From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05E23C11F6A for ; Fri, 2 Jul 2021 09:19:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE96D61413 for ; Fri, 2 Jul 2021 09:19:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231190AbhGBJVq (ORCPT ); Fri, 2 Jul 2021 05:21:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56684 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231160AbhGBJVi (ORCPT ); Fri, 2 Jul 2021 05:21:38 -0400 Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F78CC061762; Fri, 2 Jul 2021 02:19:06 -0700 (PDT) Received: by mail-pg1-x530.google.com with SMTP id a2so8967117pgi.6; Fri, 02 Jul 2021 02:19:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dy1wiJWCUbzzuhF4ayH4yFxHIlEj9ymL/XTMpQPprYI=; b=E2z6L2MQkh9yQU2Fs2u0eB41ZEhaYkoYJVT2vk/82L6ktkv2YiXQU1B+OLq1j1cSJp 7Ww8QzmuEWd2nFtDgUfLuhf6w87904MrcHcERagKgpHa8PcEvnZCtxQjV44ZrdY3UYgo 1VNgnXN3WlqhJI8Wxk6u3Q0lJXTdyEB7DGrzVLFhZN18byWdg8WdIzc4N12s2EyZ/TLx sRHEaRRy+Ew6QP2BqEEgQ/C+VZOGQd0FOz5IvTfT5dgdCJ2hluBKXo6nutg1dz4b/vDE oL5z30yqwb2jGiearr/vfUdD+QxBf8WVuOoBd+PZgqC2oEAKnd7r3+fvhv/eMG5E6ki+ Xy1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dy1wiJWCUbzzuhF4ayH4yFxHIlEj9ymL/XTMpQPprYI=; b=UKCga34/IFS6BgM65aFSvYd1/6Y1MNxCJVPQPwpyBngfSyJzoXEM4aVepz9t9EIlt3 BN56XwSSNSvHogk1Xn8H+gcMAe1iA+qm00jQHB1YdZL+OR8sCW1k1JHIp/Yva6gC38uy 7Y5lSPM3wdwA4LfQEPw2idIEDM/6X4GF0W93GY5a1V4tD64IBtrMyF49ZdRAyEnDyWek PEttW0dkS3Lkax3+SYmbDwvr89oVqSwu1Y0iAcRcvCJouoPa6qbVTIEemwy3SQsHadrD Xq3VxXZNrNRg39OlnTGnBPa976IXm+ONap2b/7DNKBA6kZEHpXGzIhM7IFtwRFq+wcM3 wYUw== X-Gm-Message-State: AOAM531JrzifPesMxaAYj5t70VhEDtOsM2SdmvBt+WEmgmESxsA36l2Y EG2ZAmqnZDCOLyLLn5mnXLI= X-Google-Smtp-Source: ABdhPJyqkq1cqysNRGDWKIxi7V8bbsjUMVEe72P4kL57YqOA9/DfditjSH4QED/veTfo3SPL0kZ73A== X-Received: by 2002:a63:1226:: with SMTP id h38mr4228823pgl.376.1625217546255; Fri, 02 Jul 2021 02:19:06 -0700 (PDT) Received: from localhost.localdomain ([118.200.190.93]) by smtp.gmail.com with ESMTPSA id y3sm3023918pga.72.2021.07.02.02.19.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Jul 2021 02:19:05 -0700 (PDT) From: Desmond Cheong Zhi Xi To: jlayton@kernel.org, bfields@fieldses.org, viro@zeniv.linux.org.uk Cc: Desmond Cheong Zhi Xi , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, gregkh@linuxfoundation.org, linux-kernel-mentees@lists.linuxfoundation.org, syzbot+e6d5398a02c516ce5e70@syzkaller.appspotmail.com Subject: [PATCH 1/2] fcntl: fix potential deadlocks for &fown_struct.lock Date: Fri, 2 Jul 2021 17:18:30 +0800 Message-Id: <20210702091831.615042-2-desmondcheongzx@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210702091831.615042-1-desmondcheongzx@gmail.com> References: <20210702091831.615042-1-desmondcheongzx@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Syzbot reports a potential deadlock in do_fcntl: ======================================================== WARNING: possible irq lock inversion dependency detected 5.12.0-syzkaller #0 Not tainted -------------------------------------------------------- syz-executor132/8391 just changed the state of lock: ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: f_getown_ex fs/fcntl.c:211 [inline] ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: do_fcntl+0x8b4/0x1200 fs/fcntl.c:395 but this lock was taken by another, HARDIRQ-safe lock in the past: (&dev->event_lock){-...}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&f->f_owner.lock); local_irq_disable(); lock(&dev->event_lock); lock(&new->fa_lock); lock(&dev->event_lock); *** DEADLOCK *** This happens because there is a lock hierarchy of &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock from the following call chain: input_inject_event(): spin_lock_irqsave(&dev->event_lock,...); input_handle_event(): input_pass_values(): input_to_handler(): evdev_events(): evdev_pass_values(): spin_lock(&client->buffer_lock); __pass_event(): kill_fasync(): kill_fasync_rcu(): read_lock(&fa->fa_lock); send_sigio(): read_lock_irqsave(&fown->lock,...); However, since &dev->event_lock is HARDIRQ-safe, interrupts have to be disabled while grabbing &f->f_owner.lock, otherwise we invert the lock hierarchy. Hence, we replace calls to read_lock/read_unlock on &f->f_owner.lock, with read_lock_irq/read_unlock_irq. Reported-and-tested-by: syzbot+e6d5398a02c516ce5e70@syzkaller.appspotmail.com Signed-off-by: Desmond Cheong Zhi Xi --- fs/fcntl.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/fs/fcntl.c b/fs/fcntl.c index dfc72f15be7f..cf9e81dfa615 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -150,7 +150,8 @@ void f_delown(struct file *filp) pid_t f_getown(struct file *filp) { pid_t pid = 0; - read_lock(&filp->f_owner.lock); + + read_lock_irq(&filp->f_owner.lock); rcu_read_lock(); if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) { pid = pid_vnr(filp->f_owner.pid); @@ -158,7 +159,7 @@ pid_t f_getown(struct file *filp) pid = -pid; } rcu_read_unlock(); - read_unlock(&filp->f_owner.lock); + read_unlock_irq(&filp->f_owner.lock); return pid; } @@ -208,7 +209,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg) struct f_owner_ex owner = {}; int ret = 0; - read_lock(&filp->f_owner.lock); + read_lock_irq(&filp->f_owner.lock); rcu_read_lock(); if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) owner.pid = pid_vnr(filp->f_owner.pid); @@ -231,7 +232,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg) ret = -EINVAL; break; } - read_unlock(&filp->f_owner.lock); + read_unlock_irq(&filp->f_owner.lock); if (!ret) { ret = copy_to_user(owner_p, &owner, sizeof(owner)); @@ -249,10 +250,10 @@ static int f_getowner_uids(struct file *filp, unsigned long arg) uid_t src[2]; int err; - read_lock(&filp->f_owner.lock); + read_lock_irq(&filp->f_owner.lock); src[0] = from_kuid(user_ns, filp->f_owner.uid); src[1] = from_kuid(user_ns, filp->f_owner.euid); - read_unlock(&filp->f_owner.lock); + read_unlock_irq(&filp->f_owner.lock); err = put_user(src[0], &dst[0]); err |= put_user(src[1], &dst[1]); -- 2.25.1