From patchwork Fri Jul 1 02:43:28 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omar Sandoval X-Patchwork-Id: 9209177 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8F562607D6 for ; Fri, 1 Jul 2016 02:44:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A55D283F7 for ; Fri, 1 Jul 2016 02:44:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6E5F4285C3; Fri, 1 Jul 2016 02:44:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DF98F283F7 for ; Fri, 1 Jul 2016 02:44:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751959AbcGACo1 (ORCPT ); Thu, 30 Jun 2016 22:44:27 -0400 Received: from mail-pa0-f41.google.com ([209.85.220.41]:35480 "EHLO mail-pa0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751869AbcGACo0 (ORCPT ); Thu, 30 Jun 2016 22:44:26 -0400 Received: by mail-pa0-f41.google.com with SMTP id hl6so34053634pac.2 for ; Thu, 30 Jun 2016 19:43:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osandov-com.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=UZ6AJjXyrDcQKLO8PMtg2vCgInz4cdceUesuUixsIO8=; b=bL7MMlHzbxG/qhhqRjr1zKb0Ywa8zzRBi79JOm9bWpftxUYyYiUtHa7LnF8jtg3egG p922ErgNdVjV6CL5FN6rgWwqR9KdsqdKJt3aw5iiutB/VOAXyH/BNFKDwb7Z4TtiwRKZ W30BG4n1gAUdujrgSe5Kdb8ZQG47WJyO5iOHaJvi1ZFHCyxacGuu+sk/w1V3QVbKSI9E pqqck3f/gkRc8Vhr0/d+9tU+KoawhzAC+sf1c5R1yAaInNpmcviU3vpCnqZ7rI6QLeI3 AEISPpjvkGoc5BgkODskUmSYvBuGGvF7/yhQagrbZVwAqDFJHHUPZrBfL1GpE91tXxhU mLng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=UZ6AJjXyrDcQKLO8PMtg2vCgInz4cdceUesuUixsIO8=; b=X/AZ677ZGdwEd9Q2lQ+qM1fIgXYpNQAw93IWler3Axg6u4SbMGGw/SvhQOuaIGp0tE YIvlNI4CR84rsG3yQM0UAKmH7FJFpSrYR9qosOVB4hZ0KJAkSC3gpc4e4kI+9ytDE1Bq a0dT821heRi+NQIUQVsPhr7RO5KYuLN3eHDxg/aKIYQNneYdA2iGYyvJbYqdPIsji/Cv t52oWE6hbsVqBICbyMipmxErwUOtwHcaVx1opqWIJTXzpu5hzjH8kAlv7c9QO00DQufy gtoNC5F8LdwUkPeqnwR3HYBblUrBJoJgjUOZVSiC+iPDGCrSvptBS8BD6GFRkS8uvquO lJ6A== X-Gm-Message-State: ALyK8tJ1t9OKBfwTY7C3fJyBeNqL7if6ZypcnD+iy89FAe8MQlc2+naOoPIVVnayT1ookcCN X-Received: by 10.66.26.105 with SMTP id k9mr1283190pag.103.1467341010056; Thu, 30 Jun 2016 19:43:30 -0700 (PDT) Received: from vader ([2620:10d:c090:180::1:3d43]) by smtp.gmail.com with ESMTPSA id sp5sm918610pac.37.2016.06.30.19.43.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 30 Jun 2016 19:43:29 -0700 (PDT) Date: Thu, 30 Jun 2016 19:43:28 -0700 From: Omar Sandoval To: Dmitry Vyukov Cc: axboe@kernel.dk, linux-block@vger.kernel.org, LKML , syzkaller , Kostya Serebryany , Alexander Potapenko Subject: Re: block: GPF in get_task_ioprio Message-ID: <20160701024328.GA9765@vader> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Jun 30, 2016 at 10:50:44AM +0200, Dmitry Vyukov wrote: > Hello, > > The following program triggers GPF in get_task_ioprio if run in a parallel loop: Dmitry, Could you please try the below? I'm having a hard time reproducing it but I can see how it could happen; I think `p->io_context` is getting freed in exit_io_context() in between the `if (p->io_context)` and `ret = p->io_context->ioprio`. Thanks, Omar > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > #include > > int main() > { > syscall(SYS_ioprio_set, 0x2ul, 0x0ul, 0x7ffful, 0, 0, 0); > syscall(SYS_ioprio_get, 0x3ul, 0x0ul, 0, 0, 0, 0); > return 0; > } > > This patch also seems to help to trigger it: > > int set_task_ioprio(struct task_struct *task, int ioprio) > { > @@ -150,8 +151,10 @@ static int get_task_ioprio(struct task_struct *p) > if (ret) > goto out; > ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM); > - if (p->io_context) > + if (p->io_context) { > + ndelay(10000); > ret = p->io_context->ioprio; > + } > out: > return ret; > } > > kasan: GPF could be caused by NULL-ptr deref or user memory access > general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN > Modules linked in: > CPU: 2 PID: 8978 Comm: a.out Not tainted 4.7.0-rc5+ #22 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff8800612397c0 ti: ffff880062d08000 task.ti: ffff880062d08000 > RIP: 0010:[] > [] get_task_ioprio+0x9a/0xe0 block/ioprio.c:156 > RSP: 0018:ffff880062d0feb8 EFLAGS: 00010206 > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000007605 > RDX: 0000000000000009 RSI: 0000002004a58c71 RDI: 0000000000000048 > RBP: ffff880062d0fed0 R08: 0000000000000002 R09: 0000000000000002 > R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800647817c0 > R13: ffff8800647827b0 R14: ffffffff82c80ac2 R15: dffffc0000000000 > FS: 0000000001127880(0000) GS:ffff88006d400000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000004b20c0 CR3: 0000000061894000 CR4: 00000000000006e0 > Stack: > ffff8800647817c0 0000000000000000 ffffffff8813a660 ffff880062d0ff48 > ffffffff82c80ec5 ffffffff82c80ac2 ffffffff880f8240 0000000362d0ff48 > 0000000000000000 000040037fff4003 fffffbfff101f048 ffffffff880f81e0 > Call Trace: > [< inline >] SYSC_ioprio_get block/ioprio.c:230 > [] SyS_ioprio_get+0x795/0x9c0 block/ioprio.c:182 > [] entry_SYSCALL_64_fastpath+0x23/0xc1 > arch/x86/entry/entry_64.S:207 > Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 4f 49 8b 9c 24 f0 0f 00 > 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 48 48 89 fa 48 c1 ea 03 <0f> > b6 04 02 84 c0 74 04 3c 01 7e 12 0f b7 5b 48 e8 51 6f 91 fe > RIP [] get_task_ioprio+0x9a/0xe0 block/ioprio.c:156 > RSP > ---[ end trace 8b400ca760ff21a5 ]--- > > On commit 00bf377d19ad3d80cbc7a036521279a86e397bfb (Jun 29). > -- > To unsubscribe from this list: send the line "unsubscribe linux-block" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/block/ioprio.c b/block/ioprio.c index cc7800e9eb44..01b8116298a1 100644 --- a/block/ioprio.c +++ b/block/ioprio.c @@ -150,8 +150,10 @@ static int get_task_ioprio(struct task_struct *p) if (ret) goto out; ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM); + task_lock(p); if (p->io_context) ret = p->io_context->ioprio; + task_unlock(p); out: return ret; }