linux-kernel - [PATCH] sh: fix mmap_sem deadlock in sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1413201552-2730-1-git-send-email-adami@cubiware.com>
Date:	Mon, 13 Oct 2014 13:59:12 +0200
From:	Adam Iwaniuk <adami@...iware.com>
To:	linux-sh@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, Adam Iwaniuk <adami@...iware.com>
Subject: [PATCH] sh: fix mmap_sem deadlock in sys_cacheflush

From: Adam Iwaniuk <adami@...iware.com>

We can't be holding the mmap_sem while calling __flush_XXX_region/flush_icache_range
because the flush can fault. If we fault on a user address, the page fault handler
will try to take mmap_sem again. Since both places acquire the read lock, most of the
time it succeeds. However, if another thread tries to acquire the write lock on the
mmap_sem (e.g. mmap) in between the call to __flush_XXX_region/flush_icache_range and
the fault, the down_read in do_page_fault will deadlock.

Signed-off-by: Adam Iwaniuk <adami@...iware.com>
---
 arch/sh/kernel/sys_sh.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sh/kernel/sys_sh.c b/arch/sh/kernel/sys_sh.c
index 8c6a350..4aa294c 100644
--- a/arch/sh/kernel/sys_sh.c
+++ b/arch/sh/kernel/sys_sh.c
@@ -74,6 +74,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, int op)
 		up_read(&current->mm->mmap_sem);
 		return -EFAULT;
 	}
+	up_read(&current->mm->mmap_sem);
 
 	switch (op & CACHEFLUSH_D_PURGE) {
 		case CACHEFLUSH_D_INVAL:
@@ -90,6 +91,5 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, int op)
 	if (op & CACHEFLUSH_I)
 		flush_icache_range(addr, addr+len);
 
-	up_read(&current->mm->mmap_sem);
 	return 0;
 }
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/