linux-kernel - Re: [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 5 Jun 2017 10:39:37 +0200
From:   Richard Weinberger <richard@....at>
To:     Jia-Ju Bai <baijiaju1990@....com>, dedekind1@...il.com
Cc:     linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ubifs: Fix a sleep-in-atomic bug in ubifs_read_nnode

Am 05.06.2017 um 10:25 schrieb Richard Weinberger:
> Jia-Ju Bai,
> 
> Am 05.06.2017 um 05:38 schrieb Jia-Ju Bai:
>> The driver may sleep under a spin lock, and the function call path is:
>> ubifs_change_lp (acquire the lock by spin_lock)
>>   change_category
>>     ubifs_remove_from_cat
>>       remove_from_lpt_heap
>>         dbg_check_heap
>>           ubifs_lpt_lookup
>>             ubifs_read_nnode
>>               kzalloc(GFP_NOFS) --> may sleep
>>
>> To fix it, "GFP_NOFS" is replaced with "GFP_ATOMIC".
> 
> So, this happens only when dbg_check_heap() is activated, right?

Why do we call change_category() anyway with c->space_lock held?

Thanks,
//richard