Re: complete_all() with x waiters in swake_up_all_locked

[Sebastian Andrzej Siewior <bigeasy@linutronix.de>]

On 2019-12-13 11:08:35 [+0200], John Mathew wrote:
> 
> I was able to reproduce the warning on v5.2.21-rt14 which is the
> latest tag on the rt-devel branch.
> Here is my analysis.
> What I see is that in crypto/algboss.c there is a probe being
> scheduled when a notification arrives.
> The probe will run a thread: cryptomgr_probe and wait for its completion.
> The issue arises because a similar module is also issues a wait for
> completion on the exactly same completion object (larval->completion).
> The similar module is:  crypto_larval_wait in linux-rt-devel/crypto/api.c
> It is casting a crypto_larval struct pointer from a crypto_alg struct
> pointer which doesn't seem to have/init a completion object.

It should. container_of() statement would be better.

> So it is actually the cryptomgr_probe thread that actually completes
> both its own and the crypto_larval_wait waits and so the number of
> completions exceeds the limit of 2.
> 
> This looks like an error to me.

Why? So multiple threads request a specific algorithm. This is
synchronized into one request which (once complete) invokes
complete_all() to wake all requesting threads. So this does not sound
bad. 
I compiled and tested the syzkaller testcase but still no luck. Is there
something special to you .config?

> So I created patch in the following email.
> I don't think the issue is with the limit, rather a wrong usage of the
> completion object.

But why is there no other error? Like wrong list usage, uninitialized
spin_lock, etc.?

> > > -John

 Sebastian