Messages in this thread | | | From | Dmitry Vyukov <> | Date | Mon, 13 Feb 2017 17:30:15 +0100 | Subject | Re: loop: divide error in transfer_xor |
| |
On Wed, Feb 8, 2017 at 11:39 AM, Ming Lei <tom.leiming@gmail.com> wrote: > On Wed, Feb 8, 2017 at 5:32 PM, Dmitry Vyukov <dvyukov@google.com> wrote: >> Hello, >> >> The following program triggers divide error in transfer_xor: >> https://gist.githubusercontent.com/dvyukov/bed5c929410b5619ff491c7ab22ae3f8/raw/69756a281ea0057799943412e60b8256b9f1af73/gistfile1.txt >> >> divide error: 0000 [#1] SMP KASAN >> CPU: 0 PID: 2935 Comm: loop7 Not tainted 4.10.0-rc7+ #213 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> task: ffff88006ba1e840 task.stack: ffff880067338000 >> RIP: 0010:transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 >> RSP: 0018:ffff88006733f108 EFLAGS: 00010246 >> RAX: 0000000000000000 RBX: ffff8800688d7000 RCX: 0000000000000059 >> RDX: 0000000000000000 RSI: 1ffff1000d743f43 RDI: ffff880068891c08 >> RBP: ffff88006733f160 R08: ffff8800688d7001 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800688d7000 >> R13: ffff880067b7d000 R14: dffffc0000000000 R15: 0000000000000000 >> FS: 0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 00000000006c17e0 CR3: 0000000066e3b000 CR4: 00000000001406f0 >> Call Trace: >> lo_do_transfer drivers/block/loop.c:251 [inline] >> lo_read_transfer drivers/block/loop.c:392 [inline] >> do_req_filebacked drivers/block/loop.c:541 [inline] >> loop_handle_cmd drivers/block/loop.c:1677 [inline] >> loop_queue_work+0xda0/0x49b0 drivers/block/loop.c:1689 >> kthread_worker_fn+0x4c3/0xa30 kernel/kthread.c:630 >> kthread+0x326/0x3f0 kernel/kthread.c:227 >> ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430 >> Code: 03 83 e2 07 41 29 df 42 0f b6 04 30 4d 8d 44 24 01 38 d0 7f 08 >> 84 c0 0f 85 62 02 00 00 44 89 f8 41 0f b6 48 ff 25 ff 01 00 00 99 <f7> >> 7d c8 48 63 d2 48 03 55 d0 48 89 d0 48 89 d7 48 c1 e8 03 83 >> RIP: transfer_xor+0x1d1/0x440 drivers/block/loop.c:110 RSP: ffff88006733f108 >> ---[ end trace 0166f7bd3b0c0933 ]--- >> >> On commit 8b1b41ee74f9712c355d66dc105bbea663ae0afd > > Looks a race between set status and I/O, could you test the attached > patch to see if this oops can be fixed?
Yes, it fixes the crash. Tested-by: Dmitry Vyukov <dvyukov@google.com>
| |