linux-kernel - Re: + ipc-convert-ipcs_idr-to-xarray-update.patch added to -mm tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200605195848.GB5393@lca.pw>
Date:   Fri, 5 Jun 2020 15:58:48 -0400
From:   Qian Cai <cai@....pw>
To:     linux-kernel@...r.kernel.org
Cc:     dave@...olabs.net, manfred@...orfullife.com,
        mm-commits@...r.kernel.org, willy@...radead.org,
        akpm@...ux-foundation.org
Subject: Re: + ipc-convert-ipcs_idr-to-xarray-update.patch added to -mm tree

On Thu, Apr 23, 2020 at 06:47:53PM -0700, Andrew Morton wrote:
> ------------------------------------------------------
> From: "Matthew Wilcox (Oracle)" <willy@...radead.org>
> Subject: ipc-convert-ipcs_idr-to-xarray-update
> 
> implemant change suggested by Manfred
> 
> Link: http://lkml.kernel.org/r/20200421183342.GQ5820@bombadil.infradead.org
> Signed-off-by: Matthew Wilcox <willy@...radead.org>
> Cc: Manfred Spraul <manfred@...orfullife.com>
> Cc: Davidlohr Bueso <dave@...olabs.net>
> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
> ---
> 
>  include/linux/xarray.h |    1 
>  ipc/util.c             |   52 +++++++++++++++------------------------
>  lib/xarray.c           |    2 -
>  3 files changed, 21 insertions(+), 34 deletions(-)
> 
[]
> --- a/ipc/util.c~ipc-convert-ipcs_idr-to-xarray-update
> +++ a/ipc/util.c
> @@ -210,52 +210,40 @@ static inline int ipc_id_alloc(struct ip
>  	int err;
>  
>  	if (get_restore_id(ids) < 0) {
> -		XA_STATE(xas, &ids->ipcs, 0);
> -		int min_idx, max_idx;
> +		int max_idx;
>  
>  		max_idx = max(ids->in_use*3/2, ipc_min_cycle);
>  		max_idx = min(max_idx, ipc_mni) - 1;
>  
> -		xas_lock(&xas);
> +		xa_lock(&ids->ipcs);
>  
> -		min_idx = ids->next_idx;
> -		new->seq = ids->seq;
> +		err = __xa_alloc_cyclic(&ids->ipcs, &idx, NULL,
> +				XA_LIMIT(0, max_idx), &ids->next_idx,
> +				GFP_KERNEL);

This will trigger,

[ 8853.759549] LTP: starting semget05
[ 8867.257088] BUG: sleeping function called from invalid context at mm/slab.h:567
[ 8867.270259] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 22556, name: semget05
[ 8867.270309] 2 locks held by semget05/22556:
[ 8867.270345]  #0: 00000000512de7e0 (&ids->rwsem){++++}-{3:3}, at: ipcget+0x4e/0x230
[ 8867.270426]  #1: 00000000552b9018 (&new->lock){+.+.}-{2:2}, at: ipc_addid+0xf4/0xf50
[ 8867.270495] CPU: 0 PID: 22556 Comm: semget05 Not tainted 5.7.0-next-20200605 #4
[ 8867.270531] Hardware name: IBM 2964 N96 400 (z/VM 6.4.0)
[ 8867.270565] Call Trace:
[ 8867.270606]  [<000000004ff1ee2a>] show_stack+0x11a/0x1c8
[ 8867.270649]  [<00000000505a751c>] dump_stack+0x134/0x180
[ 8867.270692]  [<000000004ffba20e>] ___might_sleep+0x3d6/0x400
[ 8867.270732]  [<0000000050332ad8>] kmem_cache_alloc+0x2b0/0x560
[ 8867.270772]  [<00000000505c6efa>] __xas_nomem+0x10a/0x278
[ 8867.270810]  [<00000000505cc408>] __xa_alloc+0x168/0x220
[ 8867.270848]  [<00000000505cc5b0>] __xa_alloc_cyclic+0xf0/0x208
__xa_alloc_cyclic at lib/xarray.c:1698
[ 8867.270885]  [<00000000504d9b9a>] ipc_addid+0x412/0xf50
ipc_id_alloc at ipc/util.c: 293
[ 8867.272003]  [<00000000504e1cf6>] newary+0x246/0x3a0
newary at ipc/sem.c:570
[ 8867.272041]  [<00000000504dc030>] ipcget+0x68/0x230
ipcget_new at ipc/util.c:347
(inlined by) ipcget at ipc/util.c:646
[ 8867.272079]  [<00000000504e6308>] ksys_semget+0xf8/0x118
[ 8867.273237]  [<00000000504eb5bc>] ksys_ipc+0x134/0x310
[ 8867.273276]  [<000000004ff08f64>] __s390x_sys_s390_ipc+0x3c/0x50
[ 8867.273321]  [<00000000509063c4>] system_call+0xdc/0x29c
[ 8867.273355] 2 locks held by semget05/22556:
[ 8867.273387]  #0: 00000000512de7e0 (&ids->rwsem){++++}-{3:3}, at: ipcget+0x4e/0x230
[ 8867.275205]  #1: 00000000552b9018 (&new->lock){+.+.}-{2:2}, at: ipc_addid+0xf4/0xf50