From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D5D9C32792 for ; Thu, 3 Oct 2019 15:19:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3D26A215EA for ; Thu, 3 Oct 2019 15:19:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570115959; bh=VGdOBCvthwZAw5M9KmhytugKdy+xBwor+dx5qoa9qwI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=p+m0S1E7Nw2tdl38U6p1/s92M/IPCxpqNhXiFVOGg5iH7oW4vNH8chiTikgm/dM17 dqAjPI8hGjLOzY6L2v8D5ogrioaTcwAEJlvWaVOIapEv/Yk+pwWri3ai7GchzIfTny gOPZWaa9xPz7fdirzG4orpHnJQFw9SJ0YJC4wvd8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727978AbfJCPTS (ORCPT ); Thu, 3 Oct 2019 11:19:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:41528 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727587AbfJCPTS (ORCPT ); Thu, 3 Oct 2019 11:19:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 159942133F; Thu, 3 Oct 2019 15:19:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570115957; bh=VGdOBCvthwZAw5M9KmhytugKdy+xBwor+dx5qoa9qwI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=HHBg/O/EbdAZy3ZxpyzUZxL/0T6EehvnMS8+oBpWzjfFGRtctXBRD5M37gayo9xN6 wubnWGONGuwlABlKV6ngpxHEX0HJtfm6Duy2h8Z7by17N2P+GI1gjvUYGBYipYVUF3 IbD3i4GSR9M3MAZphxn8yU6qNK2t3C2UiuY70fiU= Date: Thu, 3 Oct 2019 17:19:14 +0200 From: Greg KH To: Sasha Levin Cc: ebiggers@google.com, hch@lst.de, mszeredi@redhat.com, stable@vger.kernel.org Subject: Re: FAILED: patch "[PATCH] fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock" failed to apply to 4.19-stable tree Message-ID: <20191003151914.GA3183327@kroah.com> References: <157008885411399@kroah.com> <20191003131655.GW17454@sasha-vm> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20191003131655.GW17454@sasha-vm> User-Agent: Mutt/1.12.2 (2019-09-21) Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Thu, Oct 03, 2019 at 09:16:55AM -0400, Sasha Levin wrote: > On Thu, Oct 03, 2019 at 09:47:34AM +0200, gregkh@linuxfoundation.org wrote: > > > > The patch below does not apply to the 4.19-stable tree. > > If someone wants it applied there, or to any other stable or longterm > > tree, then please email the backport, including the original git commit > > id to . > > > > thanks, > > > > greg k-h > > > > ------------------ original commit in Linus's tree ------------------ > > > > > From 76e43c8ccaa35c30d5df853013561145a0f750a5 Mon Sep 17 00:00:00 2001 > > From: Eric Biggers > > Date: Sun, 8 Sep 2019 20:15:18 -0700 > > Subject: [PATCH] fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock > > > > When IOCB_CMD_POLL is used on the FUSE device, aio_poll() disables IRQs > > and takes kioctx::ctx_lock, then fuse_iqueue::waitq.lock. > > > > This may have to wait for fuse_iqueue::waitq.lock to be released by one > > of many places that take it with IRQs enabled. Since the IRQ handler > > may take kioctx::ctx_lock, lockdep reports that a deadlock is possible. > > > > Fix it by protecting the state of struct fuse_iqueue with a separate > > spinlock, and only accessing fuse_iqueue::waitq using the versions of > > the waitqueue functions which do IRQ-safe locking internally. > > > > Reproducer: > > > > #include > > #include > > #include > > #include > > #include > > #include > > #include > > > > int main() > > { > > char opts[128]; > > int fd = open("/dev/fuse", O_RDWR); > > aio_context_t ctx = 0; > > struct iocb cb = { .aio_lio_opcode = IOCB_CMD_POLL, .aio_fildes = fd }; > > struct iocb *cbp = &cb; > > > > sprintf(opts, "fd=%d,rootmode=040000,user_id=0,group_id=0", fd); > > mkdir("mnt", 0700); > > mount("foo", "mnt", "fuse", 0, opts); > > syscall(__NR_io_setup, 1, &ctx); > > syscall(__NR_io_submit, ctx, 1, &cbp); > > } > > > > Beginning of lockdep output: > > > > ===================================================== > > WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected > > 5.3.0-rc5 #9 Not tainted > > ----------------------------------------------------- > > syz_fuse/135 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: > > 000000003590ceda (&fiq->waitq){+.+.}, at: spin_lock include/linux/spinlock.h:338 [inline] > > 000000003590ceda (&fiq->waitq){+.+.}, at: aio_poll fs/aio.c:1751 [inline] > > 000000003590ceda (&fiq->waitq){+.+.}, at: __io_submit_one.constprop.0+0x203/0x5b0 fs/aio.c:1825 > > > > and this task is already holding: > > 0000000075037284 (&(&ctx->ctx_lock)->rlock){..-.}, at: spin_lock_irq include/linux/spinlock.h:363 [inline] > > 0000000075037284 (&(&ctx->ctx_lock)->rlock){..-.}, at: aio_poll fs/aio.c:1749 [inline] > > 0000000075037284 (&(&ctx->ctx_lock)->rlock){..-.}, at: __io_submit_one.constprop.0+0x1f4/0x5b0 fs/aio.c:1825 > > which would create a new lock dependency: > > (&(&ctx->ctx_lock)->rlock){..-.} -> (&fiq->waitq){+.+.} > > > > but this new dependency connects a SOFTIRQ-irq-safe lock: > > (&(&ctx->ctx_lock)->rlock){..-.} > > > > [...] > > > > Reported-by: syzbot+af05535bb79520f95431@syzkaller.appspotmail.com > > Reported-by: syzbot+d86c4426a01f60feddc7@syzkaller.appspotmail.com > > Fixes: bfe4037e722e ("aio: implement IOCB_CMD_POLL") > > Cc: # v4.19+ > > Cc: Christoph Hellwig > > Signed-off-by: Eric Biggers > > Signed-off-by: Miklos Szeredi > > There were some context changes mostly due to commit 217316a601016 ("fuse: > Optimize request_end() by not taking fiq->waitq.lock"). I've fixed it up > and queued on 4.14-4.4. It said it didn't need to go to anything older than 4.19, so I've dropped the 4.4.y, 4.9.y, and 4.14.y versions. thanks, greg k-h