAwMDAwMDAKCVIxMDogMDAwMDAwMDAwMDAw
MDAwMCBSMTE6IDAwMDAwMDAwMDAwMDAwMDAgUjEyOiBmZmZmODgwMDY4OGQ3MDAwCglSMTM6IGZm
ZmY4ODAwNjdiN2QwMDAgUjE0OiBkZmZmZmMwMDAwMDAwMDAwIFIxNTogMDAwMDAwMDAwMDAwMDAw
MAoJRlM6ICAwMDAwMDAwMDAwMDAwMDAwKDAwMDApIEdTOmZmZmY4ODAwNmQwMDAwMDAoMDAwMCkK
CWtubEdTOjAwMDAwMDAwMDAwMDAwMDAKCUNTOiAgMDAxMCBEUzogMDAwMCBFUzogMDAwMCBDUjA6
IDAwMDAwMDAwODAwNTAwMzMKCUNSMjogMDAwMDAwMDAwMDZjMTdlMCBDUjM6IDAwMDAwMDAwNjZl
M2IwMDAgQ1I0OiAwMDAwMDAwMDAwMTQwNmYwCglDYWxsIFRyYWNlOgoJIGxvX2RvX3RyYW5zZmVy
IGRyaXZlcnMvYmxvY2svbG9vcC5jOjI1MSBbaW5saW5lXQoJIGxvX3JlYWRfdHJhbnNmZXIgZHJp
dmVycy9ibG9jay9sb29wLmM6MzkyIFtpbmxpbmVdCgkgZG9fcmVxX2ZpbGViYWNrZWQgZHJpdmVy
cy9ibG9jay9sb29wLmM6NTQxIFtpbmxpbmVdCgkgbG9vcF9oYW5kbGVfY21kIGRyaXZlcnMvYmxv
Y2svbG9vcC5jOjE2NzcgW2lubGluZV0KCSBsb29wX3F1ZXVlX3dvcmsrMHhkYTAvMHg0OWIwIGRy
aXZlcnMvYmxvY2svbG9vcC5jOjE2ODkKCSBrdGhyZWFkX3dvcmtlcl9mbisweDRjMy8weGEzMCBr
ZXJuZWwva3RocmVhZC5jOjYzMAoJIGt0aHJlYWQrMHgzMjYvMHgzZjAga2VybmVsL2t0aHJlYWQu
YzoyMjcKCSByZXRfZnJvbV9mb3JrKzB4MzEvMHg0MCBhcmNoL3g4Ni9lbnRyeS9lbnRyeV82NC5T
OjQzMAoJQ29kZTogMDMgODMgZTIgMDcgNDEgMjkgZGYgNDIgMGYgYjYgMDQgMzAgNGQgOGQgNDQg
MjQgMDEgMzggZDAgN2YgMDgKCTg0IGMwIDBmIDg1IDYyIDAyIDAwIDAwIDQ0IDg5IGY4IDQxIDBm
IGI2IDQ4IGZmIDI1IGZmIDAxIDAwIDAwIDk5IDxmNz4KCTdkIGM4IDQ4IDYzIGQyIDQ4IDAzIDU1
IGQwIDQ4IDg5IGQwIDQ4IDg5IGQ3IDQ4IGMxIGU4IDAzIDgzCglSSVA6IHRyYW5zZmVyX3hvcisw
eDFkMS8weDQ0MCBkcml2ZXJzL2Jsb2NrL2xvb3AuYzoxMTAgUlNQOgoJZmZmZjg4MDA2NzMzZjEw
OAoJLS0tWyBlbmQgdHJhY2UgMDE2NmY3YmQzYjBjMDkzMyBdLS0tCgpSZXBvcnRlZC1ieTogRG1p
dHJ5IFZ5dWtvdiA8ZHZ5dWtvdkBnb29nbGUuY29tPgpDYzogc3RhYmxlQHZnZXIua2VybmVsLm9y
ZwpTaWduZWQtb2ZmLWJ5OiBNaW5nIExlaSA8dG9tLmxlaW1pbmdAZ21haWwuY29tPgotLS0KIGRy
aXZlcnMvYmxvY2svbG9vcC5jIHwgMTcgKysrKysrKysrKysrLS0tLS0KIDEgZmlsZSBjaGFuZ2Vk
LCAxMiBpbnNlcnRpb25zKCspLCA1IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2RyaXZlcnMv
