linux-kernel - Re: [Bug #12606] fb_mmap: circular locking dependency on hibernation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 08 Feb 2009 23:00:17 +0100
From:	Andrea Righi <righi.andrea@...il.com>
To:	"Rafael J. Wysocki" <rjw@...k.pl>
CC:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Kernel Testers List <kernel-testers@...r.kernel.org>,
	Andrey Borzenkov <arvidjaar@...l.ru>
Subject: Re: [Bug #12606] fb_mmap: circular locking dependency on hibernation

On 2009-02-08 20:21, Rafael J. Wysocki wrote:
> This message has been generated automatically as a part of a report
> of recent regressions.
> 
> The following bug entry is on the current list of known regressions
> from 2.6.28.  Please verify if it still should be listed and let me know
> (either way).
> 
> 
> Bug-Entry	: http://bugzilla.kernel.org/show_bug.cgi?id=12606
> Subject		: fb_mmap: circular locking dependency on hibernation
> Submitter	: Andrey Borzenkov <arvidjaar@...l.ru>
> Date		: 2009-01-27 18:37 (13 days old)
> References	: http://marc.info/?l=linux-kernel&m=123308162731408&w=4
> Handled-By	: Andrea Righi <righi.andrea@...il.com>
> Patch		: http://marc.info/?l=linux-kernel&m=123365581406194&w=2

This is fixed by:

commit 1f5e31d7e55ac7fbd4ec5e5b20c8868b0e4564c9
Author: Andrea Righi <righi.andrea@...il.com>
Date:   Wed Feb 4 15:12:03 2009 -0800

    fbmem: don't call copy_from/to_user() with mutex held

    Avoid calling copy_from/to_user() with fb_info->lock mutex held in fbmem
    ioctl().

    fb_mmap() is called under mm->mmap_sem (A) held, that also acquires
    fb_info->lock (B); fb_ioctl() takes fb_info->lock (B) and does
    copy_from/to_user() that might acquire mm->mmap_sem (A), causing a
    deadlock.

    NOTE: it doesn't push down the fb_info->lock in each own driver's
    fb_ioctl(), so there are still potential deadlocks elsewhere.

    Signed-off-by: Andrea Righi <righi.andrea@...il.com>
    Cc: Dave Jones <davej@...hat.com>
    Cc: "Rafael J. Wysocki" <rjw@...k.pl>
    Cc: Johannes Weiner <hannes@...urebad.de>
    Cc: Krzysztof Helt <krzysztof.h1@...pl>
    Cc: Harvey Harrison <harvey.harrison@...il.com>
    Cc: Stefan Richter <stefanr@...6.in-berlin.de>
    Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/