linux-kernel - Re: [BUG][2.6.38] IRQ Lock Inversion / i915 fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Mar 2011 16:05:26 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Takashi Iwai <tiwai@...e.de>,
	Knut Petersen <Knut_Petersen@...nline.de>,
	Jaroslav Kysela <perex@...ex.cz>,
	Chris Wilson <chris@...is-wilson.co.uk>,
	jesse.barnes@...el.com, gregkh@...e.de,
	linux-kernel@...r.kernel.org,
	David Müller <d.mueller@...oft.ch>
Subject: Re: [BUG][2.6.38] IRQ Lock Inversion / i915 fails

On Thu, Mar 17, 2011 at 10:33:04AM -0700, Linus Torvalds wrote:
> On Thu, Mar 17, 2011 at 10:15 AM, Takashi Iwai <tiwai@...e.de> wrote:
> >
> > The trigger callback should be called always in irq-disabled context,
> > so this should be OK.
> 
> Oh, ok. I missed the snd_pcm_action_lock_irq() thing disabling
> interrupts in that call sequence..
> 
> > But loopback_pos_update() is called in the
> > timer callback, and this can be the issue.
> 
> Hmm. If the timer callback is the only other case doing that, then
> that should be ok.
> 
> In fact, now that I look at that lockdep thing, I'm confused. Where
> does the hard irq come in at all for that lock? It seems to come from
> self_group.lock, but I don't see why/how they nest.

Here's the issue. It's quite subtle.


	CPU0			CPU1
	----			----
				spin_lock(cable->lock);
spin_lock(group->lock);
spin_lock(cable->lock);
	<blocked>
				<interrupt>
				spin_lock(group->lock);
				<deadlock>

If any lock is taken while holding a lock that can be used in interrupt
context, then that lock must also be protected from interrupts as well,
even if that lock has nothing to do with interrupts.

Lockdep reported that the cable->lock was held while holding the
substream->self_group->lock, and it looks like that substream->self_group->lock
can also be taken in interrupt context.

-- Steve

> 
> That said, the sound locking is odd, I'm sure you see it. But a
> commentary about how this came about in the changelog would be good.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/