YmxvY2svbG9vcC5jIGIvZHJpdmVycy9ibG9jay9sb29wLmMKaW5kZXggZWQ1MjU5NTEwODU3Li40
YjUyYTE2OTAzMjkgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvYmxvY2svbG9vcC5jCisrKyBiL2RyaXZl
cnMvYmxvY2svbG9vcC5jCkBAIC0xMDk3LDkgKzEwOTcsMTIgQEAgbG9vcF9zZXRfc3RhdHVzKHN0
cnVjdCBsb29wX2RldmljZSAqbG8sIGNvbnN0IHN0cnVjdCBsb29wX2luZm82NCAqaW5mbykKIAlp
ZiAoKHVuc2lnbmVkIGludCkgaW5mby0+bG9fZW5jcnlwdF9rZXlfc2l6ZSA+IExPX0tFWV9TSVpF
KQogCQlyZXR1cm4gLUVJTlZBTDsKIAorCS8qIEkvTyBuZWVkIHRvIGJlIGRyYWluZWQgZHVyaW5n
IHRyYW5zZmVyIHRyYW5zaXRpb24gKi8KKwlibGtfbXFfZnJlZXplX3F1ZXVlKGxvLT5sb19xdWV1
ZSk7CisKIAllcnIgPSBsb29wX3JlbGVhc2VfeGZlcihsbyk7CiAJaWYgKGVycikKLQkJcmV0dXJu
IGVycjsKKwkJZ290byBleGl0OwogCiAJaWYgKGluZm8tPmxvX2VuY3J5cHRfdHlwZSkgewogCQl1
bnNpZ25lZCBpbnQgdHlwZSA9IGluZm8tPmxvX2VuY3J5cHRfdHlwZTsKQEAgLTExMTQsMTIgKzEx
MTcsMTQgQEAgbG9vcF9zZXRfc3RhdHVzKHN0cnVjdCBsb29wX2RldmljZSAqbG8sIGNvbnN0IHN0
cnVjdCBsb29wX2luZm82NCAqaW5mbykKIAogCWVyciA9IGxvb3BfaW5pdF94ZmVyKGxvLCB4ZmVy
LCBpbmZvKTsKIAlpZiAoZXJyKQotCQlyZXR1cm4gZXJyOworCQlnb3RvIGV4aXQ7CiAKIAlpZiAo
bG8tPmxvX29mZnNldCAhPSBpbmZvLT5sb19vZmZzZXQgfHwKIAkgICAgbG8tPmxvX3NpemVsaW1p
dCAhPSBpbmZvLT5sb19zaXplbGltaXQpCi0JCWlmIChmaWd1cmVfbG9vcF9zaXplKGxvLCBpbmZv
LT5sb19vZmZzZXQsIGluZm8tPmxvX3NpemVsaW1pdCkpCi0JCQlyZXR1cm4gLUVGQklHOworCQlp
ZiAoZmlndXJlX2xvb3Bfc2l6ZShsbywgaW5mby0+bG9fb2Zmc2V0LCBpbmZvLT5sb19zaXplbGlt
aXQpKSB7CisJCQllcnIgPSAtRUZCSUc7CisJCQlnb3RvIGV4aXQ7CisJCX0KIAogCWxvb3BfY29u
ZmlnX2Rpc2NhcmQobG8pOwogCkBAIC0xMTU2LDcgKzExNjEsOSBAQCBsb29wX3NldF9zdGF0dXMo
c3RydWN0IGxvb3BfZGV2aWNlICpsbywgY29uc3Qgc3RydWN0IGxvb3BfaW5mbzY0ICppbmZvKQog
CS8qIHVwZGF0ZSBkaW8gaWYgbG9fb2Zmc2V0IG9yIHRyYW5zZmVyIGlzIGNoYW5nZWQgKi8KIAlf
X2xvb3BfdXBkYXRlX2RpbyhsbywgbG8tPnVzZV9kaW8pOwogCi0JcmV0dXJuIDA7CisgZXhpdDoK
KwlibGtfbXFfdW5mcmVlemVfcXVldWUobG8tPmxvX3F1ZXVlKTsKKwlyZXR1cm4gZXJyOwogfQog
CiBzdGF0aWMgaW50Ci0tIAoyLjcuNAoK
--001a114e1ce27acc910548027b26--