mm-commits Archive on lore.kernel.org
 help / color / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, hughd@google.com, linux-mm@kvack.org,
	mm-commits@vger.kernel.org, torvalds@linux-foundation.org,
	yang.shi@linux.alibaba.com
Subject: [patch 12/15] shmem: fix possible deadlocks on shmlock_user_lock
Date: Mon, 20 Apr 2020 18:14:14 -0700
Message-ID: <20200421011414.R2zEkJGM2%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200420181310.c18b3c0aa4dc5b3e5ec1be10@linux-foundation.org>

From: Hugh Dickins <hughd@google.com>
Subject: shmem: fix possible deadlocks on shmlock_user_lock

Recent commit 71725ed10c40 ("mm: huge tmpfs: try to split_huge_page() when
punching hole") has allowed syzkaller to probe deeper, uncovering a
long-standing lockdep issue between the irq-unsafe shmlock_user_lock, the
irq-safe xa_lock on mapping->i_pages, and shmem inode's info->lock which
nests inside xa_lock (or tree_lock) since 4.8's shmem_uncharge().

user_shm_lock(), servicing SysV shmctl(SHM_LOCK), wants shmlock_user_lock
while its caller shmem_lock() holds info->lock with interrupts disabled;
but hugetlbfs_file_setup() calls user_shm_lock() with interrupts enabled,
and might be interrupted by a writeback endio wanting xa_lock on i_pages. 
This may not risk an actual deadlock, since shmem inodes do not take part
in writeback accounting, but there are several easy ways to avoid it.

Requiring interrupts disabled for shmlock_user_lock would be easy, but
it's a high-level global lock for which that seems inappropriate. 
Instead, recall that the use of info->lock to guard info->flags in
shmem_lock() dates from pre-3.1 days, when races with SHMEM_PAGEIN and
SHMEM_TRUNCATE could occur: nowadays it serves no purpose, the only flag
added or removed is VM_LOCKED itself, and calls to shmem_lock() an inode
are already serialized by the caller.  Take info->lock out of the chain
and the possibility of deadlock or lockdep warning goes away.

Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2004161707410.16322@eggly.anvils
Reported-by: syzbot+c8a8197c8852f566b9d9@syzkaller.appspotmail.com
Link: https://lore.kernel.org/lkml/000000000000e5838c05a3152f53@google.com/
Reported-by: syzbot+40b71e145e73f78f81ad@syzkaller.appspotmail.com
Link: https://lore.kernel.org/lkml/0000000000003712b305a331d3b1@google.com/
Fixes: 4595ef88d136 ("shmem: make shmem_inode_info::lock irq-safe")
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Yang Shi <yang.shi@linux.alibaba.com>
Acked-by: Yang Shi <yang.shi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/shmem.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/mm/shmem.c~shmem-fix-possible-deadlocks-on-shmlock_user_lock
+++ a/mm/shmem.c
@@ -2179,7 +2179,11 @@ int shmem_lock(struct file *file, int lo
 	struct shmem_inode_info *info = SHMEM_I(inode);
 	int retval = -ENOMEM;
 
-	spin_lock_irq(&info->lock);
+	/*
+	 * What serializes the accesses to info->flags?
+	 * ipc_lock_object() when called from shmctl_do_lock(),
+	 * no serialization needed when called from shm_destroy().
+	 */
 	if (lock && !(info->flags & VM_LOCKED)) {
 		if (!user_shm_lock(inode->i_size, user))
 			goto out_nomem;
@@ -2194,7 +2198,6 @@ int shmem_lock(struct file *file, int lo
 	retval = 0;
 
 out_nomem:
-	spin_unlock_irq(&info->lock);
 	return retval;
 }
 
_

  parent reply index

Thread overview: 71+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-21  1:13 incoming Andrew Morton
2020-04-21  1:13 ` [patch 01/15] sh: fix build error in mm/init.c Andrew Morton
2020-04-21  1:13 ` [patch 02/15] slub: avoid redzone when choosing freepointer location Andrew Morton
2020-04-21  1:13 ` [patch 03/15] mm/userfaultfd: disable userfaultfd-wp on x86_32 Andrew Morton
2020-04-21  1:13 ` [patch 04/15] MAINTAINERS: add an entry for kfifo Andrew Morton
2020-04-21  1:13 ` [patch 05/15] mm/hugetlb: fix a addressing exception caused by huge_pte_offset Andrew Morton
2020-04-21  1:13 ` [patch 06/15] mm, gup: return EINTR when gup is interrupted by fatal signals Andrew Morton
2020-04-21  1:13 ` [patch 07/15] checkpatch: fix a typo in the regex for $allocFunctions Andrew Morton
2020-04-21  1:14 ` [patch 08/15] tools/build: tweak unused value workaround Andrew Morton
2020-04-21  1:14 ` [patch 09/15] mm/ksm: fix NULL pointer dereference when KSM zero page is enabled Andrew Morton
2020-04-21  1:14 ` [patch 10/15] mm/shmem: fix build without THP Andrew Morton
2020-04-21  1:14 ` [patch 11/15] vmalloc: fix remap_vmalloc_range() bounds checks Andrew Morton
2020-04-21  1:14 ` Andrew Morton [this message]
2020-04-21  1:14 ` [patch 13/15] mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path Andrew Morton
2020-04-21  1:14 ` [patch 14/15] coredump: fix null pointer dereference on coredump Andrew Morton
2020-04-21  1:14 ` [patch 15/15] tools/vm: fix cross-compile build Andrew Morton
2020-04-21  2:00 ` + mm-memory_hotplug-refrain-from-adding-memory-into-an-impossible-node.patch added to -mm tree Andrew Morton
2020-04-21  2:48 ` + x86-mm-define-mm_p4d_folded.patch " Andrew Morton
2020-04-21  2:52 ` + mm-debug-add-tests-validating-architecture-page-table-helpers-v17.patch " Andrew Morton
2020-04-21  2:59 ` + mm-mmapc-add-more-sanity-checks-to-get_unmapped_area.patch " Andrew Morton
2020-04-21  2:59 ` + mm-mmapc-do-not-allow-mappings-outside-of-allowed-limits.patch " Andrew Morton
2020-04-21  3:07 ` + initrdmem=-option-to-specify-initrd-physical-address-checkpatch-fixes.patch " Andrew Morton
2020-04-21  3:58 ` + initrdmem=-option-to-specify-initrd-physical-address.patch " Andrew Morton
2020-04-21  5:43 ` mmotm 2020-04-20-22-43 uploaded Andrew Morton
2020-04-22  1:36 ` + mm-swapfilec-found_free-could-be-represented-by-tmp-max.patch added to -mm tree Andrew Morton
2020-04-22  1:36 ` + mm-swapfilec-tmp-is-always-smaller-than-max.patch " Andrew Morton
2020-04-22  1:36 ` + mm-swapfilec-omit-a-duplicate-code-by-compare-tmp-and-max-first.patch " Andrew Morton
2020-04-23 22:36 ` + kasan-initialise-array-in-kasan_memcmp-test.patch " Andrew Morton
2020-04-23 22:38 ` + kvm-svm-change-flag-passed-to-gup-fast-in-sev_pin_memory.patch " Andrew Morton
2020-04-23 22:41 ` + mm-pass-task-and-mm-to-do_madvise-fix.patch " Andrew Morton
2020-04-23 22:44 ` + mm-support-vector-address-ranges-for-process_madvise.patch " Andrew Morton
2020-04-23 22:44 ` + mm-support-vector-address-ranges-for-process_madvise-fix.patch " Andrew Morton
2020-04-23 22:48 ` + kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source.patch " Andrew Morton
2020-04-23 22:48 ` + stringh-fix-incompatibility-between-fortify_source-and-kasan.patch " Andrew Morton
2020-04-23 23:03 ` + powerpc-add-support-for-folded-p4d-page-tables-fix.patch " Andrew Morton
2020-04-23 23:09 ` [folded-merged] memcg-optimize-memorynuma_stat-like-memorystat-fix.patch removed from " Andrew Morton
2020-04-23 23:32 ` + slub-remove-userspace-notifier-for-cache-add-remove.patch added to " Andrew Morton
2020-04-23 23:35 ` + ocfs2-mount-shared-volume-without-ha-stack.patch " Andrew Morton
2020-04-24  0:29 ` + mm-memory_hotplug-handle-memblocks-only-with-config_arch_keep_memblock.patch " Andrew Morton
