From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, syzkaller <syzkaller@googlegroups.com>,
Noa Osherovich <noaos@mellanox.com>,
Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 4.15 20/64] RDMA/uverbs: Fix circular locking dependency
Date: Mon, 26 Feb 2018 21:21:57 +0100 [thread overview]
Message-ID: <20180226202154.309904731@linuxfoundation.org> (raw)
In-Reply-To: <20180226202153.453363333@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 1ff5325c3ca1843228a86549318bbd3b414b9207 upstream.
Avoid circular locking dependency by calling
to uobj_alloc_commit() outside of xrcd_tree_mutex lock.
======================================================
WARNING: possible circular locking dependency detected
4.15.0+ #87 Not tainted
------------------------------------------------------
syzkaller401056/269 is trying to acquire lock:
(&uverbs_dev->xrcd_tree_mutex){+.+.}, at: [<000000006c12d2cd>] uverbs_free_xrcd+0xd2/0x360
but task is already holding lock:
(&ucontext->uobjects_lock){+.+.}, at: [<00000000da010f09>] uverbs_cleanup_ucontext+0x168/0x730
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&ucontext->uobjects_lock){+.+.}:
__mutex_lock+0x111/0x1720
rdma_alloc_commit_uobject+0x22c/0x600
ib_uverbs_open_xrcd+0x61a/0xdd0
ib_uverbs_write+0x7f9/0xef0
__vfs_write+0x10d/0x700
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
entry_SYSCALL_64_fastpath+0x1e/0x8b
-> #0 (&uverbs_dev->xrcd_tree_mutex){+.+.}:
lock_acquire+0x19d/0x440
__mutex_lock+0x111/0x1720
uverbs_free_xrcd+0xd2/0x360
remove_commit_idr_uobject+0x6d/0x110
uverbs_cleanup_ucontext+0x2f0/0x730
ib_uverbs_cleanup_ucontext.constprop.3+0x52/0x120
ib_uverbs_close+0xf2/0x570
__fput+0x2cd/0x8d0
task_work_run+0xec/0x1d0
do_exit+0x6a1/0x1520
do_group_exit+0xe8/0x380
SyS_exit_group+0x1e/0x20
entry_SYSCALL_64_fastpath+0x1e/0x8b
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ucontext->uobjects_lock);
lock(&uverbs_dev->xrcd_tree_mutex);
lock(&ucontext->uobjects_lock);
lock(&uverbs_dev->xrcd_tree_mutex);
*** DEADLOCK ***
3 locks held by syzkaller401056/269:
#0: (&file->cleanup_mutex){+.+.}, at: [<00000000c9f0c252>] ib_uverbs_close+0xac/0x570
#1: (&ucontext->cleanup_rwsem){++++}, at: [<00000000b6994d49>] uverbs_cleanup_ucontext+0xf6/0x730
#2: (&ucontext->uobjects_lock){+.+.}, at: [<00000000da010f09>] uverbs_cleanup_ucontext+0x168/0x730
stack backtrace:
CPU: 0 PID: 269 Comm: syzkaller401056 Not tainted 4.15.0+ #87
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
dump_stack+0xde/0x164
? dma_virt_map_sg+0x22c/0x22c
? uverbs_cleanup_ucontext+0x168/0x730
? console_unlock+0x502/0xbd0
print_circular_bug.isra.24+0x35e/0x396
? print_circular_bug_header+0x12e/0x12e
? find_usage_backwards+0x30/0x30
? entry_SYSCALL_64_fastpath+0x1e/0x8b
validate_chain.isra.28+0x25d1/0x40c0
? check_usage+0xb70/0xb70
? graph_lock+0x160/0x160
? find_usage_backwards+0x30/0x30
? cyc2ns_read_end+0x10/0x10
? print_irqtrace_events+0x280/0x280
? __lock_acquire+0x93d/0x1630
__lock_acquire+0x93d/0x1630
lock_acquire+0x19d/0x440
? uverbs_free_xrcd+0xd2/0x360
__mutex_lock+0x111/0x1720
? uverbs_free_xrcd+0xd2/0x360
? uverbs_free_xrcd+0xd2/0x360
? __mutex_lock+0x828/0x1720
? mutex_lock_io_nested+0x1550/0x1550
? uverbs_cleanup_ucontext+0x168/0x730
? __lock_acquire+0x9a9/0x1630
? mutex_lock_io_nested+0x1550/0x1550
? uverbs_cleanup_ucontext+0xf6/0x730
? lock_contended+0x11a0/0x11a0
? uverbs_free_xrcd+0xd2/0x360
uverbs_free_xrcd+0xd2/0x360
remove_commit_idr_uobject+0x6d/0x110
uverbs_cleanup_ucontext+0x2f0/0x730
? sched_clock_cpu+0x18/0x200
? uverbs_close_fd+0x1c0/0x1c0
ib_uverbs_cleanup_ucontext.constprop.3+0x52/0x120
ib_uverbs_close+0xf2/0x570
? ib_uverbs_remove_one+0xb50/0xb50
? ib_uverbs_remove_one+0xb50/0xb50
__fput+0x2cd/0x8d0
task_work_run+0xec/0x1d0
do_exit+0x6a1/0x1520
? fsnotify_first_mark+0x220/0x220
? exit_notify+0x9f0/0x9f0
? entry_SYSCALL_64_fastpath+0x5/0x8b
? entry_SYSCALL_64_fastpath+0x5/0x8b
? trace_hardirqs_on_thunk+0x1a/0x1c
? time_hardirqs_on+0x27/0x670
? time_hardirqs_off+0x27/0x490
? syscall_return_slowpath+0x6c/0x460
? entry_SYSCALL_64_fastpath+0x5/0x8b
do_group_exit+0xe8/0x380
SyS_exit_group+0x1e/0x20
entry_SYSCALL_64_fastpath+0x1e/0x8b
RIP: 0033:0x431ce9
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # 4.11
Fixes: fd3c7904db6e ("IB/core: Change idr objects to use the new schema")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs_cmd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -560,9 +560,10 @@ ssize_t ib_uverbs_open_xrcd(struct ib_uv
if (f.file)
fdput(f);
+ mutex_unlock(&file->device->xrcd_tree_mutex);
+
uobj_alloc_commit(&obj->uobject);
- mutex_unlock(&file->device->xrcd_tree_mutex);
return in_len;
err_copy:
next prev parent reply other threads:[~2018-02-26 20:21 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-26 20:21 [PATCH 4.15 00/64] 4.15.7-stable review Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 01/64] netfilter: drop outermost socket lock in getsockopt() Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 02/64] arm64: mm: dont write garbage into TTBR1_EL1 register Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 03/64] kconfig.h: Include compiler types to avoid missed struct attributes Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 04/64] MIPS: boot: Define __ASSEMBLY__ for its.S build Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 05/64] xtensa: fix high memory/reserved memory collision Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 06/64] scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 07/64] MIPS: Drop spurious __unused in struct compat_flock Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 08/64] cfg80211: fix cfg80211_beacon_dup Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 09/64] i2c: designware: must wait for enable Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 10/64] i2c: bcm2835: Set up the rising/falling edge delays Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 11/64] X.509: fix BUG_ON() when hash algorithm is unsupported Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 