linux-kernel - Re: [PATCH] devcoredump: Fix circular locking dependency with devcd->mutex.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f3398dd1-0d69-4db6-9bfc-ed3c6fe92ab5@lankhorst.se>
Date: Fri, 24 Oct 2025 12:27:33 +0200
From: Maarten Lankhorst <dev@...khorst.se>
To: Johannes Berg <johannes@...solutions.net>, linux-kernel@...r.kernel.org
Cc: intel-xe@...ts.freedesktop.org, Mukesh Ojha <quic_mojha@...cinc.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 "Rafael J. Wysocki" <rafael@...nel.org>, Danilo Krummrich <dakr@...nel.org>,
 stable@...r.kernel.org, Matthew Brost <matthew.brost@...el.com>
Subject: Re: [PATCH] devcoredump: Fix circular locking dependency with
 devcd->mutex.

Hey,

Den 2025-10-24 kl. 10:39, skrev Johannes Berg:
> On Fri, 2025-10-24 at 10:37 +0200, Maarten Lankhorst wrote:
>>>
>>> CPU 0				CPU 1
>>>
>>> dev_coredump_put()		devcd_del()
>>>  -> devcd_free()
>>>    -> locked
>>>      -> !deleted
>>>      -> __devcd_del()
>>> 				-> __devcd_del()
>>>
>>> no?
>>>
>>> johannes
>>
>>
>> Yeah don't you love the races in the design? All intricate and subtle.
> 
> :)
> 
>> In this case it's handled by disable_delayed_work_sync(),
>> which waits for devcd_del() to be completed. devcd_del is called from the workqueue,
>> and the first step devcd_free does is calling disable_delayed_work_sync, which means
>> devcd_del() either fully completed or was not run at all.
> 
> Oh... right, I totally missed the _sync. My bad, sorry.
> 
> I guess I really should say
> 
> Reviewed-by: Johannes Berg <johannes@...solutions.net>
> 
> since I finally _did_ review it carefully. Sorry it took forever.
> 
> johannes
No worries. It's an extremely tricky and prone to races part of code especially with the various ways a coredump can be destroyed.

I almost replied with another potential bug, calling read() after calling write(), but that's worked around by the reference
kept on the devcd device.

Kind regards,
~Maarten Lankhorst