public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+49056626fe41e01f2ba7@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] possible deadlock in move_pages
Date: Wed, 20 Mar 2024 18:45:54 +0800	[thread overview]
Message-ID: <20240320104554.2181-1-hdanton@sina.com> (raw)
In-Reply-To: <000000000000e97f090614006d76@google.com>

On Tue, 19 Mar 2024 02:52:16 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    e5eb28f6d1af Merge tag 'mm-nonmm-stable-2024-03-14-09-36' ..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=173b7ac9180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  e5eb28f6d1af

--- x/mm/userfaultfd.c
+++ y/mm/userfaultfd.c
@@ -1442,9 +1442,9 @@ static int uffd_move_lock(struct mm_stru
 		 * See comment in lock_vma() as to why not using
 		 * vma_start_read() here.
 		 */
-		down_read(&(*dst_vmap)->vm_lock->lock);
+		down_read_nested(&(*dst_vmap)->vm_lock->lock, 1);
 		if (*dst_vmap != *src_vmap)
-			down_read(&(*src_vmap)->vm_lock->lock);
+			down_read_nested(&(*src_vmap)->vm_lock->lock, 2);
 	}
 	mmap_read_unlock(mm);
 	return err;
--

  parent reply	other threads:[~2024-03-20 10:46 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-19  9:52 [syzbot] [mm?] possible deadlock in move_pages syzbot
2024-03-19 13:37 ` David Hildenbrand
2024-03-19 17:24   ` Lokesh Gidra
2024-03-19 23:47     ` Lokesh Gidra
2024-03-20 10:45 ` Hillf Danton [this message]
2024-03-20 11:09   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240320104554.2181-1-hdanton@sina.com \
    --to=hdanton@sina.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+49056626fe41e01f2ba7@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox