AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-24 00:10:51 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

fcntl: fix potential deadlock for &fasync_struct.fa_lock

Browse Source 
[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]

There is an existing lock hierarchy of
&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock
from the following call chain:

  input_inject_event():
    spin_lock_irqsave(&dev->event_lock,...);
    input_handle_event():
      input_pass_values():
        input_to_handler():
          evdev_events():
            evdev_pass_values():
              spin_lock(&client->buffer_lock);
              __pass_event():
                kill_fasync():
                  kill_fasync_rcu():
                    read_lock(&fa->fa_lock);
                    send_sigio():
                      read_lock_irqsave(&fown->lock,...);

&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled
while grabbing &fasync_struct.fa_lock, otherwise we invert the lock
hierarchy. However, since kill_fasync which calls kill_fasync_rcu is
an exported symbol, it may not necessarily be called with interrupts
disabled.

As kill_fasync_rcu may be called with interrupts disabled (for
example, in the call chain above), we replace calls to
read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu
with read_lock_irqsave/read_unlock_irqrestore.

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Desmond Cheong Zhi Xi 2021-07-02 17:18:31 +08:00 committed by AuxXxilium
parent a6e472ecc5
commit 0b182fed9a
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/fcntl.c
View File

@ -1259,13 +1259,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
{ {
while (fa) { while (fa) {
struct fown_struct *fown; struct fown_struct *fown;
unsigned long flags;
if (fa->magic != FASYNC_MAGIC) { if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in " printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n"); "fasync_struct!\n");
return; return;
} }
read_lock(&fa->fa_lock); read_lock_irqsave(&fa->fa_lock, flags);
if (fa->fa_file) { if (fa->fa_file) {
fown = &fa->fa_file->f_owner; fown = &fa->fa_file->f_owner;
/* Don't send SIGURG to processes which have not set a /* Don't send SIGURG to processes which have not set a
@ -1274,7 +1275,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
if (!(sig == SIGURG && fown->signum == 0)) if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band); send_sigio(fown, fa->fa_fd, band);
} }
read_unlock(&fa->fa_lock); read_unlock_irqrestore(&fa->fa_lock, flags);
fa = rcu_dereference(fa->fa_next); fa = rcu_dereference(fa->fa_next);
} }
} }