From: Linus Torvalds <torvalds@linux-foundation.org>
To: Jens Axboe <axboe@kernel.dk>
Cc: syzbot <syzbot+10d25e23199614b7721f@syzkaller.appspotmail.com>,
Arnd Bergmann <arnd@arndb.de>, Borislav Petkov <bp@alien8.de>,
"Darrick J. Wong" <darrick.wong@oracle.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Peter Anvin <hpa@zytor.com>,
Linux API <linux-api@vger.kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
linux-block <linux-block@vger.kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
Andrew Lutomirski <luto@kernel.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
Ingo Molnar <mingo@redhat.com>,
Michael Ellerman <mpe@ellerman.id.au>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Thomas Gleixner <tglx@linutronix.de>,
Al Viro <viro@zeniv.linux.org.uk>,
"the arch/x86 maintainers" <x86@kernel.org>
Subject: Re: WARNING in percpu_ref_kill_and_confirm
Date: Mon, 22 Apr 2019 09:27:58 -0700 [thread overview]
Message-ID: <CAHk-=wgG=RqK8T5kWiZfH7da6rBuqp3kAesP=ETgceb6RzvZng@mail.gmail.com> (raw)
In-Reply-To: <ad884b18-0e03-d6be-02b0-4e5273f068ce@kernel.dk>
[ Crossed emails ]
On Mon, Apr 22, 2019 at 9:23 AM Jens Axboe <axboe@kernel.dk> wrote:
>
> I think the below should fix this. Very early versions of io_uring didn't
> have this issue, since we did the percpu ref tryget for io_uring_register().
Ok, so I like your patch better than mine, but note how syzbot
bisected this to the initial merge of the io_uring code.
I agree that code shouldn't have had this particular issue, but it
looks like it does.
Is there some way to race with io_ring_ctx_wait_and_kill(), which
_also_ does that ref_kill() thing? I'm not seeing how that could
happen, but maybe if the file ref counts get screwed up you have
->release() called early..
Linus
WARNING: multiple messages have this Message-ID (diff)
From: Linus Torvalds <torvalds@linux-foundation.org>
To: Jens Axboe <axboe@kernel.dk>
Cc: syzbot <syzbot+10d25e23199614b7721f@syzkaller.appspotmail.com>,
Arnd Bergmann <arnd@arndb.de>, Borislav Petkov <bp@alien8.de>,
"Darrick J. Wong" <darrick.wong@oracle.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Peter Anvin <hpa@zytor.com>,
Linux API <linux-api@vger.kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
linux-block <linux-block@vger.kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
Andrew Lutomirski <luto@kernel.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
Ingo Molnar <mingo@redhat.com>,
Michael Ellerman <mpe@ellerman.id.au>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Thomas Gleixner <tglx@linutronix.de>,
Al Viro <viro@zeniv.linux.org.uk>
Subject: Re: WARNING in percpu_ref_kill_and_confirm
Date: Mon, 22 Apr 2019 09:27:58 -0700 [thread overview]
Message-ID: <CAHk-=wgG=RqK8T5kWiZfH7da6rBuqp3kAesP=ETgceb6RzvZng@mail.gmail.com> (raw)
In-Reply-To: <ad884b18-0e03-d6be-02b0-4e5273f068ce@kernel.dk>
[ Crossed emails ]
On Mon, Apr 22, 2019 at 9:23 AM Jens Axboe <axboe@kernel.dk> wrote:
>
> I think the below should fix this. Very early versions of io_uring didn't
> have this issue, since we did the percpu ref tryget for io_uring_register().
Ok, so I like your patch better than mine, but note how syzbot
bisected this to the initial merge of the io_uring code.
I agree that code shouldn't have had this particular issue, but it
looks like it does.
Is there some way to race with io_ring_ctx_wait_and_kill(), which
_also_ does that ref_kill() thing? I'm not seeing how that could
happen, but maybe if the file ref counts get screwed up you have
->release() called early..
Linus
next prev parent reply other threads:[~2019-04-22 16:34 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-22 16:06 WARNING in percpu_ref_kill_and_confirm syzbot
2019-04-22 16:23 ` Jens Axboe
2019-04-22 16:27 ` Linus Torvalds [this message]
2019-04-22 16:27 ` Linus Torvalds
2019-04-22 16:32 ` Jens Axboe
2019-04-22 16:32 ` Jens Axboe
2019-04-22 16:38 ` Jens Axboe
2019-04-22 16:38 ` Jens Axboe
2019-04-22 16:48 ` Linus Torvalds
2019-04-22 16:48 ` Linus Torvalds
2019-04-22 16:50 ` Jens Axboe
2019-04-22 16:50 ` Jens Axboe
2019-04-23 14:41 ` Dmitry Vyukov
2019-04-23 14:41 ` Dmitry Vyukov
2019-04-22 16:23 ` Linus Torvalds
2019-04-22 16:23 ` Linus Torvalds
2019-04-22 16:28 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHk-=wgG=RqK8T5kWiZfH7da6rBuqp3kAesP=ETgceb6RzvZng@mail.gmail.com' \
--to=torvalds@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=axboe@kernel.dk \
--cc=bp@alien8.de \
--cc=darrick.wong@oracle.com \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mingo@redhat.com \
--cc=mpe@ellerman.id.au \
--cc=syzbot+10d25e23199614b7721f@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.