From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andre Przywara <andre.przywara@arm.com>,
Juergen Gross <jgross@suse.com>
Subject: [PATCH 4.12 26/27] xen: avoid deadlock in xenbus driver
Date: Mon, 10 Jul 2017 19:10:23 +0200 [thread overview]
Message-ID: <20170710170104.979010375@linuxfoundation.org> (raw)
In-Reply-To: <20170710170103.831324799@linuxfoundation.org>
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit 1a3fc2c402810bf336882e695abd1678dbc8d279 upstream.
There has been a report about a deadlock in the xenbus driver:
[ 247.979498] ======================================================
[ 247.985688] WARNING: possible circular locking dependency detected
[ 247.991882] 4.12.0-rc4-00022-gc4b25c0 #575 Not tainted
[ 247.997040] ------------------------------------------------------
[ 248.003232] xenbus/91 is trying to acquire lock:
[ 248.007875] (&u->msgbuffer_mutex){+.+.+.}, at: [<ffff00000863e904>]
xenbus_dev_queue_reply+0x3c/0x230
[ 248.017163]
[ 248.017163] but task is already holding lock:
[ 248.023096] (xb_write_mutex){+.+...}, at: [<ffff00000863a940>]
xenbus_thread+0x5f0/0x798
[ 248.031267]
[ 248.031267] which lock already depends on the new lock.
[ 248.031267]
[ 248.039615]
[ 248.039615] the existing dependency chain (in reverse order) is:
[ 248.047176]
[ 248.047176] -> #1 (xb_write_mutex){+.+...}:
[ 248.052943] __lock_acquire+0x1728/0x1778
[ 248.057498] lock_acquire+0xc4/0x288
[ 248.061630] __mutex_lock+0x84/0x868
[ 248.065755] mutex_lock_nested+0x3c/0x50
[ 248.070227] xs_send+0x164/0x1f8
[ 248.074015] xenbus_dev_request_and_reply+0x6c/0x88
[ 248.079427] xenbus_file_write+0x260/0x420
[ 248.084073] __vfs_write+0x48/0x138
[ 248.088113] vfs_write+0xa8/0x1b8
[ 248.091983] SyS_write+0x54/0xb0
[ 248.095768] el0_svc_naked+0x24/0x28
[ 248.099897]
[ 248.099897] -> #0 (&u->msgbuffer_mutex){+.+.+.}:
[ 248.106088] print_circular_bug+0x80/0x2e0
[ 248.110730] __lock_acquire+0x1768/0x1778
[ 248.115288] lock_acquire+0xc4/0x288
[ 248.119417] __mutex_lock+0x84/0x868
[ 248.123545] mutex_lock_nested+0x3c/0x50
[ 248.128016] xenbus_dev_queue_reply+0x3c/0x230
[ 248.133005] xenbus_thread+0x788/0x798
[ 248.137306] kthread+0x110/0x140
[ 248.141087] ret_from_fork+0x10/0x40
It is rather easy to avoid by dropping xb_write_mutex before calling
xenbus_dev_queue_reply().
Fixes: fd8aa9095a95c02dcc35540a263267c29b8fda9d ("xen: optimize xenbus
driver for multiple concurrent xenstore accesses").
Reported-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Tested-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus_comms.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
--- a/drivers/xen/xenbus/xenbus_comms.c
+++ b/drivers/xen/xenbus/xenbus_comms.c
@@ -299,17 +299,7 @@ static int process_msg(void)
mutex_lock(&xb_write_mutex);
list_for_each_entry(req, &xs_reply_list, list) {
if (req->msg.req_id == state.msg.req_id) {
- if (req->state == xb_req_state_wait_reply) {
- req->msg.type = state.msg.type;
- req->msg.len = state.msg.len;
- req->body = state.body;
- req->state = xb_req_state_got_reply;
- list_del(&req->list);
- req->cb(req);
- } else {
- list_del(&req->list);
- kfree(req);
- }
+ list_del(&req->list);
err = 0;
break;
}
@@ -317,6 +307,15 @@ static int process_msg(void)
mutex_unlock(&xb_write_mutex);
if (err)
goto out;
+
+ if (req->state == xb_req_state_wait_reply) {
+ req->msg.type = state.msg.type;
+ req->msg.len = state.msg.len;
+ req->body = state.body;
+ req->state = xb_req_state_got_reply;
+ req->cb(req);
+ } else
+ kfree(req);
}
mutex_unlock(&xs_response_mutex);
next prev parent reply other threads:[~2017-07-10 17:11 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-10 17:09 [PATCH 4.12 00/27] 4.12.1-stable review Greg Kroah-Hartman
2017-07-10 17:09 ` [PATCH 4.12 01/27] driver core: platform: fix race condition with driver_override Greg Kroah-Hartman
2017-07-10 17:09 ` [PATCH 4.12 02/27] RDMA/uverbs: Check port number supplied by user verbs cmds Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 03/27] usb: dwc3: replace %p with %pK Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 04/27] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 05/27] usb: usbip: set buffer pointers to NULL after free Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 06/27] Add USB quirk for HVR-950q to avoid intermittent device resets Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 07/27] usb: Fix typo in the definition of Endpoint[out]Request Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 08/27] USB: core: fix device node leak Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 11/27] xhci: Limit USB2 port wake support for AMD Promontory hosts Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 12/27] gfs2: Fix glock rhashtable rcu bug Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 13/27] Add "shutdown" to "struct class" Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 14/27] tpm: Issue a TPM2_Shutdown for TPM2 devices Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 15/27] tpm: fix a kernel memory leak in tpm-sysfs.c Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 16/27] powerpc/powernv: Fix CPU_HOTPLUG=n idle.c compile error Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 17/27] x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 18/27] sched/fair, cpumask: Export for_each_cpu_wrap() Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 19/27] sched/core: Implement new approach to scale select_idle_cpu() Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 20/27] sched/numa: Use down_read_trylock() for the mmap_sem Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 21/27] sched/numa: Override part of migrate_degrades_locality() when idle balancing Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 22/27] sched/fair: Simplify wake_affine() for the single socket case Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 23/27] sched/numa: Implement NUMA node level wake_affine() Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 24/27] sched/fair: Remove effective_load() Greg Kroah-Hartman
2017-07-10 17:10 ` [PATCH 4.12 25/27] sched/numa: Hide numa_wake_affine() from UP build Greg Kroah-Hartman
2017-07-10 17:10 ` Greg Kroah-Hartman [this message]
2017-07-10 17:10 ` [PATCH 4.12 27/27] crypto: drbg - Fixes panic in wait_for_completion call Greg Kroah-Hartman
2017-07-11 1:21 ` [PATCH 4.12 00/27] 4.12.1-stable review Guenter Roeck
2017-07-11 9:47 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170710170104.979010375@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andre.przywara@arm.com \
--cc=jgross@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).