| Message ID | 20220907163502.577561-1-syoshida@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | nbd: Fix hung when signal interrupts nbd_start_device_ioctl() | expand |
On Thu, Sep 08, 2022 at 01:35:02AM +0900, Shigeru Yoshida wrote: > syzbot reported hung task [1]. The following program is a simplified > version of the reproducer: > > int main(void) > { > int sv[2], fd; > > if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0) > return 1; > if ((fd = open("/dev/nbd0", 0)) < 0) > return 1; > if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0) > return 1; > if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0) > return 1; > if (ioctl(fd, NBD_DO_IT) < 0) > return 1; > return 0; > } > > When signal interrupt nbd_start_device_ioctl() waiting the condition > atomic_read(&config->recv_threads) == 0, the task can hung because it > waits the completion of the inflight IOs. > > This patch fixes the issue by clearing queue, not just shutdown, when > signal interrupt nbd_start_device_ioctl(). > > Link: https://syzkaller.appspot.com/bug?id=7d89a3ffacd2b83fdd39549bc4d8e0a89ef21239 [1] > Reported-by: syzbot+38e6c55d4969a14c1534@syzkaller.appspotmail.com > Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Thanks, Josef
On Thu, 8 Sep 2022 01:35:02 +0900, Shigeru Yoshida wrote: > syzbot reported hung task [1]. The following program is a simplified > version of the reproducer: > > int main(void) > { > int sv[2], fd; > > [...] Applied, thanks! [1/1] nbd: Fix hung when signal interrupts nbd_start_device_ioctl() commit: 1de7c3cf48fc41cd95adb12bd1ea9033a917798a Best regards,
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 2a709daefbc4..2a2a1d996a57 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1413,10 +1413,12 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd) mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); - if (ret) + if (ret) { sock_shutdown(nbd); - flush_workqueue(nbd->recv_workq); + nbd_clear_que(nbd); + } + flush_workqueue(nbd->recv_workq); mutex_lock(&nbd->config_lock); nbd_bdev_reset(nbd); /* user requested, ignore socket errors */
syzbot reported hung task [1]. The following program is a simplified version of the reproducer: int main(void) { int sv[2], fd; if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0) return 1; if ((fd = open("/dev/nbd0", 0)) < 0) return 1; if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0) return 1; if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0) return 1; if (ioctl(fd, NBD_DO_IT) < 0) return 1; return 0; } When signal interrupt nbd_start_device_ioctl() waiting the condition atomic_read(&config->recv_threads) == 0, the task can hung because it waits the completion of the inflight IOs. This patch fixes the issue by clearing queue, not just shutdown, when signal interrupt nbd_start_device_ioctl(). Link: https://syzkaller.appspot.com/bug?id=7d89a3ffacd2b83fdd39549bc4d8e0a89ef21239 [1] Reported-by: syzbot+38e6c55d4969a14c1534@syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> --- drivers/block/nbd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)