Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1320535 > unrolled thread
| Started by | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| First post | 2016-01-28 11:40 +0100 |
| Last post | 2016-01-29 10:30 +0100 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: floppy: GPF in floppy_rb0_cb Dmitry Vyukov <dvyukov@google.com> - 2016-01-28 11:40 +0100
[PATCH] floppy: fix lock_fdc() signal handling Jiri Kosina <jikos@kernel.org> - 2016-01-28 11:50 +0100
Re: [PATCH] floppy: fix lock_fdc() signal handling Dmitry Vyukov <dvyukov@google.com> - 2016-01-29 10:30 +0100
| From | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| Date | 2016-01-28 11:40 +0100 |
| Subject | Re: floppy: GPF in floppy_rb0_cb |
| Message-ID | <qVS9A-24O-7@gated-at.bofh.it> |
On Wed, Jan 27, 2016 at 9:27 PM, Jiri Kosina <jikos@kernel.org> wrote: > On Wed, 27 Jan 2016, Dmitry Vyukov wrote: > >> > Alright, there is a serious issue with how floppy_revalidate() handles >> > error from lock_fdc() (in-depth explanation for the curious: it doesn't). >> > >> > In case wait_for_event_interruptible() is actually interrupted without >> > succesfully claiming fdc, we proceed with revalidation, causing all kinds >> > of havoc (because another parallel request is still in progress). >> > >> > The whole story with the 'interruptible' parameter to lock_fdc() is funny >> > as well, because we always wait interruptibly anyway. So it can be nuked. >> > Most of the lock_fdc() callsites do properly handle error (and propagate >> > EINTR), but floppy_revalidate() and floppy_check_events() don't. >> > >> > Could you please let syzkaller retest with the patch below? It fixes all >> > the oopses I am able to trigger here. >> >> Done. I will get back to you if I see any other oops. > > Please also get to me in case you don't see any other oops after the > timeframe you have been able to reproduce the original problem, so that we > could consider the issue resolved and I can make proper patch from this > and send it upstream. I have not seen any /dev/fd0 related crashes over night. Previously I seen tons of them, so I guess this bug is fixed. Please send this upstream. Thanks
[toc] | [next] | [standalone]
| From | Jiri Kosina <jikos@kernel.org> |
|---|---|
| Date | 2016-01-28 11:50 +0100 |
| Subject | [PATCH] floppy: fix lock_fdc() signal handling |
| Message-ID | <qVSjg-28z-31@gated-at.bofh.it> |
| In reply to | #1320535 |
On Thu, 28 Jan 2016, Dmitry Vyukov wrote:
> I have not seen any /dev/fd0 related crashes over night. Previously I
> seen tons of them, so I guess this bug is fixed.
> Please send this upstream.
> Thanks
Thanks a lot for testing, Dmitry.
Jens, here is the patch with proper changelog. Could you please apply it
to your tree? Or would you prefer a pull request with this single patch in
it?
Thanks.
From: Jiri Kosina <jkosina@suse.cz>
Subject: [PATCH] floppy: fix lock_fdc() signal handling
floppy_revalidate() doesn't perform any error handling on lock_fdc()
result. lock_fdc() might actually be interrupted by a signal (it waits for
fdc becoming non-busy interruptibly). In such case, floppy_revalidate()
proceeds as if it had claimed the lock, but it fact it doesn't.
In case of multiple threads trying to open("/dev/fdX"), this leads to
serious corruptions all over the place, because all of a sudden there is
no critical section protection (that'd otherwise be guaranteed by locked
fd) whatsoever.
While at this, fix the fact that the 'interruptible' parameter to
lock_fdc() doesn't make any sense whatsoever, because we always wait
interruptibly anyway.
Most of the lock_fdc() callsites do properly handle error (and propagate
EINTR), but floppy_revalidate() and floppy_check_events() don't. Fix this.
