lkml.org 
[lkml]   [2021]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] BUG: sleeping function called from invalid context in __might_resched
Date
On Tuesday, November 16, 2021 9:53:53 AM CET Fabio M. De Francesco wrote:
> On Tuesday, November 16, 2021 9:09:11 AM CET syzbot wrote:
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer is still
triggering
> an issue:
> > BUG: sleeping function called from invalid context in __might_resched
> > [...]
>
> The reproducer is still triggering an issue, but this time it looks like it
> is triggered by a different path of execution.
>
> The same invalid "in_interrupt()" test is also in con_flush_chars().
>
> Let's try to remove it too...
>
> My first idea would be to replace "if (in_interrupt())" with the same
> "preempt_count() || irqs_disabled()" I used in do_con_write(). However I
> noticed that both do_con_write() and con_flush_chars() are only called from
> inside con_write() (which, aside from calling those functions, does nothing
> else).
>
> So why not remove the if (in_interrupt()) from both them and use if
> (preempt_count() || irqs_disabled()) just once in con_write()?
>
> I think this should be the right solution, but I prefer to go one step at a
> time.
>
> Therefore, I'll (1) use the same (redundant, if it was used in con_write())
> test also in con_flush_chars(), (2) wait for Syzbot to confirm that it
fixes
> the bug, and (3) wait for maintainers review and suggestions about whether
or
> not moving those tests one level upper.
>
> #syz test:
> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>
> ---
> Fabio M. De Francesco

Don't know exactly what happened, so let's retry the test...

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 7359c3e80d63..46511d1ac6ee 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2902,7 +2902,7 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
struct vt_notifier_param param;
bool rescan;

- if (in_interrupt())
+ if (preempt_count() || irqs_disabled())
return count;

console_lock();
@@ -3358,7 +3358,7 @@ static void con_flush_chars(struct tty_struct *tty)
{
struct vc_data *vc;

- if (in_interrupt()) /* from flush_to_ldisc */
+ if (preempt_count() || irqs_disabled()) /* from flush_to_ldisc */
return;

/* if we race with con_close(), vt may be null */
\
 
 \ /
  Last update: 2021-11-16 10:03    [W:1.178 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site