From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Borkmann Subject: Re: [PATCH bpf v4] bpf/tracing: fix a deadlock in perf_event_detach_bpf_prog Date: Wed, 11 Apr 2018 01:14:57 +0200 Message-ID: <7c19c01d-c636-b259-40db-b2cd0a79d628@iogearbox.net> References: <20180410163732.2818747-1-yhs@fb.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: kernel-team@fb.com To: Yonghong Song , ast@fb.com, netdev@vger.kernel.org Return-path: Received: from www62.your-server.de ([213.133.104.62]:34574 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755397AbeDJXO7 (ORCPT ); Tue, 10 Apr 2018 19:14:59 -0400 In-Reply-To: <20180410163732.2818747-1-yhs@fb.com> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 04/10/2018 06:37 PM, Yonghong Song wrote: > syzbot reported a possible deadlock in perf_event_detach_bpf_prog. > The error details: > ====================================================== > WARNING: possible circular locking dependency detected > 4.16.0-rc7+ #3 Not tainted > ------------------------------------------------------ > syz-executor7/24531 is trying to acquire lock: > (bpf_event_mutex){+.+.}, at: [<000000008a849b07>] perf_event_detach_bpf_prog+0x92/0x3d0 kernel/trace/bpf_trace.c:854 > > but task is already holding lock: > (&mm->mmap_sem){++++}, at: [<0000000038768f87>] vm_mmap_pgoff+0x198/0x280 mm/util.c:353 > > which lock already depends on the new lock. > > the existing dependency chain (in reverse order) is: > [...] > > The bug is introduced by Commit f371b304f12e ("bpf/tracing: allow > user space to query prog array on the same tp") where copy_to_user, > which requires mm->mmap_sem, is called inside bpf_event_mutex lock. > At the same time, during perf_event file descriptor close, > mm->mmap_sem is held first and then subsequent > perf_event_detach_bpf_prog needs bpf_event_mutex lock. > Such a senario caused a deadlock. > > As suggested by Daniel, moving copy_to_user out of the > bpf_event_mutex lock should fix the problem. > > Fixes: f371b304f12e ("bpf/tracing: allow user space to query prog array on the same tp") > Reported-by: syzbot+dc5ca0e4c9bfafaf2bae@syzkaller.appspotmail.com > Signed-off-by: Yonghong Song Applied to bpf tree, thanks Yonghong!