Spotted by 'syzkaller' tool.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
drivers/block/floppy.c | 33 ++++++++++++++++++---------------
1 file changed, 18 insertions(+), 15 deletions(-)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9e25120..b206115 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -866,7 +866,7 @@ static void set_fdc(int drive)
}
/* locks the driver */
-static int lock_fdc(int drive, bool interruptible)
+static int lock_fdc(int drive)
{
if (WARN(atomic_read(&usage_count) == 0,
"Trying to lock fdc while usage count=0\n"))
@@ -2173,7 +2173,7 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
{
int ret;
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
set_floppy(drive);
@@ -2960,7 +2960,7 @@ static int user_reset_fdc(int drive, int arg, bool interruptible)
{
int ret;
- if (lock_fdc(drive, interruptible))
+ if (lock_fdc(drive))
return -EINTR;
if (arg == FD_RESET_ALWAYS)
@@ -3243,7 +3243,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
mutex_lock(&open_lock);
- if (lock_fdc(drive, true)) {
+ if (lock_fdc(drive)) {
mutex_unlock(&open_lock);
return -EINTR;
}
@@ -3263,7 +3263,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
} else {
int oldStretch;
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
if (cmd != FDDEFPRM) {
/* notice a disk change immediately, else
@@ -3349,7 +3349,7 @@ static int get_floppy_geometry(int drive, int type, struct floppy_struct **g)
if (type)
*g = &floppy_type[type];
else {
- if (lock_fdc(drive, false))
+ if (lock_fdc(drive))
return -EINTR;
if (poll_drive(false, 0) == -EINTR)
return -EINTR;
@@ -3433,7 +3433,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
if (UDRS->fd_ref != 1)
/* somebody else has this drive open */
return -EBUSY;
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
/* do the actual eject. Fails on
@@ -3445,7 +3445,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
process_fd_request();
return ret;
case FDCLRPRM:
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
current_type[drive] = NULL;
floppy_sizes[drive] = MAX_DISK_SIZE << 1;
@@ -3467,7 +3467,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
UDP->flags &= ~FTD_MSG;
return 0;
case FDFMTBEG:
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
return -EINTR;
@@ -3484,7 +3484,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
return do_format(drive, &inparam.f);
case FDFMTEND:
case FDFLUSH:
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
return invalidate_drive(bdev);
case FDSETEMSGTRESH:
@@ -3507,7 +3507,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
outparam = UDP;
break;
case FDPOLLDRVSTAT:
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
return -EINTR;
@@ -3530,7 +3530,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
case FDRAWCMD:
if (type)
return -EINVAL;
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
set_floppy(drive);
i = raw_cmd_ioctl(cmd, (void __user *)param);
@@ -3539,7 +3539,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
process_fd_request();
return i;
case FDTWADDLE:
- if (lock_fdc(drive, true))
+ if (lock_fdc(drive))
return -EINTR;
twaddle();
process_fd_request();
@@ -3748,7 +3748,8 @@ static unsigned int floppy_check_events(struct gendisk *disk,
return DISK_EVENT_MEDIA_CHANGE;
if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
- lock_fdc(drive, false);
+ if (lock_fdc(drive))
+ return -EINTR;
poll_drive(false, 0);
process_fd_request();
}
@@ -3847,7 +3848,9 @@ static int floppy_revalidate(struct gendisk *disk)
"VFS: revalidate called on non-open device.\n"))
return -EFAULT;
- lock_fdc(drive, false);
+ res = lock_fdc(drive);
+ if (res)
+ return res;
cf = (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags) ||
test_bit(FD_VERIFY_BIT, &UDRS->flags));
if (!(cf || test_bit(drive, &fake_change) || drive_no_geom(drive))) {
[toc] | [prev] | [next] | [standalone]
| From | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| Date | 2016-01-29 10:30 +0100 |
| Subject | Re: [PATCH] floppy: fix lock_fdc() signal handling |
| Message-ID | <qWdxn-Dc-1@gated-at.bofh.it> |
| In reply to | #1320547 |
On Thu, Jan 28, 2016 at 11:43 AM, Jiri Kosina <jikos@kernel.org> wrote:
> On Thu, 28 Jan 2016, Dmitry Vyukov wrote:
>
>> I have not seen any /dev/fd0 related crashes over night. Previously I
>> seen tons of them, so I guess this bug is fixed.
>> Please send this upstream.
>> Thanks
>
> Thanks a lot for testing, Dmitry.
>
> Jens, here is the patch with proper changelog. Could you please apply it
> to your tree? Or would you prefer a pull request with this single patch in
> it?
> Thanks.
Done
Replaced the old patch with this one.
Thanks for a quick fix
> From: Jiri Kosina <jkosina@suse.cz>
> Subject: [PATCH] floppy: fix lock_fdc() signal handling
>
> floppy_revalidate() doesn't perform any error handling on lock_fdc()
> result. lock_fdc() might actually be interrupted by a signal (it waits for
> fdc becoming non-busy interruptibly). In such case, floppy_revalidate()
> proceeds as if it had claimed the lock, but it fact it doesn't.
