Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1576389 > unrolled thread

loop: divide error in transfer_xor

Started byDmitry Vyukov <dvyukov@google.com>
First post2017-02-08 10:40 +0100
Last post2017-02-13 17:40 +0100
Articles 3 — 2 participants

Back to article view | Back to linux.kernel

Contents

  loop: divide error in transfer_xor Dmitry Vyukov <dvyukov@google.com> - 2017-02-08 10:40 +0100
    Re: loop: divide error in transfer_xor Ming Lei <tom.leiming@gmail.com> - 2017-02-08 12:00 +0100
      Re: loop: divide error in transfer_xor Dmitry Vyukov <dvyukov@google.com> - 2017-02-13 17:40 +0100

#1576389 — loop: divide error in transfer_xor

FromDmitry Vyukov <dvyukov@google.com>
Date2017-02-08 10:40 +0100
Subjectloop: divide error in transfer_xor
Message-ID<t8wTg-6YY-15@gated-at.bofh.it>
Hello,

The following program triggers divide error in transfer_xor:
https://gist.githubusercontent.com/dvyukov/bed5c929410b5619ff491c7ab22ae3f8/raw/69756a281ea0057799943412e60b8256b9f1af73/gistfile1.txt

divide error: 0000 [#1] SMP KASAN
CPU: 0 PID: 2935 Comm: loop7 Not tainted 4.10.0-rc7+ #213
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006ba1e840 task.stack: ffff880067338000
RIP: 0010:transfer_xor+0x1d1/0x440 drivers/block/loop.c:110
RSP: 0018:ffff88006733f108 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8800688d7000 RCX: 0000000000000059
RDX: 0000000000000000 RSI: 1ffff1000d743f43 RDI: ffff880068891c08
RBP: ffff88006733f160 R08: ffff8800688d7001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800688d7000
R13: ffff880067b7d000 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006c17e0 CR3: 0000000066e3b000 CR4: 00000000001406f0
Call Trace:
 lo_do_transfer drivers/block/loop.c:251 [inline]
 lo_read_transfer drivers/block/loop.c:392 [inline]
 do_req_filebacked drivers/block/loop.c:541 [inline]
 loop_handle_cmd drivers/block/loop.c:1677 [inline]
 loop_queue_work+0xda0/0x49b0 drivers/block/loop.c:1689
 kthread_worker_fn+0x4c3/0xa30 kernel/kthread.c:630
 kthread+0x326/0x3f0 kernel/kthread.c:227
 ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
Code: 03 83 e2 07 41 29 df 42 0f b6 04 30 4d 8d 44 24 01 38 d0 7f 08
84 c0 0f 85 62 02 00 00 44 89 f8 41 0f b6 48 ff 25 ff 01 00 00 99 <f7>
7d c8 48 63 d2 48 03 55 d0 48 89 d0 48 89 d7 48 c1 e8 03 83
RIP: transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: ffff88006733f108
---[ end trace 0166f7bd3b0c0933 ]---

On commit 8b1b41ee74f9712c355d66dc105bbea663ae0afd

[toc] | [next] | [standalone]

#1576441

FromMing Lei <tom.leiming@gmail.com>
Date2017-02-08 12:00 +0100
Message-ID<t8y8G-7Ir-21@gated-at.bofh.it>
In reply to#1576389

