From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: Re: next-20090220: XFS, IMA: BUG: sleeping function called from invalid context at mm/slub.c:1613 Date: Fri, 20 Feb 2009 17:16:59 -0500 Message-ID: <1235168219.3019.4.camel@localhost.localdomain> References: <20090220122242.b36a778f.akpm@linux-foundation.org> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from e36.co.us.ibm.com ([32.97.110.154]:40072 "EHLO e36.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751178AbZBTWRE (ORCPT ); Fri, 20 Feb 2009 17:17:04 -0500 In-Reply-To: <20090220122242.b36a778f.akpm@linux-foundation.org> Sender: linux-next-owner@vger.kernel.org List-ID: To: Andrew Morton Cc: Alexander Beregalov , linux-kernel@vger.kernel.org, linux-next@vger.kernel.org, xfs@oss.sgi.com, James Morris On Fri, 2009-02-20 at 12:22 -0800, Andrew Morton wrote: > On Fri, 20 Feb 2009 14:00:21 +0300 > Alexander Beregalov wrote: > > > Hi > > > > I have applied the following patch from Mimi Zohar > > http://marc.info/?l=linux-next&m=123509665514552 > > > > That is why it is dirty. > > The kernel can not boot without it when IMA is enabled. With CONFIG_DEBUG_SG and IMA defined, it couldn't boot. > > BUG: sleeping function called from invalid context at mm/slub.c:1613 > > in_atomic(): 1, irqs_disabled(): 0, pid: 1514, name: mkdir > > 3 locks held by mkdir/1514: > > #0: (&type->i_mutex_dir_key#2/1){+.+.+.}, at: [] > > lookup_create+0x30/0xd0 > > #1: (&(&ip->i_lock)->mr_lock/1){+.+.+.}, at: [] > > xfs_ilock+0xdf/0x120 > > #2: (&pag->pag_ici_lock){++++.+}, at: [] > > xfs_iget+0x156/0x650 > > Pid: 1514, comm: mkdir Not tainted 2.6.29-rc5-next-20090220-dirty #1 > > Call Trace: > > [] ? __debug_show_held_locks+0x13/0x30 > > [] __might_sleep+0x105/0x140 > > [] kmem_cache_alloc+0xd1/0x100 > > [] ima_iint_insert+0x49/0xf0 > > [] ima_inode_alloc+0x1d/0x30 > > [] inode_init_always+0xaf/0x250 > > [] xfs_iget+0x206/0x650 > > [] xfs_trans_iget+0x208/0x250 > > [] xfs_ialloc+0xc1/0x700 > > [] xfs_dir_ialloc+0xa9/0x340 > > [] ? down_write_nested+0x79/0x90 > > [] xfs_create+0x3e1/0x690 > > [] xfs_vn_mknod+0x63/0xf0 > > [] xfs_vn_mkdir+0xe/0x10 > > [] vfs_mkdir+0x8c/0xd0 > > [] sys_mkdirat+0x106/0x120 > > [] ? sysret_check+0x27/0x62 > > [] ? trace_hardirqs_on_caller+0x17d/0x1e0 > > [] sys_mkdir+0x13/0x20 > > [] system_call_fastpath+0x16/0x1b > > BUG: sleeping function called from invalid context at mm/slub.c:1613 > > Please do not be tempted to switch ima_iint_insert() to use GFP_ATOMIC > to "fix" this. > > Arguably, ima_iint_insert() should requite that the caller pass in the > gfp_t rather than assuming that GFP_KERNEL can be used. But that is > not a suitable fix for this bug. > > We may need to make that change to ima_iint_insert() anyway, as there's > a good chance that callers will require GFP_NOFS. > > > But to fix this bug, xfs needs to stop calling inode_init_always() > under read_lock(). Because inode_alloc_security() also can sleep (see > new_inode_smack()). > > Also, ima_iint_insert() does a radix_tree_lookup() without holding > ima_iint_lock, which appears to be a bug. Thank you. For now, here's a patch to add locking around the radix_tree_lookup(). I'll look into passing gfp_t. Mimi integrity: ima iint radix_tree_lookup locking fix Based on Andrew Morton's comments: - add missing locks around radix_tree_lookup in ima_iint_insert() Signed-off-by: Mimi Zohar Index: security-testing-2.6/security/integrity/ima/ima_iint.c =================================================================== --- security-testing-2.6.orig/security/integrity/ima/ima_iint.c +++ security-testing-2.6/security/integrity/ima/ima_iint.c @@ -73,8 +73,10 @@ out: if (rc < 0) { kmem_cache_free(iint_cache, iint); if (rc == -EEXIST) { + spin_lock(&ima_iint_lock); iint = radix_tree_lookup(&ima_iint_store, (unsigned long)inode); + spin_unlock(&ima_iint_lock); } else iint = NULL; }