linux-kernel - [RFC PATCH 1/3] regulator: allocate memory outside of regulator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 10 Aug 2020 22:09:21 +0200
From:   Michał Mirosław <mirq-linux@...e.qmqm.pl>
To:     Dmitry Osipenko <digetx@...il.com>
Cc:     Mark Brown <broonie@...nel.org>,
        Liam Girdwood <lgirdwood@...il.com>,
        linux-kernel@...r.kernel.org
Subject: [RFC PATCH 1/3] regulator: allocate memory outside of regulator_list
 mutex

Allocating memory with regulator_list_mutex held makes lockdep unhappy
when memory pressure makes the system do fs_reclaim on eg. eMMC using
a regulator. Push the lock inside regulator_init_coupling() after the
allocation.

======================================================
WARNING: possible circular locking dependency detected
5.7.13+ #533 Not tainted
------------------------------------------------------
kswapd0/383 is trying to acquire lock:
cca78ca4 (&sbi->write_io[i][j].io_rwsem){++++}-{3:3}, at: __submit_merged_write_cond+0x104/0x154
but task is already holding lock:
c0e38518 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x50
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (fs_reclaim){+.+.}-{0:0}:
       fs_reclaim_acquire.part.11+0x40/0x50
       fs_reclaim_acquire+0x24/0x28
       __kmalloc+0x54/0x218
       regulator_register+0x860/0x1584
       dummy_regulator_probe+0x60/0xa8
[...]
other info that might help us debug this:

Chain exists of:
  &sbi->write_io[i][j].io_rwsem --> regulator_list_mutex --> fs_reclaim

Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(fs_reclaim);
                               lock(regulator_list_mutex);
                               lock(fs_reclaim);
  lock(&sbi->write_io[i][j].io_rwsem);
 *** DEADLOCK ***

1 lock held by kswapd0/383:
 #0: c0e38518 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x50
[...]

Fixes: d8ca7d184b33 ("regulator: core: Introduce API for regulators coupling customization")
Signed-off-by: Michał Mirosław <mirq-linux@...e.qmqm.pl>
---
 drivers/regulator/core.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 2ee109950352..915a727d8fc7 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -4900,7 +4900,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
 static int regulator_init_coupling(struct regulator_dev *rdev)
 {
 	struct regulator_dev **coupled;
-	int err, n_phandles;
+	int err = 0, n_phandles;
 
 	if (!IS_ENABLED(CONFIG_OF))
 		n_phandles = 0;
@@ -4911,6 +4911,7 @@ static int regulator_init_coupling(struct regulator_dev *rdev)
 	if (!coupled)
 		return -ENOMEM;
 
+	mutex_lock(&regulator_list_mutex);
 	rdev->coupling_desc.coupled_rdevs = coupled;
 
 	/*
@@ -4923,19 +4924,21 @@ static int regulator_init_coupling(struct regulator_dev *rdev)
 
 	/* regulator isn't coupled */
 	if (n_phandles == 0)
-		return 0;
+		goto out;
 
-	if (!of_check_coupling_data(rdev))
-		return -EPERM;
+	if (!of_check_coupling_data(rdev)) {
+		err = -EPERM;
+		goto out;
+	}
 
 	rdev->coupling_desc.coupler = regulator_find_coupler(rdev);
 	if (IS_ERR(rdev->coupling_desc.coupler)) {
 		err = PTR_ERR(rdev->coupling_desc.coupler);
 		rdev_err(rdev, "failed to get coupler: %d\n", err);
-		return err;
 	}
-
-	return 0;
+out:
+	mutex_unlock(&regulator_list_mutex);
+	return err;
 }
 
 static int generic_coupler_attach(struct regulator_coupler *coupler,
@@ -5135,9 +5138,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
 	if (ret < 0)
 		goto wash;
 
-	mutex_lock(&regulator_list_mutex);
 	ret = regulator_init_coupling(rdev);
-	mutex_unlock(&regulator_list_mutex);
 	if (ret < 0)
 		goto wash;
 
-- 
2.20.1