From: Song Liu <song@kernel.org>
To: "Dae R. Jeong" <dae.r.jeong@kaist.ac.kr>
Cc: yjkwon@kaist.ac.kr, linux-raid <linux-raid@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: WARNING in md_ioctl
Date: Sun, 18 Oct 2020 23:18:11 -0700 [thread overview]
Message-ID: <CAPhsuW583=org7AOR-W2vcQV3pTBxin2LG1tb3On=x6VtjXvxQ@mail.gmail.com> (raw)
In-Reply-To: <20201017110651.GA1602260@dragonet>
On Sat, Oct 17, 2020 at 4:13 AM Dae R. Jeong <dae.r.jeong@kaist.ac.kr> wrote:
>
> Hi,
>
> I looked into the warning "WARNING in md_ioctl" found by Syzkaller.
> (https://syzkaller.appspot.com/bug?id=fbf9eaea2e65bfcabb4e2750c3ab0892867edea1)
> I suspect that it is caused by a race between two concurrenct ioctl()s as belows.
>
> CPU1 (md_ioctl()) CPU2 (md_ioctl())
> ------ ------
> set_bit(MD_CLOSING, &mddev->flags);
> did_set_md_closing = true;
> WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
>
> if(did_set_md_closing)
> clear_bit(MD_CLOSING, &mddev->flags);
>
> If the above is correct, this warning is introduced
> in the commit 065e519e("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop").
> Could you please take a look into this?
This is an interesting case. We try to protect against concurrent
ioctl via mddev->openers:
if (mddev->pers && atomic_read(&mddev->openers) > 1) {
mutex_unlock(&mddev->open_mutex);
err = -EBUSY;
goto out;
}
But in this case, we are sending multiple ioctl from the same fd, so
openers == 1.
We can probably do something like:
diff --git i/drivers/md/md.c w/drivers/md/md.c
index 6072782070230..49442a3f4605b 100644
--- i/drivers/md/md.c
+++ w/drivers/md/md.c
@@ -7591,8 +7591,10 @@ static int md_ioctl(struct block_device *bdev,
fmode_t mode,
err = -EBUSY;
goto out;
}
- WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
- set_bit(MD_CLOSING, &mddev->flags);
+ if (test_and_set_bit(MD_CLOSING, &mddev->flags)) {
+ err = -EBUSY;
+ goto out;
+ }
did_set_md_closing = true;
mutex_unlock(&mddev->open_mutex);
sync_blockdev(bdev);
Could you please test whether this fixes the issue?
Thanks,
Song
next prev parent reply other threads:[~2020-10-19 6:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-17 11:06 WARNING in md_ioctl Dae R. Jeong
2020-10-19 6:18 ` Song Liu [this message]
2020-10-19 7:03 ` Dae R. Jeong
2020-10-21 5:28 ` Song Liu
2020-10-22 0:24 ` Dae R. Jeong
-- strict thread matches above, loose matches on Subject: below --
2018-04-30 1:00 syzbot
2019-11-25 22:37 ` syzbot
2019-11-26 8:42 ` Daniel Vetter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAPhsuW583=org7AOR-W2vcQV3pTBxin2LG1tb3On=x6VtjXvxQ@mail.gmail.com' \
--to=song@kernel.org \
--cc=dae.r.jeong@kaist.ac.kr \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-raid@vger.kernel.org \
--cc=yjkwon@kaist.ac.kr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).