linux-kernel - Re: possible deadlock in rds_wake_sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 7 Aug 2018 17:07:54 -0400
From:   Sowmini Varadhan <sowmini.varadhan@...cle.com>
To:     syzbot <syzbot+52140d69ac6dc6b927a9@...kaller.appspotmail.com>
Cc:     davem@...emloft.net, linux-kernel@...r.kernel.org,
        linux-rdma@...r.kernel.org, netdev@...r.kernel.org,
        rds-devel@....oracle.com, santosh.shilimkar@...cle.com,
        syzkaller-bugs@...glegroups.com
Subject: Re: possible deadlock in rds_wake_sk_sleep

On (08/07/18 13:47), syzbot wrote:
>  Possible unsafe locking scenario:
> 
>        CPU0                    CPU1
>        ----                    ----
>   lock(&(&rm->m_rs_lock)->rlock);
>                                lock(&rs->rs_recv_lock);
>                                lock(&(&rm->m_rs_lock)->rlock);
>   lock(&rs->rs_recv_lock);
> 
>  *** DEADLOCK ***

looks like a valid find, I think the deadlock should be avoided
by having rds_clear_recv_queue do something like

 get rs_recv_lock
 un-tether the rs_recv_queue into a temporary list 
 releease rs_recv_lock
 purge the rds_incoming  temporary list

I can give this a shot later this week.

--Sowmini