lkml.org 
[lkml]   [2022]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [syzbot] possible deadlock in throtl_pending_timer_fn
On Fri, Jul 29, 2022 at 08:25:08PM -0700, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit 0a9a25ca78437b39e691bcc3dc8240455b803d8d
> Author: Ming Lei <ming.lei@redhat.com>
> Date: Fri Mar 18 13:01:43 2022 +0000
>
> block: let blkcg_gq grab request queue's refcnt
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16c3cfc2080000
> start commit: cb71b93c2dc3 Add linux-next specific files for 20220628
> git tree: linux-next
> final oops: https://syzkaller.appspot.com/x/report.txt?x=15c3cfc2080000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11c3cfc2080000
> kernel config: https://syzkaller.appspot.com/x/.config?x=badbc1adb2d582eb
> dashboard link: https://syzkaller.appspot.com/bug?extid=934ebb67352c8a490bf3
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17713dee080000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15d24952080000
>
> Reported-by: syzbot+934ebb67352c8a490bf3@syzkaller.appspotmail.com
> Fixes: 0a9a25ca7843 ("block: let blkcg_gq grab request queue's refcnt")

No, this lockdep warning isn't related with the above commit, which
caused another regression, but fixed by commit d578c770c852
("block: avoid calling blkg_free() in atomic context"). Looks syzbot
can't recognize difference between the two different issues.

This specific issue of '[syzbot] possible deadlock in throtl_pending_timer_fn',
is actually introduced by commit ("27029b4b18aa blkcg: fix memleak for iolatency").

blk_throtl_exit() isn't safe to be called before blkg_destroy_all().

The following change should avoid the issue:


diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 869af9d72bcf..1606acb917fd 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1268,6 +1268,7 @@ static int blkcg_css_online(struct cgroup_subsys_state *css)
int blkcg_init_queue(struct request_queue *q)
{
struct blkcg_gq *new_blkg, *blkg;
+ bool need_exit_throtl = false;
bool preloaded;
int ret;

@@ -1301,7 +1302,7 @@ int blkcg_init_queue(struct request_queue *q)

ret = blk_iolatency_init(q);
if (ret) {
- blk_throtl_exit(q);
+ need_exit_throtl = true;
blk_ioprio_exit(q);
goto err_destroy_all;
}
@@ -1310,6 +1311,8 @@ int blkcg_init_queue(struct request_queue *q)

err_destroy_all:
blkg_destroy_all(q);
+ if (need_exit_throtl)
+ blk_throtl_exit(q);
return ret;
err_unlock:
spin_unlock_irq(&q->queue_lock);


Thanks,
Ming

\
 
 \ /
  Last update: 2022-07-30 13:18    [W:0.794 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site