Hello,
syzbot found the following crash on:
HEAD commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e31ba7e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: [email protected]
RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
==================================================================
BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline]
BUG: KASAN: null-ptr-deref in bitmap_zero include/linux/bitmap.h:232 [inline]
BUG: KASAN: null-ptr-deref in cpumask_clear include/linux/cpumask.h:406 [inline]
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
Write of size 8 at addr 0000000000000118 by task syz-executor083/7593
CPU: 0 PID: 7593 Comm: syz-executor083 Not tainted 5.6.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
__kasan_report.cold+0x5/0x32 mm/kasan/report.c:510
kasan_report+0xe/0x20 mm/kasan/common.c:641
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x128/0x190 mm/kasan/generic.c:192
memset+0x20/0x40 mm/kasan/common.c:108
memset include/linux/string.h:366 [inline]
bitmap_zero include/linux/bitmap.h:232 [inline]
cpumask_clear include/linux/cpumask.h:406 [inline]
blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
blk_mq_init_allocated_queue+0xf21/0x13c0 block/blk-mq.c:2943
blk_mq_init_queue+0x5c/0xa0 block/blk-mq.c:2733
loop_add+0x2cb/0x8a0 drivers/block/loop.c:2022
loop_control_ioctl drivers/block/loop.c:2175 [inline]
loop_control_ioctl+0x153/0x340 drivers/block/loop.c:2157
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4411c9
Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
I think the issue is because of line 2827, that is, the q->nr_hw_queues is
updated too earlier. It is still possible the init would fail later.
2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
2810 struct request_queue *q)
2811 {
2812 int i, j, end;
2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
2814
2815 if (q->nr_hw_queues < set->nr_hw_queues) {
2816 struct blk_mq_hw_ctx **new_hctxs;
2817
2818 new_hctxs = kcalloc_node(set->nr_hw_queues,
2819 sizeof(*new_hctxs), GFP_KERNEL,
2820 set->numa_node);
2821 if (!new_hctxs)
2822 return;
2823 if (hctxs)
2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues *
2825 sizeof(*hctxs));
2826 q->queue_hw_ctx = new_hctxs;
2827 q->nr_hw_queues = set->nr_hw_queues;
2828 kfree(hctxs);
2829 hctxs = new_hctxs;
2830 }
Let's assume below line 2847 is failed (e.g.,
blk_mq_alloc_and_init_hctx()->blk_mq_alloc_hctx()->zalloc_cpumask_var_node(&hctx->cpumask,
gfp, node)).
As a result, we would come to line 2865 and 2866, and q->nr_hw_queues is already
set to set->nr_hw_queues at above line 2827.
2832 /* protect against switching io scheduler */
2833 mutex_lock(&q->sysfs_lock);
2834 for (i = 0; i < set->nr_hw_queues; i++) {
2835 int node;
2836 struct blk_mq_hw_ctx *hctx;
2837
2838 node =
blk_mq_hw_queue_to_node(&set->map[HCTX_TYPE_DEFAULT], i);
2839 /*
2840 * If the hw queue has been mapped to another numa node,
2841 * we need to realloc the hctx. If allocation fails, fallback
2842 * to use the previous one.
2843 */
2844 if (hctxs[i] && (hctxs[i]->numa_node == node))
2845 continue;
2846
2847 hctx = blk_mq_alloc_and_init_hctx(set, q, i, node);
2848 if (hctx) {
2849 if (hctxs[i])
2850 blk_mq_exit_hctx(q, set, hctxs[i], i);
2851 hctxs[i] = hctx;
2852 } else {
2853 if (hctxs[i])
2854 pr_warn("Allocate new hctx on node %d fails,\
2855 fallback to previous one on
node %d\n",
2856 node, hctxs[i]->numa_node);
2857 else
2858 break;
2859 }
2860 }
2861 /*
2862 * Increasing nr_hw_queues fails. Free the newly allocated
2863 * hctxs and keep the previous q->nr_hw_queues.
