From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>,
Jeff Layton <jlayton@kernel.org>, Sasha Levin <sashal@kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 33/39] fcntl: fix potential deadlock for &fasync_struct.fa_lock
Date: Sun, 5 Sep 2021 21:21:47 -0400 [thread overview]
Message-ID: <20210906012153.929962-33-sashal@kernel.org> (raw)
In-Reply-To: <20210906012153.929962-1-sashal@kernel.org>
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]
There is an existing lock hierarchy of
&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock
from the following call chain:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
evdev_events():
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock_irqsave(&fown->lock,...);
&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled
while grabbing &fasync_struct.fa_lock, otherwise we invert the lock
hierarchy. However, since kill_fasync which calls kill_fasync_rcu is
an exported symbol, it may not necessarily be called with interrupts
disabled.
As kill_fasync_rcu may be called with interrupts disabled (for
example, in the call chain above), we replace calls to
read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu
with read_lock_irqsave/read_unlock_irqrestore.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fcntl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 05b36b28f2e8..71b43538fa44 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -995,13 +995,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
{
while (fa) {
struct fown_struct *fown;
+ unsigned long flags;
if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n");
return;
}
- read_lock(&fa->fa_lock);
+ read_lock_irqsave(&fa->fa_lock, flags);
if (fa->fa_file) {
fown = &fa->fa_file->f_owner;
/* Don't send SIGURG to processes which have not set a
@@ -1010,7 +1011,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band);
}
- read_unlock(&fa->fa_lock);
+ read_unlock_irqrestore(&fa->fa_lock, flags);
fa = rcu_dereference(fa->fa_next);
}
}
--
2.30.2
next prev parent reply other threads:[~2021-09-06 1:27 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 1:21 [PATCH AUTOSEL 5.10 01/39] locking/mutex: Fix HANDOFF condition Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 02/39] regmap: fix the offset of register error log Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 03/39] regulator: tps65910: Silence deferred probe error Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 04/39] crypto: mxs-dcp - Check for DMA mapping errors Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 05/39] sched/deadline: Fix reset_on_fork reporting of DL tasks Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 06/39] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 07/39] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 08/39] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 09/39] rcu/tree: Handle VM stoppage in stall detection Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 10/39] EDAC/mce_amd: Do not load edac_mce_amd module on guests Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 11/39] posix-cpu-timers: Force next expiration recalc after itimer reset Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 12/39] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 13/39] hrtimer: Ensure timerfd notification for HIGHRES=n Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 14/39] udf: Check LVID earlier Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 15/39] udf: Fix iocharset=utf8 mount option Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 16/39] isofs: joliet: " Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 17/39] bcache: add proper error unwinding in bcache_device_init Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 18/39] blk-throtl: optimize IOPS throttle for large IO scenarios Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 19/39] nvme-tcp: don't update queue count when failing to set io queues Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 20/39] nvme-rdma: " Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 21/39] nvmet: pass back cntlid on successful completion Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 22/39] power: supply: smb347-charger: Add missing pin control activation Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 23/39] power: supply: max17042_battery: fix typo in MAx17042_TOFF Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 24/39] s390/cio: add dev_busid sysfs entry for each subchannel Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 25/39] s390/zcrypt: fix wrong offset index for APKA master key valid state Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 26/39] libata: fix ata_host_start() Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 27/39] crypto: omap - Fix inconsistent locking of device lists Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 28/39] crypto: qat - do not ignore errors from enable_vf2pf_comms() Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 29/39] crypto: qat - handle both source of interrupt in VF ISR Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 30/39] crypto: qat - fix reuse of completion variable Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 31/39] crypto: qat - fix naming for init/shutdown VF to PF notifications Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 32/39] crypto: qat - do not export adf_iov_putmsg() Sasha Levin
2021-09-06 1:21 ` Sasha Levin [this message]
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 34/39] udf_get_extendedattr() had no boundary checks Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 35/39] s390/kasan: fix large PMD pages address alignment check Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 36/39] s390/pci: fix misleading rc in clp_set_pci_fn() Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 37/39] s390/debug: keep debug data on resize Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 38/39] s390/debug: fix debug area life cycle Sasha Levin
2021-09-06 1:21 ` [PATCH AUTOSEL 5.10 39/39] s390/ap: fix state machine hang after failure to enable irq Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210906012153.929962-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=desmondcheongzx@gmail.com \
--cc=jlayton@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).