linux-kernel - Re: 2.6.23-rc2-mm1: sleeping function called from invalid context at kernel/mutex.c:86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 11 Aug 2007 11:24:22 +0400
From:	Alexey Dobriyan <adobriyan@...il.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Mariusz Kozlowski <m.kozlowski@...land.pl>,
	josh@...edesktop.org, linux-kernel@...r.kernel.org,
	"Randy.Dunlap" <rdunlap@...otime.net>
Subject: Re: 2.6.23-rc2-mm1: sleeping function called from invalid context at kernel/mutex.c:86

On Fri, Aug 10, 2007 at 12:55:17AM -0700, Andrew Morton wrote:
> On Fri, 10 Aug 2007 09:40:00 +0200 Ingo Molnar <mingo@...e.hu> wrote:
> 
> > 
> > * Andrew Morton <akpm@...ux-foundation.org> wrote:
> > 
> > > We seem to have made a mess in there.  timer_list_show() ends up 
> > > calling lookup_module_symbol_name(), which takes a mutex.  However 
> > > print_symbol() (which is called at oops time, interrupt time, etc) 
> > > calls module_address_lookup(), which is basically the same, only it 
> > > doesn't take the mutex.
> > 
> > hm, current upstream does:
> > 
> >  static void print_name_offset(struct seq_file *m, void *sym)
> >  {
> >          char symname[KSYM_NAME_LEN];
> > 
> >          if (lookup_symbol_name((unsigned long)sym, symname) < 0)
> > 
> > why was that changed?
> 
> It wasn't.

Oh no, it was! commit 9d65cb4a1718a072898c7a57a3bc61b2dc4bcd4d

	Fix race between cat /proc/*/wchan and rmmod et al

	kallsyms_lookup() can go iterating over modules list unprotected which is OK
	for emergency situations (oops), but not OK for regular stuff like
	/proc/*/wchan.

> lookup_symbol_name() calls lookup_module_symbol_name() which
> calls mutex_lock().
> 
> > I think symbol lookups for debug purposes have to 
> > be lockless, fundamentally.
> > 
> 
> Sure, especially a sysrq thingy.

I imagine user running powertop which IIRC trolls /proc/timer_list and
doing rmmod following powertop instructions.

> It's a bit nasty to just go in there and start walking data structures
> without holding the needed lock though.

Yep.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/