On Mon, 2019-03-11 at 10:48 -0700, Linus Torvalds wrote:
> On Mon, Mar 11, 2019 at 8:19 AM Bart Van Assche <[email protected]> wrote:
> >
> > I think this issue has been fixed by a commit that went upstream yesterday.
> > Hence:
> >
> > #syz fix: workqueue, lockdep: Fix an alloc_workqueue() error path
>
> Well, syzbot just reported a problem with that fix itself ("WARNING in
> lockdep_unregister_key").
>
> Looks like now the lockdep_unregister_key() cleanup might be called
> even when the lockdep map was never initialized at all in that error
> case. Hmm?
>
> I _think_ you need to split that "err_free_wq" label into "just free
> the wq" and "unregister lockdep and free wq".
>
> But I didn't look any more closely, I might be misreading things.
Hi Linus,
>From the console output of the syzbot bug report at the start of this
e-mail thread:
WARNING: CPU: 1 PID: 7649 at kernel/locking/lockdep.c:747
register_lock_class+0x10de/0x2220
On line 747 in lockdep.c there is the following warning statement:
WARN_ON_ONCE(class->name != lock->name);
My interpretation is that this means that a lockdep key got reregistered
without unregistration between the two registration calls. That's why I
posted my "#syz fix: workqueue, lockdep: Fix an alloc_workqueue() error
path" reply.
The latest syzbot complaint is different. In the console output of the latest
report I found the following:
WARNING: CPU: 1 PID: 6970 at kernel/locking/lockdep.c:4925
lockdep_unregister_key+0x21c/0x4e0
On line 4925 there is the following warning statement:
WARN_ON_ONCE(!found);
In other words, lockdep_unregister_key() got called for a key that was never
registered.
I agree with your conclusion that the err_free_wq label needs to be split. I
will post a patch that realizes this.
Bart.
