lkml.org 
[lkml]   [2019]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: BUG: unable to handle kernel paging request in io_wq_cancel_all
From
Date
On 10/30/19 1:44 AM, syzbot wrote:
> syzbot has bisected this bug to:
>
> commit ef0524d3654628ead811f328af0a4a2953a8310f
> Author: Jens Axboe <axboe@kernel.dk>
> Date: Thu Oct 24 13:25:42 2019 +0000
>
> io_uring: replace workqueue usage with io-wq
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16acf5d0e00000
> start commit: c57cf383 Add linux-next specific files for 20191029
> git tree: linux-next
> final crash: https://syzkaller.appspot.com/x/report.txt?x=15acf5d0e00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11acf5d0e00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cb86688f30db053d
> dashboard link: https://syzkaller.appspot.com/bug?extid=221cc24572a2fed23b6b
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=168671d4e00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140f4898e00000
>
> Reported-by: syzbot+221cc24572a2fed23b6b@syzkaller.appspotmail.com
> Fixes: ef0524d36546 ("io_uring: replace workqueue usage with io-wq")

Good catch, it's a case of NULL vs ERR_PTR() confusion. I'll fold in
the below fix.


diff --git a/fs/io_uring.c b/fs/io_uring.c
index af1937d66aee..76d653085987 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3534,8 +3534,9 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx,
/* Do QD, or 4 * CPUS, whatever is smallest */
concurrency = min(ctx->sq_entries, 4 * num_online_cpus());
ctx->io_wq = io_wq_create(concurrency, ctx->sqo_mm);
- if (!ctx->io_wq) {
- ret = -ENOMEM;
+ if (IS_ERR(ctx->io_wq)) {
+ ret = PTR_ERR(ctx->io_wq);
+ ctx->io_wq = NULL;
goto err;
}

--
Jens Axboe

\
 
 \ /
  Last update: 2019-10-30 15:42    [W:0.041 / U:0.232 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site