>
> In case of multiple threads trying to open("/dev/fdX"), this leads to
> serious corruptions all over the place, because all of a sudden there is
> no critical section protection (that'd otherwise be guaranteed by locked
> fd) whatsoever.
>
> While at this, fix the fact that the 'interruptible' parameter to
> lock_fdc() doesn't make any sense whatsoever, because we always wait
> interruptibly anyway.
>
> Most of the lock_fdc() callsites do properly handle error (and propagate
> EINTR), but floppy_revalidate() and floppy_check_events() don't. Fix this.
>
> Spotted by 'syzkaller' tool.
>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Tested-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
> ---
> drivers/block/floppy.c | 33 ++++++++++++++++++---------------
> 1 file changed, 18 insertions(+), 15 deletions(-)
>
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 9e25120..b206115 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -866,7 +866,7 @@ static void set_fdc(int drive)
> }
>
> /* locks the driver */
> -static int lock_fdc(int drive, bool interruptible)
> +static int lock_fdc(int drive)
> {
> if (WARN(atomic_read(&usage_count) == 0,
> "Trying to lock fdc while usage count=0\n"))
> @@ -2173,7 +2173,7 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
> {
> int ret;
>
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
>
> set_floppy(drive);
> @@ -2960,7 +2960,7 @@ static int user_reset_fdc(int drive, int arg, bool interruptible)
> {
> int ret;
>
> - if (lock_fdc(drive, interruptible))
> + if (lock_fdc(drive))
> return -EINTR;
>
> if (arg == FD_RESET_ALWAYS)
> @@ -3243,7 +3243,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
> if (!capable(CAP_SYS_ADMIN))
> return -EPERM;
> mutex_lock(&open_lock);
> - if (lock_fdc(drive, true)) {
> + if (lock_fdc(drive)) {
> mutex_unlock(&open_lock);
> return -EINTR;
> }
> @@ -3263,7 +3263,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
> } else {
> int oldStretch;
>
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> if (cmd != FDDEFPRM) {
> /* notice a disk change immediately, else
> @@ -3349,7 +3349,7 @@ static int get_floppy_geometry(int drive, int type, struct floppy_struct **g)
> if (type)
> *g = &floppy_type[type];
> else {
> - if (lock_fdc(drive, false))
> + if (lock_fdc(drive))
> return -EINTR;
> if (poll_drive(false, 0) == -EINTR)
> return -EINTR;
> @@ -3433,7 +3433,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> if (UDRS->fd_ref != 1)
> /* somebody else has this drive open */
> return -EBUSY;
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
>
> /* do the actual eject. Fails on
> @@ -3445,7 +3445,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> process_fd_request();
> return ret;
> case FDCLRPRM:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> current_type[drive] = NULL;
> floppy_sizes[drive] = MAX_DISK_SIZE << 1;
> @@ -3467,7 +3467,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> UDP->flags &= ~FTD_MSG;
> return 0;
> case FDFMTBEG:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
> return -EINTR;
> @@ -3484,7 +3484,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> return do_format(drive, &inparam.f);
> case FDFMTEND:
> case FDFLUSH:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> return invalidate_drive(bdev);
> case FDSETEMSGTRESH:
> @@ -3507,7 +3507,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> outparam = UDP;
> break;
> case FDPOLLDRVSTAT:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
> return -EINTR;
> @@ -3530,7 +3530,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> case FDRAWCMD:
> if (type)
> return -EINVAL;
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> set_floppy(drive);
> i = raw_cmd_ioctl(cmd, (void __user *)param);
> @@ -3539,7 +3539,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
> process_fd_request();
> return i;
> case FDTWADDLE:
> - if (lock_fdc(drive, true))
> + if (lock_fdc(drive))
> return -EINTR;
> twaddle();
> process_fd_request();
> @@ -3748,7 +3748,8 @@ static unsigned int floppy_check_events(struct gendisk *disk,
> return DISK_EVENT_MEDIA_CHANGE;
>
> if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
> - lock_fdc(drive, false);
> + if (lock_fdc(drive))
> + return -EINTR;
> poll_drive(false, 0);
> process_fd_request();
> }
> @@ -3847,7 +3848,9 @@ static int floppy_revalidate(struct gendisk *disk)
> "VFS: revalidate called on non-open device.\n"))
> return -EFAULT;
>
> - lock_fdc(drive, false);
> + res = lock_fdc(drive);
> + if (res)
> + return res;
> cf = (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags) ||
> test_bit(FD_VERIFY_BIT, &UDRS->flags));
> if (!(cf || test_bit(drive, &fake_change) || drive_no_geom(drive))) {
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web