2864 */
2865 if (i != set->nr_hw_queues) {
2866 j = q->nr_hw_queues;
2867 end = i;
2868 } else {
2869 j = i;
2870 end = q->nr_hw_queues;
2871 q->nr_hw_queues = set->nr_hw_queues;
2872 }
The above would not change q->nr_hw_queues again, although hctx are not
allocated successfully. Later we hit fault at line 2501 and line 2502.
2494 static void blk_mq_map_swqueue(struct request_queue *q)
2495 {
2496 unsigned int i, j, hctx_idx;
2497 struct blk_mq_hw_ctx *hctx;
2498 struct blk_mq_ctx *ctx;
2499 struct blk_mq_tag_set *set = q->tag_set;
2500
2501 queue_for_each_hw_ctx(q, hctx, i) {
2502 cpumask_clear(hctx->cpumask);
2503 hctx->nr_ctx = 0;
2504 hctx->dispatch_from = NULL;
2505 }
I can reproduce on purpose with below patch.
https://github.com/finallyjustice/patchset/blob/master/syzbot%2B313d95e8a7a49263f88d-reproducer.patch
The patch is used to emulate a memory allocation failure for:
blk_mq_alloc_and_init_hctx()
-> blk_mq_alloc_hctx()
->zalloc_cpumask_var_node(&hctx->cpumask, gfp, node)).
Dongli Zhang
On 3/26/20 12:33 PM, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
> git tree: upstream
> console output: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=15e31ba7e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujio9zJzSQ$
> kernel config: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiOaxMATc$
> dashboard link: https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiid_YjTs$
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiAWmy3bw$
> C reproducer: https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujiMv3YHnM$
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: [email protected]
>
> RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
> RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
> RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
> R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
> ==================================================================
> BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline]
> BUG: KASAN: null-ptr-deref in bitmap_zero include/linux/bitmap.h:232 [inline]
> BUG: KASAN: null-ptr-deref in cpumask_clear include/linux/cpumask.h:406 [inline]
> BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
> Write of size 8 at addr 0000000000000118 by task syz-executor083/7593
>
> CPU: 0 PID: 7593 Comm: syz-executor083 Not tainted 5.6.0-rc7-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x188/0x20d lib/dump_stack.c:118
> __kasan_report.cold+0x5/0x32 mm/kasan/report.c:510
> kasan_report+0xe/0x20 mm/kasan/common.c:641
> check_memory_region_inline mm/kasan/generic.c:185 [inline]
> check_memory_region+0x128/0x190 mm/kasan/generic.c:192
> memset+0x20/0x40 mm/kasan/common.c:108
> memset include/linux/string.h:366 [inline]
> bitmap_zero include/linux/bitmap.h:232 [inline]
> cpumask_clear include/linux/cpumask.h:406 [inline]
> blk_mq_map_swqueue+0xea/0xe90 block/blk-mq.c:2502
> blk_mq_init_allocated_queue+0xf21/0x13c0 block/blk-mq.c:2943
> blk_mq_init_queue+0x5c/0xa0 block/blk-mq.c:2733
> loop_add+0x2cb/0x8a0 drivers/block/loop.c:2022
> loop_control_ioctl drivers/block/loop.c:2175 [inline]
> loop_control_ioctl+0x153/0x340 drivers/block/loop.c:2157
> vfs_ioctl fs/ioctl.c:47 [inline]
> ksys_ioctl+0x11a/0x180 fs/ioctl.c:763
> __do_sys_ioctl fs/ioctl.c:772 [inline]
> __se_sys_ioctl fs/ioctl.c:770 [inline]
> __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770
> do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x4411c9
> Code: e8 5c ae 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007ffca409c958 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007ffca409c970 RCX: 00000000004411c9
> RDX: 0000000000000000 RSI: 0000000000004c80 RDI: 0000000000000003
> RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
> R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
> ==================================================================
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhuji0GhH8ds$ for more information about syzbot.
