lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Wed, 31 May 2017 16:13:11 +0800
From:   Jia-Ju Bai <baijiaju1990@....com>
To:     oleg.drokin@...el.com, andreas.dilger@...el.com,
        jsimmons@...radead.org, gregkh@...uxfoundation.org,
        bobijam.xu@...el.com, dmitry.eremin@...el.com
Cc:     lustre-devel@...ts.lustre.org, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, Jia-Ju Bai <baijiaju1990@....com>
Subject: [PATCH] libcfs: Fix a sleep-in-atomic bug in cfs_wi_scheduler

The driver may sleep under a spin lock, and the function call path is:
cfs_wi_scheduler (acquire the lock by spin_lock)
  LASSERT
    lbug_with_loc
      libcfs_debug_dumplog
        schedule and kthread_run --> may sleep

To fix it, all "LASSERT" is placed out of the spin_lock and spin_unlock.

Signed-off-by: Jia-Ju Bai <baijiaju1990@....com>
---
 drivers/staging/lustre/lnet/libcfs/workitem.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/lustre/lnet/libcfs/workitem.c b/drivers/staging/lustre/lnet/libcfs/workitem.c
index dbc2a9b..9f7832e 100644
--- a/drivers/staging/lustre/lnet/libcfs/workitem.c
+++ b/drivers/staging/lustre/lnet/libcfs/workitem.c
@@ -212,9 +212,9 @@ static int cfs_wi_scheduler(void *arg)
 			CWARN("Unable to bind %s on CPU partition %d\n",
 			      sched->ws_name, sched->ws_cpt);
 
+	LASSERT(sched->ws_starting == 1);
 	spin_lock(&cfs_wi_data.wi_glock);
 
-	LASSERT(sched->ws_starting == 1);
 	sched->ws_starting--;
 	sched->ws_nthreads++;
 
@@ -231,11 +231,14 @@ static int cfs_wi_scheduler(void *arg)
 		       nloops < CFS_WI_RESCHED) {
 			wi = list_entry(sched->ws_runq.next,
 					struct cfs_workitem, wi_list);
+
+			spin_unlock(&sched->ws_lock);
 			LASSERT(wi->wi_scheduled && !wi->wi_running);
+			LASSERT(sched->ws_nscheduled > 0);
+			spin_lock(&sched->ws_lock);
 
 			list_del_init(&wi->wi_list);
 
-			LASSERT(sched->ws_nscheduled > 0);
 			sched->ws_nscheduled--;
 
 			wi->wi_running = 1;
@@ -254,7 +257,10 @@ static int cfs_wi_scheduler(void *arg)
 			if (list_empty(&wi->wi_list))
 				continue;
 
+			spin_unlock(&sched->ws_lock);
 			LASSERT(wi->wi_scheduled);
+			spin_lock(&sched->ws_lock);
+
 			/* wi is rescheduled, should be on rerunq now, we
 			 * move it to runq so it can run action now
 			 */
-- 
1.7.9.5


Powered by blists - more mailing lists