linux-kernel - Re: drm_vm.c:drm_mmap: possible circular locking dependency detected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Jan 2010 13:12:33 -0800
From:	Dmitry Torokhov <dmitry.torokhov@...il.com>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	Tejun Heo <tj@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
	Borislav Petkov <petkovbb@...glemail.com>,
	David Airlie <airlied@...ux.ie>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <greg@...ah.com>, Al Viro <viro@...IV.linux.org.uk>
Subject: Re: drm_vm.c:drm_mmap: possible circular locking dependency detected

On Mon, Jan 04, 2010 at 11:43:10AM -0800, Eric W. Biederman wrote:
> Dmitry Torokhov <dmitry.torokhov@...il.com> writes:
> 
> > On Sun, Jan 03, 2010 at 02:57:15AM -0800, Eric W. Biederman wrote:
> >> Dmitry Torokhov <dmitry.torokhov@...il.com> writes:
> >> 
> >> >
> >> > Overall I am not concerned about lockdep bitching about serio because it
> >> > still bitches if you simply reload psmouse on a box with Synaptics with a
> >> > pass-through port even though there are nested annotations and it is
> >> > silent first time around.
> >> 
> >> This is a new lockdep annotation, and looking into it this appears to
> >> be a true possible deadlock in the serio/sysfs interactions.
> >> 
> >> We have serio_pin_driver() called from all of the sysfs attributes
> >> which does:
> >>    mutex_lock(&serio->drv_mutex);
> >> 
> >> We have serio_disconnect_driver() called on an unplug which does:
> >>    mutex_lock(&serio->drv_mutex);
> >> 
> >> The deadlock potential is if someone reads say the psmouse rate
> >> sysfs file while the mouse is being unplugged.  There is a race
> >> such that we can have:
> >> 
> >> 						  sysfs_read_file()
> >>                                                     fill_read_buffer()
> >> 						       sysfs_get_active_two()
> >> 							 psmouse_attr_show_helper()
> >>                                         		   serio_pin_driver()
> >> serio_disconnect_driver()		
> >>   mutex_lock(&serio->drv_mutex);		
> >> 				<----------------->	   mutex_lock(&serio_drv_mutex);
> >>     psmouse_disconnect()
> >>       sysfs_remove_group(... psmouse_attr_group);
> >> 	....
> >> 	sysfs_deactivate(); 
> >> 	  wait_for_completion();
> >> 
> >> 
> >> So it is unlikely but possible to deadlock by accessing a serio
> >> attribute of a serio device that is being removed.
> >
> > Hmm, I guess I was too quick dismissing lockdep complaints here. Now
> > that sysfs remove waits deadlock indeed is possible. Actually the locks
> > on serio->drv_mutex in attributes were added to make sure we don't
> > access device that was unbound from the driver through stale sysfs
> > attributes.
> 
> Cool.  So we have solved the problem generically but we have left over
> layer specific solutions.  That seems like a good problem to have.
> 
> >> What to do about it is another question.
> >
> > I think we should simply not take serio->drv_mutex in attributes and use
> > driver-private mutex to serialize "set" methods that may alter device
> > state.
> 
> Do you have any ideas what those might be?  It looks like we are only
> talking about psmouse and atkbd.  So the audit for this chunk should
> not be too bad.

Right, only these 2.

> 
> The psmouse code already has a mutex on it's set operations only the
> atkbd does not.  The atkbd code does do a driver stop/start, which is
> similar (but race prone without the serio->drv_mutex).
> 
> Except for the lack of atkbd_enable/disable locking the patch below should
> be good.  Opinions from someone who knows the serio code better than I do
> would be helpful.

Thanks Eric, this looks good. I'll add the missing mutex to atkbd and
apply. I think it can wait for .34 though - the window is quite small.

-- 
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/