> syzbot engineers can be reached at [email protected].
>
> syzbot will keep track of this bug report. See:
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhuji-FPYYaM$ for how to communicate with syzbot.
> syzbot can test patches for this bug, for details see:
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*testing-patches__;Iw!!GqivPVa7Brio!JzLj_P7A2CZ5lDE3ebmGzrvRKgaonmEiUGcG7zyHXS3fLkHfwlOva46qhujip-J1ifc$
>
syzbot has bisected this bug to:
commit 768134d4f48109b90f4248feecbeeb7d684e410c
Author: Jens Axboe <[email protected]>
Date: Mon Nov 11 03:30:53 2019 +0000
io_uring: don't do flush cancel under inflight_lock
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000
start commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
git tree: upstream
final crash: https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000
Reported-by: [email protected]
Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
On 2020-03-26 17:19, Dongli Zhang wrote:
> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
> updated too earlier. It is still possible the init would fail later.
>
> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
> 2810 struct request_queue *q)
> 2811 {
> 2812 int i, j, end;
> 2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
> 2814
> 2815 if (q->nr_hw_queues < set->nr_hw_queues) {
> 2816 struct blk_mq_hw_ctx **new_hctxs;
> 2817
> 2818 new_hctxs = kcalloc_node(set->nr_hw_queues,
> 2819 sizeof(*new_hctxs), GFP_KERNEL,
> 2820 set->numa_node);
> 2821 if (!new_hctxs)
> 2822 return;
> 2823 if (hctxs)
> 2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues *
> 2825 sizeof(*hctxs));
> 2826 q->queue_hw_ctx = new_hctxs;
> 2827 q->nr_hw_queues = set->nr_hw_queues;
> 2828 kfree(hctxs);
> 2829 hctxs = new_hctxs;
> 2830 }
Which kernel tree does this syzbot report refer to? Commit
d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.
Thanks,
Bart.
On 2020-03-26 18:28, syzbot wrote:
> syzbot has bisected this bug to:
>
> commit 768134d4f48109b90f4248feecbeeb7d684e410c
> Author: Jens Axboe <[email protected]>
> Date: Mon Nov 11 03:30:53 2019 +0000
>
> io_uring: don't do flush cancel under inflight_lock
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14233ef5e00000
> start commit: 1b649e0b Merge git://git.kernel.org/pub/scm/linux/kernel/g..
> git tree: upstream
> final crash: https://syzkaller.appspot.com/x/report.txt?x=16233ef5e00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=12233ef5e00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=27392dd2975fd692
> dashboard link: https://syzkaller.appspot.com/bug?extid=313d95e8a7a49263f88d
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13850447e00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119a26f5e00000
>
> Reported-by: [email protected]
> Fixes: 768134d4f481 ("io_uring: don't do flush cancel under inflight_lock")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
#syz fix: blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()
On 3/26/20 7:52 PM, Bart Van Assche wrote:
> On 2020-03-26 17:19, Dongli Zhang wrote:
>> I think the issue is because of line 2827, that is, the q->nr_hw_queues is
>> updated too earlier. It is still possible the init would fail later.
>>
>> 2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
>> 2810 struct request_queue *q)
>> 2811 {
>> 2812 int i, j, end;
>> 2813 struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
>> 2814
>> 2815 if (q->nr_hw_queues < set->nr_hw_queues) {
>> 2816 struct blk_mq_hw_ctx **new_hctxs;
>> 2817
>> 2818 new_hctxs = kcalloc_node(set->nr_hw_queues,
>> 2819 sizeof(*new_hctxs), GFP_KERNEL,
>> 2820 set->numa_node);
>> 2821 if (!new_hctxs)
>> 2822 return;
>> 2823 if (hctxs)
>> 2824 memcpy(new_hctxs, hctxs, q->nr_hw_queues *
>> 2825 sizeof(*hctxs));
>> 2826 q->queue_hw_ctx = new_hctxs;
>> 2827 q->nr_hw_queues = set->nr_hw_queues;
>> 2828 kfree(hctxs);
>> 2829 hctxs = new_hctxs;
>> 2830 }
>
> Which kernel tree does this syzbot report refer to? Commit
> d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
> blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.
