linux-kernel - Re: namespace: deadlock in dec_pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 23 Jan 2017 10:35:56 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Nikolay Borisov <n.borisov.lkml@...il.com>,
        avagin <avagin@...nvz.org>, serge@...lyn.com,
        Kees Cook <keescook@...omium.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: namespace: deadlock in dec_pid_namespaces

On Sat, Jan 21, 2017 at 1:28 AM, Eric W. Biederman
<ebiederm@...ssion.com> wrote:
> Nikolay Borisov <n.borisov.lkml@...il.com> writes:
>
>> On 20.01.2017 20:05, Eric W. Biederman wrote:
>>> Nikolay Borisov <n.borisov.lkml@...il.com> writes:
>>>
>>>> On 20.01.2017 15:07, Dmitry Vyukov wrote:
>>>>> Hello,
>>>>>
>>>>> I've got the following deadlock report while running syzkaller fuzzer
>>>>> on eec0d3d065bfcdf9cd5f56dd2a36b94d12d32297 of linux-next (on odroid
>>>>> device if it matters):
>>>
>>> I am puzzled I thought we had fixed this with:
>>>   add7c65ca426 ("pid: fix lockdep deadlock warning due to ucount_lock")
>>> But apparently not.  We  just moved it from hardirq to softirq context.  Bah.
>>>
>>> Thank you very much for the report.
>>>
>>> Nikolay can you make your change use spinlock_irq?  And have put_ucounts
>>> do spin_lock_irqsave?  That way we just don't care where we call this.
>>
>> Like the one attached?
>
> Exactly thank you.  Dmitry if you have time to test that patch and
> verify it fixes your issue I would appreciate it.
>
>> I haven't really taken careful look as to whether
>> the function where _irq versions do fiddle with irq state, since this
>> might cause a problem if we unconditionally enable them.
>
> In code paths where we can sleep irqs must come in enabled or it's a
> bug.
>
> spin_lock_irq which unconditionally disables irqs is thus safe on the
> allocation path.
>
> Similary spin_unlock_irq which unconditionally enables irqs is also safe
> on the allocation path.

Yes, it fixes the issue for me:

Tested-by: Dmitry Vyukov <dvyukov@...gle.com>