2020-04-24  1:17 ` + mm-return-true-in-cpupid_pid_unset.patch " Andrew Morton
2020-04-24  1:20 ` + kernel-better-document-the-use_mm-unuse_mm-api-contract-v2-fix.patch " Andrew Morton
2020-04-24  1:40 ` + mm-thp-rename-pmd_mknotpresent-as-pmd_mkinvalid-v2.patch " Andrew Morton
2020-04-24  1:47 ` + ipc-convert-ipcs_idr-to-xarray-update.patch " Andrew Morton
     [not found]   ` <20200605195848.GB5393@lca.pw>
     [not found]     ` <20200605201134.GJ19604@bombadil.infradead.org>
2020-06-05 21:20       ` Andrew Morton
2020-12-30 15:44   ` Manfred Spraul
2020-04-24  2:06 ` + powerpc-spufs-simplify-spufs-core-dumping.patch " Andrew Morton
2020-04-24  2:06 ` + signal-factor-copy_siginfo_to_external32-from-copy_siginfo_to_user32.patch " Andrew Morton
2020-04-24  2:06 ` + binfmt_elf-femove-the-set_fs-in-fill_siginfo_note.patch " Andrew Morton
2020-04-24  2:06 ` + binfmt_elf-remove-the-set_fskernel_ds-in-elf_core_dump.patch " Andrew Morton
2020-04-24  2:06 ` + binfmt_elf_fdpic-remove-the-set_fskernel_ds-in-elf_fdpic_core_dump.patch " Andrew Morton
2020-04-24  2:06 ` + exec-simplify-the-copy_strings_kernel-calling-convention.patch " Andrew Morton
2020-04-24  2:06 ` + exec-open-code-copy_string_kernel.patch " Andrew Morton
2020-04-24  3:24 ` + add-kernel-config-option-for-twisting-kernel-behavior.patch " Andrew Morton
2020-04-24  3:24 ` + twist-allow-disabling-k_spec-function-in-drivers-tty-vt-keyboardc.patch " Andrew Morton
2020-04-24  3:24 ` + twist-add-option-for-selecting-twist-options-for-syzkallers-testing.patch " Andrew Morton
2020-04-24  3:32 ` + eventpoll-fix-missing-wakeup-for-ovflist-in-ep_poll_callback.patch " Andrew Morton
2020-04-24  3:49 ` [obsolete] linux-next-rejects.patch removed from " Andrew Morton
2020-04-24  3:51 ` + mips-mm-add-page-soft-dirty-tracking.patch added to " Andrew Morton
2020-04-24 23:36 ` + mm-memory_hotplug-set-node_start_pfn-of-hotadded-pgdat-to-0.patch " Andrew Morton
2020-04-26  0:09 ` + mm-switch-the-test_vmalloc-module-to-use-__vmalloc_node-fix-fix.patch " Andrew Morton
2020-04-26  0:17 ` + mm-hugetlb-avoid-unnecessary-check-on-pud-and-pmd-entry-in-huge_pte_offset.patch " Andrew Morton
2020-04-26  0:29 ` + eventpoll-fix-missing-wakeup-for-ovflist-in-ep_poll_callback-v2.patch " Andrew Morton
2020-04-26  0:41 ` [withdrawn] kasan-initialise-array-in-kasan_memcmp-test.patch removed from " Andrew Morton
2020-04-26  0:41 ` + kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source-v4.patch added to " Andrew Morton
2020-04-26  0:48 ` + checkpatch-test-git_dir-changes.patch " Andrew Morton
2020-04-26  1:06 ` + mm-add-debug_wx-support.patch " Andrew Morton
2020-04-26  1:06 ` + riscv-support-debug_wx.patch " Andrew Morton
2020-04-26  1:06 ` + riscv-support-debug_wx-fix.patch " Andrew Morton
2020-04-26  1:06 ` + x86-mm-use-arch_has_debug_wx-instead-of-arch-defined.patch " Andrew Morton
2020-04-26  1:06 ` + arm64-mm-use-arch_has_debug_wx-instead-of-arch-defined.patch " Andrew Morton
2020-04-26  1:09 ` [folded-merged] initrdmem=-option-to-specify-initrd-physical-address-checkpatch-fixes.patch removed from " Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200421011414.R2zEkJGM2%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=hughd@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mm-commits@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=yang.shi@linux.alibaba.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

mm-commits Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/mm-commits/0 mm-commits/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 mm-commits mm-commits/ https://lore.kernel.org/mm-commits \
		mm-commits@vger.kernel.org
	public-inbox-index mm-commits

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.mm-commits


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git