linux-kernel - Possible BT deadlock due to recursive read locking (Was: Re: kernel BUG at kernel/locking/rtmutex.c:1059)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 31 Aug 2017 16:52:12 +0200
From:   Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To:     Mart van de Wege <mvdwege@...il.com>,
        Marcel Holtmann <marcel@...tmann.org>,
        Johan Hedberg <johan.hedberg@...el.com>,
        Gustavo Padovan <gustavo@...ovan.org>,
        linux-bluetooth@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     linux-rt-users@...r.kernel.org, tglx@...utronix.de,
        Peter Zijlstra <peterz@...radead.org>
Subject: Possible BT deadlock due to recursive read locking (Was: Re: kernel
 BUG at kernel/locking/rtmutex.c:1059)

On 2017-08-30 23:25:53 [+0200], Mart van de Wege wrote:
> Hi,
Hi,

> The issue persists up to v4.11.12-rt10
Does
	CONFIG_RWLOCK_RT_READER_BIASED=y
make it go away?

> Stacktrace:
> 
> Aug 29 17:28:04 localhost kernel: [   46.483810] ------------[ cut here ]------------
> Aug 29 17:28:04 localhost kernel: [   46.483812] kernel BUG at kernel/locking/rtmutex.c:1059!

this is a deadlock on RT however !RT has a hidden problem which not
yelled at by lockdep. We have the following call path:

| hci_send_monitor_ctrl_event()
|   read_lock(&hci_sk_list.lock);
|
|   hci_send_to_channel()
|      read_lock(&hci_sk_list.lock);

So both functions acquire the same read_lock. If a write comes along
between the first read_lock() and second read_lock() then we have a
deadlock because the write_lock() will lock down further readers from
acquiring the read-lock until the writer completed its task.

This recursive locking was introduced in 38ceaa00d02d ("Bluetooth: Add
support for sending MGMT commands and events to monitor").

Sebastian