linux-kernel - Re: deadlock between &type->i_mutex_dir_key#4 and &xfs_dir_ilock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20150330194016.GC28621@dastard>
Date:	Tue, 31 Mar 2015 06:40:16 +1100
From:	Dave Chinner <david@...morbit.com>
To:	Daniel Wagner <wagi@...om.org>
Cc:	xfs@....sgi.com,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: deadlock between &type->i_mutex_dir_key#4 and
 &xfs_dir_ilock_class

On Mon, Mar 30, 2015 at 09:29:14AM +0200, Daniel Wagner wrote:
> Hi,
> 
> Just my test box booted 4.0.0-rc6 and I was greeted by:
> 
> 
> [Mar30 10:10] ======================================================
> [  +0.000043] [ INFO: possible circular locking dependency detected ]
> [  +0.000045] 4.0.0-rc6 #32 Not tainted
> [  +0.000027] -------------------------------------------------------
> [  +0.000042] ls/1709 is trying to acquire lock:
> [  +0.000034]  (&mm->mmap_sem){++++++}, at: [<ffffffff811e62cf>] might_fault+0x5f/0xb0
> [  +0.000083] 
> but task is already holding lock:
> [  +0.000043]  (&xfs_dir_ilock_class){.+.+..}, at: [<ffffffffa0424902>] xfs_ilock+0xc2/0x130 [xfs]
> [  +0.000110] 
> which lock already depends on the new lock.

No deadlock. Problem is the shmem code, which is doing inode
instantiation under the mmap_sem, thereby inverting the entire vfs
locking order w.r.t. to the mmap_sem....

i.e. this one:

> -> #1 (&isec->lock){+.+.+.}:
> [  +0.000045]        [<ffffffff810ef987>] lock_acquire+0xc7/0x160
> [  +0.000045]        [<ffffffff817e273d>] mutex_lock_nested+0x7d/0x450
> [  +0.000045]        [<ffffffff8135a755>] inode_doinit_with_dentry+0xc5/0x6a0
> [  +0.000050]        [<ffffffff8135b91c>] selinux_d_instantiate+0x1c/0x20
> [  +0.001072]        [<ffffffff8134ef9b>] security_d_instantiate+0x1b/0x30
> [  +0.001056]        [<ffffffff81255454>] d_instantiate+0x54/0x80
> [  +0.001052]        [<ffffffff811d24bc>] __shmem_file_setup+0xdc/0x250
> [  +0.001059]        [<ffffffff811d5fd8>] shmem_zero_setup+0x28/0x70
> [  +0.001074]        [<ffffffff811f2168>] mmap_region+0x5d8/0x5f0
> [  +0.001045]        [<ffffffff811f249b>] do_mmap_pgoff+0x31b/0x400
> [  +0.001040]        [<ffffffff811d6540>] vm_mmap_pgoff+0xb0/0xf0
> [  +0.001015]        [<ffffffff811f07e6>] SyS_mmap_pgoff+0x116/0x2b0
> [  +0.001009]        [<ffffffff8101bc12>] SyS_mmap+0x22/0x30
> [  +0.001000]        [<ffffffff817e7589>] system_call_fastpath+0x12/0x17

vm_mmap_pgoff() takes the mmap_sem.

> I tried to find out if this was reported before but I
> haven't found anything. If I missed it I am sorry for the noise.

It's been reported so many times I need a FAQ entry for it. problem
is, i can't fix it easily because it's a shmem bug...

Cheers,

Dave.
-- 
Dave Chinner
david@...morbit.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/