[Multipart message — attachments visible in raw view] — view raw

On Wed, Feb 8, 2017 at 5:32 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers divide error in transfer_xor:
> https://gist.githubusercontent.com/dvyukov/bed5c929410b5619ff491c7ab22ae3f8/raw/69756a281ea0057799943412e60b8256b9f1af73/gistfile1.txt
>
> divide error: 0000 [#1] SMP KASAN
> CPU: 0 PID: 2935 Comm: loop7 Not tainted 4.10.0-rc7+ #213
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88006ba1e840 task.stack: ffff880067338000
> RIP: 0010:transfer_xor+0x1d1/0x440 drivers/block/loop.c:110
> RSP: 0018:ffff88006733f108 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff8800688d7000 RCX: 0000000000000059
> RDX: 0000000000000000 RSI: 1ffff1000d743f43 RDI: ffff880068891c08
> RBP: ffff88006733f160 R08: ffff8800688d7001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800688d7000
> R13: ffff880067b7d000 R14: dffffc0000000000 R15: 0000000000000000
> FS:  0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000006c17e0 CR3: 0000000066e3b000 CR4: 00000000001406f0
> Call Trace:
>  lo_do_transfer drivers/block/loop.c:251 [inline]
>  lo_read_transfer drivers/block/loop.c:392 [inline]
>  do_req_filebacked drivers/block/loop.c:541 [inline]
>  loop_handle_cmd drivers/block/loop.c:1677 [inline]
>  loop_queue_work+0xda0/0x49b0 drivers/block/loop.c:1689
>  kthread_worker_fn+0x4c3/0xa30 kernel/kthread.c:630
>  kthread+0x326/0x3f0 kernel/kthread.c:227
>  ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
> Code: 03 83 e2 07 41 29 df 42 0f b6 04 30 4d 8d 44 24 01 38 d0 7f 08
> 84 c0 0f 85 62 02 00 00 44 89 f8 41 0f b6 48 ff 25 ff 01 00 00 99 <f7>
> 7d c8 48 63 d2 48 03 55 d0 48 89 d0 48 89 d7 48 c1 e8 03 83
> RIP: transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: ffff88006733f108
> ---[ end trace 0166f7bd3b0c0933 ]---
>
> On commit 8b1b41ee74f9712c355d66dc105bbea663ae0afd

Looks a race between set status and I/O, could you test the attached
patch to see if this oops can be fixed?


Thanks，
Ming Lei

[toc] | [prev] | [next] | [standalone]

#1579934

FromDmitry Vyukov <dvyukov@google.com>
Date2017-02-13 17:40 +0100
Message-ID<tarPr-6aX-13@gated-at.bofh.it>
In reply to#1576441
On Wed, Feb 8, 2017 at 11:39 AM, Ming Lei <tom.leiming@gmail.com> wrote:
> On Wed, Feb 8, 2017 at 5:32 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
>> Hello,
>>
>> The following program triggers divide error in transfer_xor:
>> https://gist.githubusercontent.com/dvyukov/bed5c929410b5619ff491c7ab22ae3f8/raw/69756a281ea0057799943412e60b8256b9f1af73/gistfile1.txt
>>
>> divide error: 0000 [#1] SMP KASAN
>> CPU: 0 PID: 2935 Comm: loop7 Not tainted 4.10.0-rc7+ #213
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> task: ffff88006ba1e840 task.stack: ffff880067338000
>> RIP: 0010:transfer_xor+0x1d1/0x440 drivers/block/loop.c:110
>> RSP: 0018:ffff88006733f108 EFLAGS: 00010246
>> RAX: 0000000000000000 RBX: ffff8800688d7000 RCX: 0000000000000059
>> RDX: 0000000000000000 RSI: 1ffff1000d743f43 RDI: ffff880068891c08
>> RBP: ffff88006733f160 R08: ffff8800688d7001 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800688d7000
>> R13: ffff880067b7d000 R14: dffffc0000000000 R15: 0000000000000000
>> FS:  0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00000000006c17e0 CR3: 0000000066e3b000 CR4: 00000000001406f0
>> Call Trace:
>>  lo_do_transfer drivers/block/loop.c:251 [inline]
>>  lo_read_transfer drivers/block/loop.c:392 [inline]
>>  do_req_filebacked drivers/block/loop.c:541 [inline]
>>  loop_handle_cmd drivers/block/loop.c:1677 [inline]
>>  loop_queue_work+0xda0/0x49b0 drivers/block/loop.c:1689
>>  kthread_worker_fn+0x4c3/0xa30 kernel/kthread.c:630
>>  kthread+0x326/0x3f0 kernel/kthread.c:227
>>  ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
>> Code: 03 83 e2 07 41 29 df 42 0f b6 04 30 4d 8d 44 24 01 38 d0 7f 08
>> 84 c0 0f 85 62 02 00 00 44 89 f8 41 0f b6 48 ff 25 ff 01 00 00 99 <f7>
>> 7d c8 48 63 d2 48 03 55 d0 48 89 d0 48 89 d7 48 c1 e8 03 83
>> RIP: transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: ffff88006733f108
>> ---[ end trace 0166f7bd3b0c0933 ]---
>>
>> On commit 8b1b41ee74f9712c355d66dc105bbea663ae0afd
>
> Looks a race between set status and I/O, could you test the attached
> patch to see if this oops can be fixed?


Yes, it fixes the crash.
Tested-by: Dmitry Vyukov <dvyukov@google.com>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web