From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>,
Jeff Layton <jlayton@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 5.13 39/46] fcntl: fix potential deadlock for &fasync_struct.fa_lock
Date: Sun, 5 Sep 2021 21:20:44 -0400 [thread overview]
Message-ID: <20210906012052.929174-39-sashal@kernel.org> (raw)
In-Reply-To: <20210906012052.929174-1-sashal@kernel.org>
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]
There is an existing lock hierarchy of
&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock
from the following call chain:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
evdev_events():
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock_irqsave(&fown->lock,...);
&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled
while grabbing &fasync_struct.fa_lock, otherwise we invert the lock
hierarchy. However, since kill_fasync which calls kill_fasync_rcu is
an exported symbol, it may not necessarily be called with interrupts
disabled.
As kill_fasync_rcu may be called with interrupts disabled (for
example, in the call chain above), we replace calls to
read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu
with read_lock_irqsave/read_unlock_irqrestore.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fcntl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index cf9e81dfa615..887db4918a89 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -1004,13 +1004,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
{
while (fa) {
struct fown_struct *fown;
+ unsigned long flags;
if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n");
return;
}
- read_lock(&fa->fa_lock);
+ read_lock_irqsave(&fa->fa_lock, flags);
if (fa->fa_file) {
fown = &fa->fa_file->f_owner;
/* Don't send SIGURG to processes which have not set a
@@ -1019,7 +1020,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band);
}
- read_unlock(&fa->fa_lock);
+ read_unlock_irqrestore(&fa->fa_lock, flags);
fa = rcu_dereference(fa->fa_next);
}
}
--
2.30.2
next prev parent reply other threads:[~2021-09-06 1:24 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 1:20 [PATCH AUTOSEL 5.13 01/46] locking/mutex: Fix HANDOFF condition Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 02/46] regmap: fix the offset of register error log Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 03/46] regulator: tps65910: Silence deferred probe error Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 04/46] crypto: mxs-dcp - Check for DMA mapping errors Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 05/46] sched/deadline: Fix reset_on_fork reporting of DL tasks Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 06/46] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 07/46] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 08/46] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 09/46] rcu/tree: Handle VM stoppage in stall detection Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 10/46] EDAC/mce_amd: Do not load edac_mce_amd module on guests Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 11/46] posix-cpu-timers: Force next expiration recalc after itimer reset Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 12/46] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 13/46] hrtimer: Ensure timerfd notification for HIGHRES=n Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 14/46] udf: Check LVID earlier Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 15/46] udf: Fix iocharset=utf8 mount option Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 16/46] isofs: joliet: " Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 17/46] bcache: add proper error unwinding in bcache_device_init Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 18/46] nbd: add the check to prevent overflow in __nbd_ioctl() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 19/46] blk-throtl: optimize IOPS throttle for large IO scenarios Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 20/46] nvme-tcp: don't update queue count when failing to set io queues Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 21/46] nvme-rdma: " Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 22/46] nvmet: pass back cntlid on successful completion Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 23/46] power: supply: smb347-charger: Add missing pin control activation Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 24/46] power: supply: max17042_battery: fix typo in MAx17042_TOFF Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 25/46] s390/cio: add dev_busid sysfs entry for each subchannel Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 26/46] s390/zcrypt: fix wrong offset index for APKA master key valid state Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 27/46] libata: fix ata_host_start() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 28/46] sched/topology: Skip updating masks for non-online nodes Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 29/46] crypto: omap - Fix inconsistent locking of device lists Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 30/46] crypto: qat - do not ignore errors from enable_vf2pf_comms() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 31/46] crypto: qat - handle both source of interrupt in VF ISR Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 32/46] crypto: qat - fix reuse of completion variable Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 33/46] crypto: qat - fix naming for init/shutdown VF to PF notifications Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 34/46] crypto: qat - do not export adf_iov_putmsg() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 35/46] crypto: hisilicon/sec - fix the abnormal exiting process Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 36/46] crypto: hisilicon/sec - modify the hardware endian configuration Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 37/46] crypto: tcrypt - Fix missing return value check Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 38/46] fcntl: fix potential deadlocks for &fown_struct.lock Sasha Levin
2021-09-06 1:20 ` Sasha Levin [this message]
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 40/46] udf_get_extendedattr() had no boundary checks Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 41/46] io-wq: remove GFP_ATOMIC allocation off schedule out path Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 42/46] s390/kasan: fix large PMD pages address alignment check Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 43/46] s390/pci: fix misleading rc in clp_set_pci_fn() Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 44/46] s390/debug: keep debug data on resize Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 45/46] s390/debug: fix debug area life cycle Sasha Levin
2021-09-06 1:20 ` [PATCH AUTOSEL 5.13 46/46] s390/ap: fix state machine hang after failure to enable irq Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210906012052.929174-39-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=desmondcheongzx@gmail.com \
--cc=jlayton@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).