Re: floppy: GPF in floppy_rb0_cb

[Jiri Kosina]

On Wed, 27 Jan 2016, Dmitry Vyukov wrote:

> > Alright, there is a serious issue with how floppy_revalidate() handles
> > error from lock_fdc() (in-depth explanation for the curious: it doesn't).
> >
> > In case wait_for_event_interruptible() is actually interrupted without
> > succesfully claiming fdc, we proceed with revalidation, causing all kinds
> > of havoc (because another parallel request is still in progress).
> >
> > The whole story with the 'interruptible' parameter to lock_fdc() is funny
> > as well, because we always wait interruptibly anyway. So it can be nuked.
> > Most of the lock_fdc() callsites do properly handle error (and propagate
> > EINTR), but floppy_revalidate() and floppy_check_events() don't.
> >
> > Could you please let syzkaller retest with the patch below? It fixes all
> > the oopses I am able to trigger here.
> 
> Done. I will get back to you if I see any other oops.

Please also get to me in case you don't see any other oops after the 
timeframe you have been able to reproduce the original problem, so that we 
could consider the issue resolved and I can make proper patch from this 
and send it upstream.

Thanks,

-- 
Jiri Kosina
SUSE Labs