floppy: avoid stale cont use after BH is queued - #1041
Open
blktests-ci[bot] wants to merge 1 commit into
Open
Conversation
Author
|
Upstream branch: 2d2338c |
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 6, 2026 09:20
c0cc428 to
23d8cf0
Compare
Author
|
Upstream branch: 0d83957 |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 6, 2026 09:23
261ec3d to
93a95a7
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
2 times, most recently
from
August 9, 2026 07:24
612ae31 to
863d43a
Compare
Author
|
Upstream branch: 06cf618 |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 9, 2026 08:49
93a95a7 to
95d2480
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 10, 2026 22:28
863d43a to
29ac21d
Compare
Author
|
Upstream branch: d58772d |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 10, 2026 23:20
95d2480 to
3ebae52
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 12, 2026 13:27
29ac21d to
ea2c39d
Compare
Author
|
Upstream branch: f5bbbfe |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 12, 2026 14:55
3ebae52 to
6b98cdb
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 12, 2026 18:56
ea2c39d to
4082a30
Compare
Author
|
Upstream branch: 3d6d817 |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 12, 2026 20:08
6b98cdb to
9c91495
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 13, 2026 19:18
4082a30 to
36bd7eb
Compare
Author
|
Upstream branch: 3aa1dca |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 13, 2026 21:04
9c91495 to
0c570ee
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
2 times, most recently
from
August 16, 2026 18:34
d89ab11 to
fdba928
Compare
Author
|
Upstream branch: fd923b3 |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 16, 2026 21:13
0c570ee to
1dfdc9f
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 17, 2026 14:10
fdba928 to
60442a3
Compare
Author
|
Upstream branch: 8d3ae59 |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 17, 2026 20:37
1dfdc9f to
6e93723
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
August 19, 2026 05:25
60442a3 to
3df366e
Compare
reset_fdc() arms do_floppy = reset_interrupt; the IRQ handler then queues that function via schedule_bh(). If unlock_fdc() or do_wakeup() clears cont before the work runs, reset_interrupt() dereferences a NULL cont and oopses. Example crash excerpt: [ 1070.468148] status=80 [ 1070.468152] fdc_busy=1 [ 1070.468158] cont= (null) [ 1070.468161] current_req= (null) [ 1070.468162] command_status=-1 [ 1070.468163] [ 1070.557051] floppy0: floppy timeout called [ 1070.557053] no cont in shutdown! [ 1070.557056] floppy0: floppy_shutdown: timeout handler died. [ 1074.419509] floppy0: FDC access conflict! [ 1074.419782] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 1074.421969] PGD 0 P4D 0 [ 1074.422320] Oops: 0000 [#1] SMP NOPTI [ 1074.422648] CPU: 10 PID: 3269 Comm: kworker/u256:4 Kdump: loaded [ 1074.423830] Hardware name: inspur Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 [ 1074.424284] Workqueue: floppy floppy_work_workfn [floppy] [ 1074.424757] RIP: 0010:reset_interrupt+0x3a/0xa0 [floppy] The same NULL deref has also been reported by syzbot on upstream. While a stale reset_interrupt() sits in result(), unlock_fdc() can also clear cont and let a new request install another continuation, so a plain !cont check after result() is not enough. Bump cont_seq when clearing cont, sample it in schedule_bh() as bh_seq, and use cont in reset_interrupt() only when the sequences still match. Reported-by: syzbot+619e27617b2abe6b9b72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=619e27617b2abe6b9b72 Link: https://lore.kernel.org/linux-block/00000000000093c4d105f9aa34d6@google.com/ Link: https://lists.openwall.net/linux-kernel/2021/10/27/56 Assisted-by: Cursor:Composer Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Author
|
Upstream branch: bd5f485 |
blktests-ci
Bot
force-pushed
the
series/1138048=>linus-master
branch
from
August 19, 2026 07:12
6e93723 to
0764ce2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: floppy: avoid stale cont use after BH is queued
version: 2
url: https://patchwork.kernel.org/project/linux-block/list/?series=1138048