Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [ipc/sem.c] 6394de3b86:
 BUG:kernel_NULL_pointer_dereference,address
To:     kernel test robot <rong.a.chen@intel.com>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        Davidlohr Bueso <dave@stgolabs.net>,
        Waiman Long <longman@redhat.com>, 1vier1@web.de,
        Andrew Morton <akpm@linux-foundation.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Jonathan Corbet <corbet@lwn.net>, lkp@lists.01.org,
        ltp@lists.linux.it
References: <20191021083514.GE9296@shao2-debian>
From:   Manfred Spraul <manfred@colorfullife.com>
Message-ID: <d49d1940-a704-d79e-b44f-79db9f096d5c@colorfullife.com>
Date:   Wed, 23 Oct 2019 20:28:52 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.1.1
MIME-Version: 1.0
In-Reply-To: <20191021083514.GE9296@shao2-debian>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hello,

On 10/21/19 10:35 AM, kernel test robot wrote:
> FYI, we noticed the following commit (built with gcc-7):
>
> commit: 6394de3b868537a90dd9128607192b0e97109f6b ("[PATCH 4/5] ipc/sem.c: Document and update memory barriers")
> url: https://github.com/0day-ci/linux/commits/Manfred-Spraul/wake_q-Cleanup-Documentation-update/20191014-055627

Yes, known issue:

> @@ -2148,9 +2176,11 @@ static long do_semtimedop(int semid, struct 
> sembuf __user *tsops,
> ??????? }
>
> ??????? do {
> -?????????????? WRITE_ONCE(queue.status, -EINTR);
> +?????????????? /* memory ordering ensured by the lock in sem_lock() */
> +?????????????? queue.status = EINTR;
> ??????????????? queue.sleeper = current;
>
> +?????????????? /* memory ordering is ensured by the lock in sem_lock() */
> ??????????????? __set_current_state(TASK_INTERRUPTIBLE);
> ??????????????? sem_unlock(sma, locknum);
> ??????????????? rcu_read_unlock();
It must be "-EINTR", not "EINTR".

If there is a timeout or a spurious wakeup, then the do_semtimedop() 
returns to user space without unlinking everything properly.

I was able to reproduce the issue: V1 of the series ends up with the 
shown error.

V3 as now merged doesn't fail.

--

 ??? Manfred