linux-kernel - Re: [lockdep] b09be676e0 BUG: unable to handle kernel NULL pointer dereference at 000001f2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Oct 2017 11:38:34 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Byungchul Park <byungchul.park@....com>,
        Fengguang Wu <fengguang.wu@...el.com>,
        Ingo Molnar <mingo@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        LKP <lkp@...org>, Josh Poimboeuf <jpoimboe@...hat.com>,
        kernel-team@....com
Subject: Re: [lockdep] b09be676e0 BUG: unable to handle kernel NULL pointer
 dereference at 000001f2

On Tue, Oct 10, 2017 at 11:14 AM, Peter Zijlstra <peterz@...radead.org> wrote:
>
> Ah, but that's not at all what cross-release is about. Nobody really
> does wonky ownership transfer of mutexes like that (although there might
> be someone doing something with semaphores, I didn't check). Its to
> allow detecting this deadlock:
>
>         mutex_lock(&lock)
>         wait_for_completion(&c);
>                                         mutex_lock(&lock);
>                                         complete(&c);
>
> The completion doesn't have an owner to transfer.

Well, it really does. The "init_completion()" would be the original
owner (essentially the same as a "lock()"), then it has a transfer,
and then a receive, and then "complete()" is basically the unlock
elsewhere.

Of course, right now that transfer and receive is entirely implicit,
so you don't really see it anywhere. And for completions, the whole
_point_ is that transfer, so ..

The "wait_for_completion()" is then a normal lock operation (no
transfer there - it's just trying to get the lock again).

                Linus