linux-kernel - Re: next-20090220: XFS, IMA: BUG: sleeping function called from invalid context at mm/slub.c:1613

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1235168219.3019.4.camel@localhost.localdomain>
Date:	Fri, 20 Feb 2009 17:16:59 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Alexander Beregalov <a.beregalov@...il.com>,
	linux-kernel@...r.kernel.org, linux-next@...r.kernel.org,
	xfs@....sgi.com, James Morris <jmorris@...ei.org>
Subject: Re: next-20090220: XFS, IMA: BUG: sleeping function called from
	invalid  context at mm/slub.c:1613

On Fri, 2009-02-20 at 12:22 -0800, Andrew Morton wrote: 
> On Fri, 20 Feb 2009 14:00:21 +0300
> Alexander Beregalov <a.beregalov@...il.com> wrote:
> 
> > Hi
> > 
> > I have applied the following patch from Mimi Zohar
> > http://marc.info/?l=linux-next&m=123509665514552
> > 
> > That is why it is dirty.
> > The kernel can not boot without it when IMA is enabled.

With CONFIG_DEBUG_SG and IMA defined, it couldn't boot.

> > BUG: sleeping function called from invalid context at mm/slub.c:1613
> > in_atomic(): 1, irqs_disabled(): 0, pid: 1514, name: mkdir
> > 3 locks held by mkdir/1514:
> >  #0:  (&type->i_mutex_dir_key#2/1){+.+.+.}, at: [<ffffffff802d3460>]
> > lookup_create+0x30/0xd0
> >  #1:  (&(&ip->i_lock)->mr_lock/1){+.+.+.}, at: [<ffffffff803ca77f>]
> > xfs_ilock+0xdf/0x120
> >  #2:  (&pag->pag_ici_lock){++++.+}, at: [<ffffffff803caed6>]
> > xfs_iget+0x156/0x650
> > Pid: 1514, comm: mkdir Not tainted 2.6.29-rc5-next-20090220-dirty #1
> > Call Trace:
> >  [<ffffffff8026ad33>] ? __debug_show_held_locks+0x13/0x30
> >  [<ffffffff80234fe5>] __might_sleep+0x105/0x140
> >  [<ffffffff802c6191>] kmem_cache_alloc+0xd1/0x100
> >  [<ffffffff8045fb29>] ima_iint_insert+0x49/0xf0
> >  [<ffffffff8045fbed>] ima_inode_alloc+0x1d/0x30
> >  [<ffffffff802dfa5f>] inode_init_always+0xaf/0x250
> >  [<ffffffff803caf86>] xfs_iget+0x206/0x650
> >  [<ffffffff803eb8e8>] xfs_trans_iget+0x208/0x250
> >  [<ffffffff803ce571>] xfs_ialloc+0xc1/0x700
> >  [<ffffffff803ec6f9>] xfs_dir_ialloc+0xa9/0x340
> >  [<ffffffff8025e009>] ? down_write_nested+0x79/0x90
> >  [<ffffffff803ef0c1>] xfs_create+0x3e1/0x690
> >  [<ffffffff803fb813>] xfs_vn_mknod+0x63/0xf0
> >  [<ffffffff803fb8ae>] xfs_vn_mkdir+0xe/0x10
> >  [<ffffffff802d487c>] vfs_mkdir+0x8c/0xd0
> >  [<ffffffff802d6a56>] sys_mkdirat+0x106/0x120
> >  [<ffffffff8020bc0c>] ? sysret_check+0x27/0x62
> >  [<ffffffff8026c79d>] ? trace_hardirqs_on_caller+0x17d/0x1e0
> >  [<ffffffff802d6a83>] sys_mkdir+0x13/0x20
> >  [<ffffffff8020bbdb>] system_call_fastpath+0x16/0x1b
> > BUG: sleeping function called from invalid context at mm/slub.c:1613
> 
> Please do not be tempted to switch ima_iint_insert() to use GFP_ATOMIC
> to "fix" this.
> 
> Arguably, ima_iint_insert() should requite that the caller pass in the
> gfp_t rather than assuming that GFP_KERNEL can be used.  But that is
> not a suitable fix for this bug.
> 
> We may need to make that change to ima_iint_insert() anyway, as there's
> a good chance that callers will require GFP_NOFS.
> 
> 
> But to fix this bug, xfs needs to stop calling inode_init_always()
> under read_lock().  Because inode_alloc_security() also can sleep (see
> new_inode_smack()).
> 
> Also, ima_iint_insert() does a radix_tree_lookup() without holding
> ima_iint_lock, which appears to be a bug.

Thank you. For now, here's a patch to add locking around the
radix_tree_lookup(). I'll look into passing gfp_t.

Mimi

integrity: ima iint radix_tree_lookup locking fix

Based on Andrew Morton's comments:
- add missing locks around radix_tree_lookup in ima_iint_insert()

Signed-off-by: Mimi Zohar <zohar@...ibm.com>

Index: security-testing-2.6/security/integrity/ima/ima_iint.c
===================================================================
--- security-testing-2.6.orig/security/integrity/ima/ima_iint.c
+++ security-testing-2.6/security/integrity/ima/ima_iint.c
@@ -73,8 +73,10 @@ out:
 	if (rc < 0) {
 		kmem_cache_free(iint_cache, iint);
 		if (rc == -EEXIST) {
+			spin_lock(&ima_iint_lock);
 			iint = radix_tree_lookup(&ima_iint_store,
 						 (unsigned long)inode);
+			spin_unlock(&ima_iint_lock);
 		} else
 			iint = NULL;
 	}




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/