From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=ksof=QN=vger.kernel.org=linux-fsdevel-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-2.5 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=unavailable
	autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 0D696C282CC
	for <linux-fsdevel@archiver.kernel.org>; Wed,  6 Feb 2019 13:39:39 +0000 (UTC)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by mail.kernel.org (Postfix) with ESMTP id DB96B20B1F
	for <linux-fsdevel@archiver.kernel.org>; Wed,  6 Feb 2019 13:39:38 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1728762AbfBFNjh (ORCPT
        <rfc822;linux-fsdevel@archiver.kernel.org>);
        Wed, 6 Feb 2019 08:39:37 -0500
Received: from verein.lst.de ([213.95.11.211]:59713 "EHLO newverein.lst.de"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1727262AbfBFNjh (ORCPT <rfc822;linux-fsdevel@vger.kernel.org>);
        Wed, 6 Feb 2019 08:39:37 -0500
Received: by newverein.lst.de (Postfix, from userid 2407)
        id C56FA68D93; Wed,  6 Feb 2019 14:39:35 +0100 (CET)
Date:   Wed, 6 Feb 2019 14:39:35 +0100
From:   Christoph Hellwig <hch@lst.de>
To:     Bart Van Assche <bvanassche@acm.org>
Cc:     Miklos Szeredi <miklos@szeredi.hu>, Christoph Hellwig <hch@lst.de>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        linux-fsdevel@vger.kernel.org, linux-aio <linux-aio@kvack.org>,
        syzbot <syzkaller@googlegroups.com>,
        Avi Kivity <avi@scylladb.com>,
        Eric Dumazet <edumazet@google.com>,
        stable <stable@vger.kernel.org>
Subject: Re: [PATCH] aio: Fix locking in aio_poll()
Message-ID: <20190206133935.GA29185@lst.de>
References: <20190204174555.83603-1-bvanassche@acm.org> <20190204174900.GA16229@lst.de> <CAJfpegtkPSss5LxB3eEK7tLCu+tv5GOeM+Wu+cksUxjvSg3now@mail.gmail.com> <1549414384.34241.77.camel@acm.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1549414384.34241.77.camel@acm.org>
User-Agent: Mutt/1.5.17 (2007-11-01)
Sender: linux-fsdevel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-fsdevel.vger.kernel.org>
X-Mailing-List: linux-fsdevel@vger.kernel.org

On Tue, Feb 05, 2019 at 04:53:04PM -0800, Bart Van Assche wrote:
> Could this be what happens?
> 
> aio_poll() calls vfs_poll()
>   vfs_poll() calls fuse_dev_poll()
>     fuse_dev_poll() calls poll_wait(file, &fiq->waitq, wait)
>       poll_wait() calls aio_poll_queue_proc(file, &fiq->waitq, wait)
>         aio_poll_queue_proc() stores &fiq->waitq in pt->iocb->poll.head
> aio_poll() calls spin_lock_irq(&ctx->ctx_lock)
> aio_poll() calls spin_lock(&req->head->lock) (req == &pt->iocb->poll).
> 
> I think the lockdep complaint is about the FUSE fiq->waitq lock not being
> IRQ-safe and about aio_poll() creating a dependency between an IRQ-safe lock
> (ctx->ctx_lock) and a lock that is not IRQ-safe (fiq->waitq).

That is exactly the scenario.  and the ->wake routine assumes irqs
are disabled - you really need to bypass the proper APIs to not have
the irqs disabled.