From: ebiederm@xmission.com (Eric W. Biederman)
To: Nikolay Borisov <n.borisov.lkml@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>, avagin <avagin@openvz.org>,
serge@hallyn.com, Kees Cook <keescook@chromium.org>,
Al Viro <viro@zeniv.linux.org.uk>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: namespace: deadlock in dec_pid_namespaces
Date: Sat, 21 Jan 2017 07:05:49 +1300 [thread overview]
Message-ID: <877f5py5c2.fsf@xmission.com> (raw)
In-Reply-To: <bce4b00c-8032-04f1-7fd8-ad16f9f3cef6@gmail.com> (Nikolay Borisov's message of "Fri, 20 Jan 2017 15:26:45 +0200")
Nikolay Borisov <n.borisov.lkml@gmail.com> writes:
> On 20.01.2017 15:07, Dmitry Vyukov wrote:
>> Hello,
>>
>> I've got the following deadlock report while running syzkaller fuzzer
>> on eec0d3d065bfcdf9cd5f56dd2a36b94d12d32297 of linux-next (on odroid
>> device if it matters):
I am puzzled I thought we had fixed this with:
add7c65ca426 ("pid: fix lockdep deadlock warning due to ucount_lock")
But apparently not. We just moved it from hardirq to softirq context. Bah.
Thank you very much for the report.
Nikolay can you make your change use spinlock_irq? And have put_ucounts
do spin_lock_irqsave? That way we just don't care where we call this.
I a tired of being clever.
Eric
> From 86565326b382b41cb988a83791eff1c4d600040b Mon Sep 17 00:00:00 2001
> From: Nikolay Borisov <n.borisov.lkml@gmail.com>
> Date: Fri, 20 Jan 2017 15:21:35 +0200
> Subject: [PATCH] userns: Make ucounts lock softirq-safe
>
> The ucounts_lock is being used to protect various ucounts lifecycle
> management functionalities. However, those services can also be invoked
> when a pidns is being freed in an RCU callback (e.g. softirq context).
> This can lead to deadlocks. Fix it by making the spinlock disable softirq
>
> Signed-off-by: Nikolay Borisov <n.borisov.lkml@gmail.com>
> ---
> kernel/ucount.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/ucount.c b/kernel/ucount.c
> index b4aaee935b3e..23a44ea894cd 100644
> --- a/kernel/ucount.c
> +++ b/kernel/ucount.c
> @@ -132,10 +132,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> struct hlist_head *hashent = ucounts_hashentry(ns, uid);
> struct ucounts *ucounts, *new;
>
> - spin_lock(&ucounts_lock);
> + spin_lock_bh(&ucounts_lock);
> ucounts = find_ucounts(ns, uid, hashent);
> if (!ucounts) {
> - spin_unlock(&ucounts_lock);
> + spin_unlock_bh(&ucounts_lock);
>
> new = kzalloc(sizeof(*new), GFP_KERNEL);
> if (!new)
> @@ -145,7 +145,7 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> new->uid = uid;
> atomic_set(&new->count, 0);
>
> - spin_lock(&ucounts_lock);
> + spin_lock_bh(&ucounts_lock);
> ucounts = find_ucounts(ns, uid, hashent);
> if (ucounts) {
> kfree(new);
> @@ -156,16 +156,16 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
> }
> if (!atomic_add_unless(&ucounts->count, 1, INT_MAX))
> ucounts = NULL;
> - spin_unlock(&ucounts_lock);
> + spin_unlock_bh(&ucounts_lock);
> return ucounts;
> }
>
> static void put_ucounts(struct ucounts *ucounts)
> {
> if (atomic_dec_and_test(&ucounts->count)) {
> - spin_lock(&ucounts_lock);
> + spin_lock_bh(&ucounts_lock);
> hlist_del_init(&ucounts->node);
> - spin_unlock(&ucounts_lock);
> + spin_unlock_bh(&ucounts_lock);
>
> kfree(ucounts);
> }
next prev parent reply other threads:[~2017-01-20 18:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-20 13:07 namespace: deadlock in dec_pid_namespaces Dmitry Vyukov
2017-01-20 13:26 ` Nikolay Borisov
2017-01-20 18:05 ` Eric W. Biederman [this message]
2017-01-20 22:44 ` Nikolay Borisov
2017-01-21 0:28 ` Eric W. Biederman
2017-01-23 9:35 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877f5py5c2.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=avagin@openvz.org \
--cc=dvyukov@google.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=n.borisov.lkml@gmail.com \
--cc=serge@hallyn.com \
--cc=syzkaller@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).