12/64] X.509: fix NULL dereference when restricting key with unsupported_sig Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 13/64] PKCS#7: fix certificate chain verification Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 14/64] PKCS#7: fix certificate blacklisting Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 15/64] extcon: int3496: process id-pin first so that we start with the right status Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 16/64] genirq/matrix: Handle CPU offlining proper Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 17/64] RDMA/uverbs: Protect from races between lookup and destroy of uobjects Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 18/64] RDMA/uverbs: Protect from command mask overflow Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 19/64] RDMA/uverbs: Fix bad unlock balance in ib_uverbs_close_xrcd Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman [this message]
2018-02-26 20:21 ` [PATCH 4.15 21/64] RDMA/uverbs: Sanitize user entered port numbers prior to access it Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 22/64] iio: adc: stm32: fix stm32h7_adc_enable error handling Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 23/64] iio: srf08: fix link error "devm_iio_triggered_buffer_setup" undefined Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 24/64] iio: buffer: check if a buffer has been set up when poll is called Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 25/64] iio: adis_lib: Initialize trigger before requesting interrupt Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 26/64] Kbuild: always define endianess in kconfig.h Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 27/64] x86/apic/vector: Handle vector release on CPU unplug correctly Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 28/64] x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 29/64] mm, swap, frontswap: fix THP swap if frontswap enabled Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 30/64] mm: dont defer struct page initialization for Xen pv guests Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 31/64] uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 32/64] irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 33/64] irqchip/mips-gic: Avoid spuriously handling masked interrupts Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 34/64] PCI/cxgb4: Extend T3 PCI quirk to T4+ devices Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 35/64] net: thunderbolt: Tear down connection properly on suspend Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 36/64] net: thunderbolt: Run disconnect flow asynchronously when logout is received Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 37/64] ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 38/64] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 39/64] arm64: Remove unimplemented syscall log message Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 40/64] arm64: Disable unhandled signal log messages by default Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 41/64] arm64: cpufeature: Fix CTR_EL0 field definitions Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 42/64] Add delay-init quirk for Corsair K70 RGB keyboards Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 43/64] drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 44/64] usb: host: ehci: use correct device pointer for dma ops Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 45/64] usb: dwc3: gadget: Set maxpacket size for ep0 IN Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 46/64] usb: dwc3: ep0: Reset TRB counter " Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 47/64] usb: phy: mxs: Fix NULL pointer dereference on i.MX23/28 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 48/64] usb: ldusb: add PIDs for new CASSY devices supported by this driver Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 49/64] Revert "usb: musb: host: dont start next rx urb if current one failed" Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 50/64] usb: gadget: f_fs: Process all descriptors during bind Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 51/64] usb: gadget: f_fs: Use config_ep_by_speed() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 52/64] usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 53/64] drm/cirrus: Load lut in crtc_commit Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 54/64] drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 55/64] drm: Handle unexpected holes in color-eviction Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 56/64] drm/amdgpu: disable MMHUB power gating on raven Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 57/64] drm/amdgpu: fix VA hole handling on Vega10 v3 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 58/64] drm/amdgpu: Add dpm quirk for Jet PRO (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 59/64] drm/amdgpu: only check mmBIF_IOV_FUNC_IDENTIFIER on tonga/fiji Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 60/64] drm/amdgpu: add atpx quirk handling (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 61/64] drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 62/64] drm/amdgpu: add new device to use atpx quirk Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 63/64] arm64: __show_regs: Only resolve kernel symbols when running at EL1 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 64/64] drm/i915/breadcrumbs: Ignore unsubmitted signalers Greg Kroah-Hartman
2018-02-27 0:58 ` [PATCH 4.15 00/64] 4.15.7-stable review Shuah Khan
2018-02-27 13:09 ` Greg Kroah-Hartman
2018-02-27 7:07 ` Naresh Kamboju
2018-02-27 13:09 ` Greg Kroah-Hartman
2018-02-27 7:18 ` kernelci.org bot
2018-02-27 14:58 ` Guenter Roeck
2018-02-27 18:37 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180226202154.309904731@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=noaos@mellanox.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.