linux-kernel - uio regression in 4.18-rc1 due to "uio: Prevent device destruction while fds are open"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5B2A7B73.5090000@redhat.com>
Date:   Wed, 20 Jun 2018 11:06:11 -0500
From:   Mike Christie <mchristi@...hat.com>
To:     hamish.martin@...iedtelesis.co.nz,
        chris.packham@...iedtelesis.co.nz,
        Greg KH <gregkh@...uxfoundation.org>,
        Linux Kernel List <linux-kernel@...r.kernel.org>
Subject: uio regression in 4.18-rc1 due to "uio: Prevent device destruction
 while fds are open"

Hi Hamish,

I am hitting a regression with your patch:

commit a93e7b331568227500186a465fee3c2cb5dffd1f
Author: Hamish Martin <hamish.martin@...iedtelesis.co.nz>
Date:   Mon May 14 13:32:23 2018 +1200

    uio: Prevent device destruction while fds are open

The problem is the addition of spin_lock_irqsave in uio_write. This
leads to hitting  uio_write -> copy_from_user -> _copy_from_user ->
might_fault and the logs filling up with sleeping warnings.

I also noticed some uio drivers allocate memory, sleep, grab mutexes
from callouts like open() and release and uio is now doing
spin_lock_irqsave while calling them.

Note target_core_user's irqcontrol looks buggy and was just doing more
work than it should in that callout. I can fix that driver.