linux-kernel - Re: [syzbot] [fs?] INFO: trying to register non-static key in debugfs_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f2fefbfd-0ec9-4d4a-b065-bf68ad8e1641@I-love.SAKURA.ne.jp>
Date: Thu, 21 Dec 2023 22:52:20 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: syzbot <syzbot+fb20af23d0671a82c9a2@...kaller.appspotmail.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Johannes Berg <johannes.berg@...el.com>,
        syzkaller-bugs@...glegroups.com
Cc: linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        rafael@...nel.org
Subject: Re: [syzbot] [fs?] INFO: trying to register non-static key in
 debugfs_file_get

#syz fix: Revert "debugfs: annotate debugfs handlers vs. removal with lockdep"

By the way, use of cmpxchg() implies that this path might run in parallel?
If yes, I think you need to finish lockdep_init_map() before cmpxchg(), or
concurrently running threads might reach lock_map_acquire_read() before
lockdep_init_map() completes...

        d_fsd = READ_ONCE(dentry->d_fsdata);
        if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) {
                fsd = d_fsd;
        } else {
                fsd = kmalloc(sizeof(*fsd), GFP_KERNEL);
                if (!fsd)
                        return -ENOMEM;

                fsd->real_fops = (void *)((unsigned long)d_fsd &
                                        ~DEBUGFS_FSDATA_IS_REAL_FOPS_BIT);
                refcount_set(&fsd->active_users, 1);
                init_completion(&fsd->active_users_drained);
                if (cmpxchg(&dentry->d_fsdata, d_fsd, fsd) != d_fsd) {
                        kfree(fsd);
                        fsd = READ_ONCE(dentry->d_fsdata);
                }
+#ifdef CONFIG_LOCKDEP
+               fsd->lock_name = kasprintf(GFP_KERNEL, "debugfs:%pd", dentry);
+               lockdep_register_key(&fsd->key);
+               lockdep_init_map(&fsd->lockdep_map, fsd->lock_name ?: "debugfs",
+                                &fsd->key, 0);
+#endif
        }

        /*
         * In case of a successful cmpxchg() above, this check is
         * strictly necessary and must follow it, see the comment in
         * __debugfs_remove_file().
         * OTOH, if the cmpxchg() hasn't been executed or wasn't
         * successful, this serves the purpose of not starving
         * removers.
         */
        if (d_unlinked(dentry))
                return -EIO;

        if (!refcount_inc_not_zero(&fsd->active_users))
                return -EIO;

+       lock_map_acquire_read(&fsd->lockdep_map);


On 2023/12/21 22:35, syzbot wrote:
> HEAD commit:    b10a3ccaf6e3 Merge tag 'loongarch-fixes-6.7-2' of git://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1278f06ce80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=70dcde26e6b912e5
> dashboard link: https://syzkaller.appspot.com/bug?extid=fb20af23d0671a82c9a2
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40