search for: try_to_grab_pending

...ULL if work item is idle > > From e65120fcfc1cb9697655d29ecd7982451c05d3c2 Mon Sep 17 00:00:00 2001 > From: Dan Magenheimer <dan.magenheimer at oracle.com> > Date: Thu, 18 Oct 2012 16:31:37 -0700 > > 57b30ae77b ("workqueue: reimplement cancel_delayed_work() using > try_to_grab_pending()") made cancel_delayed_work() always return %true > unless someone else is also trying to cancel the work item, which is > broken - if the target work item is idle, the return value should be > %false. > > try_to_grab_pending() indicates that the target work item was idle by &...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...x2d3 62031b68: [<600333b0>] memcpy+0x0/0x140 62031b80: [<6002d58a>] unblock_signals+0x0/0x84 62031ba0: [<602609c5>] printk+0x0/0xa0 62031bd8: [<60264e51>] __mutex_unlock_slowpath+0x13d/0x148 62031c10: [<6004ef5e>] flush_work+0x0/0x1d7 62031c18: [<60050234>] try_to_grab_pending+0x0/0x17e 62031c38: [<6004e984>] get_work_gcwq+0x71/0x8f 62031c48: [<60050539>] __cancel_work_timer+0x5b/0x115 62031c78: [<628acc85>] unplug_port+0x0/0x191 [virtio_console] 62031c98: [<6005061c>] cancel_work_sync+0x12/0x14 62031ca8: [<628ace96>] virtcons_remove+0x...

...x2d3 62031b68: [<600333b0>] memcpy+0x0/0x140 62031b80: [<6002d58a>] unblock_signals+0x0/0x84 62031ba0: [<602609c5>] printk+0x0/0xa0 62031bd8: [<60264e51>] __mutex_unlock_slowpath+0x13d/0x148 62031c10: [<6004ef5e>] flush_work+0x0/0x1d7 62031c18: [<60050234>] try_to_grab_pending+0x0/0x17e 62031c38: [<6004e984>] get_work_gcwq+0x71/0x8f 62031c48: [<60050539>] __cancel_work_timer+0x5b/0x115 62031c78: [<628acc85>] unplug_port+0x0/0x191 [virtio_console] 62031c98: [<6005061c>] cancel_work_sync+0x12/0x14 62031ca8: [<628ace96>] virtcons_remove+0x...

...t; the filesystem, an UAF access to the oinfo will eventually cause a crash. > > BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 > Read of size 8 at addr ffff8880389a8208 by task umount/669 > ... > Call Trace: > <TASK> > ... > timer_delete+0x54/0xc0 > try_to_grab_pending+0x31/0x230 > __cancel_work_timer+0x6c/0x270 > ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] > ocfs2_dismount_volume+0xdd/0x450 [ocfs2] > generic_shutdown_super+0xaa/0x280 > kill_block_super+0x46/0x70 > deactivate_locked_super+0x4d/0xb0 > cleanup_mnt+0x135/0x1f0 > ......

On Fri, 26 May 2023 09:36:25 +0800 Joseph Qi <joseph.qi at linux.alibaba.com> wrote: > Hi Andrew, > > There is an updated version v2, which describe more clearly about the > case: > https://lore.kernel.org/ocfs2-devel/e9fc4b2f-1fcc-7c31-f346-59eccff50f9b at linux.alibaba.com/T/#u Sigh. Thanks. As you can see from the above link, the email never hit ocfs2-devel and never

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632:...

...ffffffff8194b0d6>] ? get_color+0xd6/0x1d0 [<ffffffff81955350>] ? update_attr.isra.0+0xc0/0xc0 [<ffffffff8194b36f>] fb_flashcursor+0x19f/0x1b0 [<ffffffff8114328e>] process_one_work+0x3fe/0xae0 [<ffffffff811431be>] ? process_one_work+0x32e/0xae0 [<ffffffff81142e90>] ? try_to_grab_pending+0x200/0x200 [<ffffffff811bfc75>] ? debug_lockdep_rcu_enabled+0x35/0x40 [<ffffffff811439fa>] worker_thread+0x8a/0x7f0 [<ffffffff81143970>] ? process_one_work+0xae0/0xae0 [<ffffffff8114e085>] kthread+0x185/0x1b0 [<ffffffff8114df00>] ? __kthread_parkme+0xe0/0xe0 [<ffff...

.../0x200 [nouveau] [ 3.919648] nvkm_engine_ref+0x4a/0x70 [nouveau] [ 3.919681] nvkm_ioctl_new+0x118/0x280 [nouveau] [ 3.919705] ? drm_property_create+0x100/0x150 [drm] [ 3.919746] ? nvkm_udevice_map+0x40/0x40 [nouveau] [ 3.919779] nvkm_ioctl+0x13c/0x230 [nouveau] [ 3.919785] ? try_to_grab_pending+0xa7/0x130 [ 3.919816] nvif_object_init+0xc0/0x130 [nouveau] [ 3.919859] nouveau_display_create+0x13e/0x630 [nouveau] [ 3.919903] nouveau_drm_load+0x1e2/0x8d0 [nouveau] [ 3.919910] ? sysfs_do_create_link_sd.isra.2+0x6b/0xb0 [ 3.919924] drm_dev_register+0x139/0x1d0 [drm] [ 3.9...

https://bugs.freedesktop.org/show_bug.cgi?id=70388 Priority: medium Bug ID: 70388 Assignee: nouveau at lists.freedesktop.org Summary: [NV34] failed to idle channel 0xcccc0000 Severity: critical Classification: Unclassified OS: Linux (All) Reporter: rosti.bsd at gmail.com Hardware: x86 (IA32)