>
Thank you very much for sharing this. The below is in Jens' tree for 5.7.
commit d0930bb8f46b8fb4a7d429c0bf1c91b3ed00a7cf
Author: Bart Van Assche <[email protected]>
Date: Mon Mar 9 21:26:18 2020 -0700
blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()
q->nr_hw_queues must only be updated once it is known that
blk_mq_realloc_hw_ctxs() has succeeded. Otherwise it can happen that
reallocation fails and that q->nr_hw_queues is larger than the number of
allocated hardware queues. This patch fixes the following crash if
increasing the number of hardware queues fails:
BUG: KASAN: null-ptr-deref in blk_mq_map_swqueue+0x775/0x810
Write of size 8 at addr 0000000000000118 by task check/977
CPU: 3 PID: 977 Comm: check Not tainted 5.6.0-rc1-dbg+ #8
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
dump_stack+0xa5/0xe6
__kasan_report.cold+0x65/0x99
kasan_report+0x16/0x20
check_memory_region+0x140/0x1b0
memset+0x28/0x40
blk_mq_map_swqueue+0x775/0x810
blk_mq_update_nr_hw_queues+0x468/0x710
nullb_device_submit_queues_store+0xf7/0x1a0 [null_blk]
configfs_write_file+0x1c4/0x250 [configfs]
__vfs_write+0x4c/0x90
vfs_write+0x145/0x2c0
ksys_write+0xd7/0x180
__x64_sys_write+0x47/0x50
do_syscall_64+0x6f/0x2f0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fixes: ac0d6b926e74 ("block: Reduce the amount of memory required per
request queue")
Signed-off-by: Bart Van Assche <[email protected]>
Reviewed-by: Ming Lei <[email protected]>
Cc: Keith Busch <[email protected]>
Cc: Johannes Thumshirn <[email protected]>
Cc: Hannes Reinecke <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
diff --git a/block/blk-mq.c b/block/blk-mq.c
index d4bd9b961726..37ff8dfb8ab9 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2824,7 +2824,6 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
memcpy(new_hctxs, hctxs, q->nr_hw_queues *
sizeof(*hctxs));
q->queue_hw_ctx = new_hctxs;
- q->nr_hw_queues = set->nr_hw_queues;
kfree(hctxs);
hctxs = new_hctxs;
}
That should be the reason why "init_hctx() fault injection" was introduced.
Thank you very much!
Dongli Zhang
On 3/26/20 7:28 PM, syzbot wrote:
> syzbot has bisected this bug to:
>
> commit 768134d4f48109b90f4248feecbeeb7d684e410c
> Author: Jens Axboe <[email protected]>
> Date: Mon Nov 11 03:30:53 2019 +0000
>
> io_uring: don't do flush cancel under inflight_lock
This is definitely an utterly bogus bisect, not related at all.
--
Jens Axboe
This bug is marked as fixed by commit:
blk-mq: Fix a recently introduced regression in
But I can't find it in any tested tree for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and
new crashes with the same signature are ignored.
On 2020-06-24 20:01, syzbot wrote:
> This bug is marked as fixed by commit:
> blk-mq: Fix a recently introduced regression in
> But I can't find it in any tested tree for more than 90 days.
> Is it a correct commit? Please update it by replying:
> #syz fix: exact-commit-title
> Until then the bug is still considered open and
> new crashes with the same signature are ignored.
#syz fix: blk-mq: Fix a recently introduced regression in blk_mq_realloc_hw_ctxs()