Re: [syzbot] possible deadlock in throtl_pending_timer_fn

[Ming Lei]

On Fri, Jul 29, 2022 at 08:25:08PM -0700, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit 0a9a25ca78437b39e691bcc3dc8240455b803d8d
> Author: Ming Lei <ming.lei@xxxxxxxxxx>
> Date:   Fri Mar 18 13:01:43 2022 +0000
> 
>     block: let blkcg_gq grab request queue's refcnt
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16c3cfc2080000
> start commit:   cb71b93c2dc3 Add linux-next specific files for 20220628
> git tree:       linux-next
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=15c3cfc2080000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11c3cfc2080000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=badbc1adb2d582eb
> dashboard link: https://syzkaller.appspot.com/bug?extid=934ebb67352c8a490bf3
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17713dee080000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15d24952080000
> 
> Reported-by: syzbot+934ebb67352c8a490bf3@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 0a9a25ca7843 ("block: let blkcg_gq grab request queue's refcnt")

No, this lockdep warning isn't related with the above commit, which
caused another regression, but fixed by commit d578c770c852
("block: avoid calling blkg_free() in atomic context"). Looks syzbot
can't recognize difference between the two different issues.

This specific issue of '[syzbot] possible deadlock in throtl_pending_timer_fn',
is actually introduced by commit ("27029b4b18aa blkcg: fix memleak for iolatency").

blk_throtl_exit() isn't safe to be called before blkg_destroy_all().

The following change should avoid the issue:


diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 869af9d72bcf..1606acb917fd 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1268,6 +1268,7 @@ static int blkcg_css_online(struct cgroup_subsys_state *css)
 int blkcg_init_queue(struct request_queue *q)
 {
 	struct blkcg_gq *new_blkg, *blkg;
+	bool need_exit_throtl = false;
 	bool preloaded;
 	int ret;
 
@@ -1301,7 +1302,7 @@ int blkcg_init_queue(struct request_queue *q)
 
 	ret = blk_iolatency_init(q);
 	if (ret) {
-		blk_throtl_exit(q);
+		need_exit_throtl = true;
 		blk_ioprio_exit(q);
 		goto err_destroy_all;
 	}
@@ -1310,6 +1311,8 @@ int blkcg_init_queue(struct request_queue *q)
 
 err_destroy_all:
 	blkg_destroy_all(q);
+	if (need_exit_throtl)
+		blk_throtl_exit(q);
 	return ret;
 err_unlock:
 	spin_unlock_irq(&q->queue_lock);



Thanks,
Ming