Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 21 Feb 2022 17:39:09 +0100
From:   Stefano Garzarella <sgarzare@redhat.com>
To:     Anirudh Rayabharam <mail@anirudhrb.com>
Cc:     syzbot <syzbot+0abd373e2e50d704db87@syzkaller.appspotmail.com>,
        Jason Wang <jasowang@redhat.com>, kvm <kvm@vger.kernel.org>,
        kernel list <linux-kernel@vger.kernel.org>,
        Michael Tsirkin <mst@redhat.com>,
        netdev <netdev@vger.kernel.org>, syzkaller-bugs@googlegroups.com,
        Linux Virtualization <virtualization@lists.linux-foundation.org>
Subject: Re: [syzbot] INFO: task hung in vhost_work_dev_flush
Message-ID: <20220221163909.xfrgt6slp3ksqr2w@sgarzare-redhat>
References: <00000000000057702a05d8532b18@google.com>
 <CAGxU2F4nGWxG0wymrDZzd8Hwhm2=8syuEB3fLMd+t7bbN7qWrQ@mail.gmail.com>
 <YhO1YL0A6OjtXmIy@anirudhrb.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <YhO1YL0A6OjtXmIy@anirudhrb.com>
Precedence: bulk

On Mon, Feb 21, 2022 at 09:23:04PM +0530, Anirudh Rayabharam wrote:
>On Mon, Feb 21, 2022 at 03:12:33PM +0100, Stefano Garzarella wrote:
>> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
>> f71077a4d84b
>>
>> Patch sent upstream:
>> https://lore.kernel.org/virtualization/20220221114916.107045-1-sgarzare@redhat.com/T/#u
>
>I don't see how your patch fixes this issue. It looks unrelated. It is
>surprising that syzbot is happy with it.
>
>I have sent a patch for this issue here:
>https://lore.kernel.org/lkml/20220221072852.31820-1-mail@anirudhrb.com/

It is related because the worker thread is accessing the iotlb that is 
going to be freed, so it could be corrupted/invalid.

Your patch seems right, but simply prevents iotlb from being set for the 
the specific test case, so it remains NULL and iotlb_access_ok() exits 
immediately.

Anyway, currently if nregions is 0 vhost_set_memory() sets an iotlb with 
no regions (the for loop is not executed), so I'm not sure 
iotlb_access_ok() cycles infinitely.

Stefano