Skip to content
  • Jens Axboe's avatar
    floppy: fix race condition in __floppy_read_block_0() · de7b75d8
    Jens Axboe authored
    LKP recently reported a hang at bootup in the floppy code:
    
    [  245.678853] INFO: task mount:580 blocked for more than 120 seconds.
    [  245.679906]       Tainted: G                T 4.19.0-rc6-00172-ga9f38e1d #1
    [  245.680959] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    [  245.682181] mount           D 6372   580      1 0x00000004
    [  245.683023] Call Trace:
    [  245.683425]  __schedule+0x2df/0x570
    [  245.683975]  schedule+0x2d/0x80
    [  245.684476]  schedule_timeout+0x19d/0x330
    [  245.685090]  ? wait_for_common+0xa5/0x170
    [  245.685735]  wait_for_common+0xac/0x170
    [  245.686339]  ? do_sched_yield+0x90/0x90
    [  245.686935]  wait_for_completion+0x12/0x20
    [  245.687571]  __floppy_read_block_0+0xfb/0x150
    [  245.688244]  ? floppy_resume+0x40/0x40
    [  245.688844]  floppy_revalidate+0x20f/0x240
    [  245.689486]  check_disk_change+0x43/0x60
    [  245.690087]  floppy_open+0x1ea/0x360
    [  245.690653]  __blkdev_get+0xb4/0x4d0
    [  245.691212]  ? blkdev_get+0x1db/0x370
    [  245.691777]  blkdev_get+0x1f3/0x370
    [  245.692351]  ? path_put+0x15/0x20
    [  245.692871]  ? lookup_bdev+0x4b/0x90
    [  245.693539]  blkdev_get_by_path+0x3d/0x80
    [  245.694165]  mount_bdev+0x2a/0x190
    [  245.694695]  squashfs_mount+0x10/0x20
    [  245.695271]  ? squashfs_alloc_inode+0x30/0x30
    [  245.695960]  mount_fs+0xf/0x90
    [  245.696451]  vfs_kern_mount+0x43/0x130
    [  245.697036]  do_mount+0x187/0xc40
    [  245.697563]  ? memdup_user+0x28/0x50
    [  245.698124]  ksys_mount+0x60/0xc0
    [  245.698639]  sys_mount+0x19/0x20
    [  245.699167]  do_int80_syscall_32+0x61/0x130
    [  245.699813]  entry_INT80_32+0xc7/0xc7
    
    showing that we never complete that read request. The reason is that
    the completion setup is racy - it initializes the completion event
    AFTER submitting the IO, which means that the IO could complete
    before/during the init. If it does, we are passing garbage to
    complete() and we may sleep forever waiting for the event to
    occur.
    
    Fixes: 7b7b68bb
    
     ("floppy: bail out in open() if drive is not responding to block0 read")
    Reviewed-by: default avatarOmar Sandoval <osandov@fb.com>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    de7b75d8