linux-kernel - Re: INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected for kmemleak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1251891877.28251.12.camel@pc1117.cambridge.arm.com>
Date:	Wed, 02 Sep 2009 12:44:37 +0100
From:	Catalin Marinas <catalin.marinas@....com>
To:	Eric Paris <eparis@...hat.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected for
	kmemleak_lock

On Wed, 2009-09-02 at 11:54 +0100, Catalin Marinas wrote:
> On Tue, 2009-09-01 at 16:55 -0400, Eric Paris wrote:
> > I wrote a multithreaded inotify syscall pounder intended to create
> > files, destroy files, create watches, and destroy watches with the
> > maximum number of races possible.  Instead after letting it run a while
> > I came upon this!  And then my system started to crash in all sorts of
> > fun and glorious ways (kmem_cache_alloc bugs/panics/whatever)
> > 
> > -Eric
> > 
> > [ 2235.913737] ======================================================
> > [ 2235.914084] [ INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected ]
> > [ 2235.914084] 2.6.31-rc8-next-20090901 #64
> > [ 2235.914084] ------------------------------------------------------
> > [ 2235.914084] syscall_thrash/2516 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
> > [ 2235.914084]  (kthread_create_lock){+.+...}, at: [<ffffffff81091543>] kthread_create+0x73/0x180
> > [ 2235.914084] 
> > [ 2235.914084] and this task is already holding:
> > [ 2235.914084]  (kmemleak_lock){..----}, at: [<ffffffff81152611>] create_object+0x161/0x2e0
> > [ 2235.914084] which would create a new lock dependency:
> > [ 2235.914084]  (kmemleak_lock){..----} -> (kthread_create_lock){+.+...}
> 
> Are there other messages from kmemleak printed before that? It looks to
> me like kmemleak got an exceptional situation (not being able to
> allocate memory or inserting a pointer into the prio search tree) and it
> disabled itself. When disabling, it starts a clean-up thread and AFAICT
> that's the only condition when kmemleak_lock -> kthread_create_lock
> dependency would be created.
> 
> I'm not sure whether disabling interrupts around kthread_run in
> kmemleak_cleanup() would solve the problem. Otherwise, maybe the
> kmemleak clean-up thread should take a different form or just a thread
> waiting for a clean-up event (it currently acquires a mutex and cannot
> be used in interrupt context).

It looks like the kthread_create_lock cannot be acquired in interrupt
context anyway, so the patch below changes this to a workqueue.


kmemleak: Do no create the clean-up thread during kmemleak_disable()

From: Catalin Marinas <catalin.marinas@....com>

The kmemleak_disable() function could be called from various contexts
including IRQ. It creates a clean-up thread but the kthread_create()
function has restrictions on which contexts it can be called from,
mainly because of the kthread_create_lock. The patch changes the
kmemleak clean-up thread to a workqueue.

Signed-off-by: Catalin Marinas <catalin.marinas@....com>
Reported-by: Eric Paris <eparis@...hat.com>
---
 mm/kmemleak.c |   22 +++++-----------------
 1 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 401a89a..b336201 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -92,6 +92,7 @@
 #include <linux/string.h>
 #include <linux/nodemask.h>
 #include <linux/mm.h>
+#include <linux/workqueue.h>
 
 #include <asm/sections.h>
 #include <asm/processor.h>
@@ -1477,7 +1478,7 @@ static const struct file_operations kmemleak_fops = {
  * Perform the freeing of the kmemleak internal objects after waiting for any
  * current memory scan to complete.
  */
-static int kmemleak_cleanup_thread(void *arg)
+static void kmemleak_do_cleanup(struct work_struct *work)
 {
 	struct kmemleak_object *object;
 
@@ -1489,22 +1490,9 @@ static int kmemleak_cleanup_thread(void *arg)
 		delete_object_full(object->pointer);
 	rcu_read_unlock();
 	mutex_unlock(&scan_mutex);
-
-	return 0;
 }
 
-/*
- * Start the clean-up thread.
- */
-static void kmemleak_cleanup(void)
-{
-	struct task_struct *cleanup_thread;
-
-	cleanup_thread = kthread_run(kmemleak_cleanup_thread, NULL,
-				     "kmemleak-clean");
-	if (IS_ERR(cleanup_thread))
-		pr_warning("Failed to create the clean-up thread\n");
-}
+static DECLARE_WORK(cleanup_work, kmemleak_do_cleanup);
 
 /*
  * Disable kmemleak. No memory allocation/freeing will be traced once this
@@ -1522,7 +1510,7 @@ static void kmemleak_disable(void)
 
 	/* check whether it is too early for a kernel thread */
 	if (atomic_read(&kmemleak_initialized))
-		kmemleak_cleanup();
+		schedule_work(&cleanup_work);
 
 	pr_info("Kernel memory leak detector disabled\n");
 }
@@ -1618,7 +1606,7 @@ static int __init kmemleak_late_init(void)
 		 * after setting kmemleak_initialized and we may end up with
 		 * two clean-up threads but serialized by scan_mutex.
 		 */
-		kmemleak_cleanup();
+		schedule_work(&cleanup_work);
 		return -ENOMEM;
 	}
 


-- 
Catalin

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/