Re: 2.6.23-rc2-mm1: sleeping function called from invalid context at kernel/mutex.c:86

Alexey Dobriyan
2007-08-11T07:24:39Z

On Fri, Aug 10, 2007 at 12:55:17AM -0700, Andrew Morton wrote:
> On Fri, 10 Aug 2007 09:40:00 +0200 Ingo Molnar <mingo@elte.hu> wrote:
>
> >
> > * Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > > We seem to have made a mess in there. timer_list_show() ends up
> > > calling lookup_module_symbol_name(), which takes a mutex. However
> > > print_symbol() (which is called at oops time, interrupt time, etc)
> > > calls module_address_lookup(), which is basically the same, only it
> > > doesn't take the mutex.
> >
> > hm, current upstream does:
> >
> > static void print_name_offset(struct seq_file *m, void *sym)
> > {
> > char symname[KSYM_NAME_LEN];
> >
> > if (lookup_symbol_name((unsigned long)sym, symname) < 0)
> >
> > why was that changed?
>
> It wasn't.

Oh no, it was! commit 9d65cb4a1718a072898c7a57a3bc61b2dc4bcd4d

Fix race between cat /proc/*/wchan and rmmod et al

kallsyms_lookup() can go iterating over modules list unprotected which is OK
for emergency situations (oops), but not OK for regular stuff like
/proc/*/wchan.

> lookup_symbol_name() calls lookup_module_symbol_name() which
> calls mutex_lock().
>
> > I think symbol lookups for debug purposes have to
> > be lockless, fundamentally.
> >
>
> Sure, especially a sysrq thingy.

I imagine user running powertop which IIRC trolls /proc/timer_list and
doing rmmod following powertop instructions.

> It's a bit nasty to just go in there and start walking data structures
> without holding the needed lock though.

Yep.