From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY, USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEEBDC2BA2B for ; Fri, 17 Apr 2020 03:00:16 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 5E86D21D94 for ; Fri, 17 Apr 2020 03:00:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5E86D21D94 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id BA8578E0003; Thu, 16 Apr 2020 23:00:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B59BD8E0001; Thu, 16 Apr 2020 23:00:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A6F6C8E0003; Thu, 16 Apr 2020 23:00:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0197.hostedemail.com [216.40.44.197]) by kanga.kvack.org (Postfix) with ESMTP id 889FA8E0001 for ; Thu, 16 Apr 2020 23:00:15 -0400 (EDT) Received: from smtpin12.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 453AC8245571 for ; Fri, 17 Apr 2020 03:00:15 +0000 (UTC) X-FDA: 76715843190.12.print03_3c4bebc36680c X-HE-Tag: print03_3c4bebc36680c X-Filterd-Recvd-Size: 4218 Received: from out30-57.freemail.mail.aliyun.com (out30-57.freemail.mail.aliyun.com [115.124.30.57]) by imf21.hostedemail.com (Postfix) with ESMTP for ; Fri, 17 Apr 2020 03:00:13 +0000 (UTC) X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R161e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01f04397;MF=yang.shi@linux.alibaba.com;NM=1;PH=DS;RN=4;SR=0;TI=SMTPD_---0Tvl54ED_1587092406; Received: from US-143344MP.local(mailfrom:yang.shi@linux.alibaba.com fp:SMTPD_---0Tvl54ED_1587092406) by smtp.aliyun-inc.com(127.0.0.1); Fri, 17 Apr 2020 11:00:07 +0800 Subject: Re: [PATCH] shmem: fix possible deadlocks on shmlock_user_lock To: Hugh Dickins , Andrew Morton Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org References: From: Yang Shi Message-ID: Date: Thu, 16 Apr 2020 20:00:05 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 4/16/20 5:11 PM, Hugh Dickins wrote: > Recent commit 71725ed10c40 ("mm: huge tmpfs: try to split_huge_page() > when punching hole") has allowed syzkaller to probe deeper, uncovering > a long-standing lockdep issue between the irq-unsafe shmlock_user_lock, > the irq-safe xa_lock on mapping->i_pages, and shmem inode's info->lock > which nests inside xa_lock (or tree_lock) since 4.8's shmem_uncharge(). > > user_shm_lock(), servicing SysV shmctl(SHM_LOCK), wants shmlock_user_lock > while its caller shmem_lock() holds info->lock with interrupts disabled; > but hugetlbfs_file_setup() calls user_shm_lock() with interrupts enabled, > and might be interrupted by a writeback endio wanting xa_lock on i_pages. > This may not risk an actual deadlock, since shmem inodes do not take part > in writeback accounting, but there are several easy ways to avoid it. > > Requiring interrupts disabled for shmlock_user_lock would be easy, > but it's a high-level global lock for which that seems inappropriate. > Instead, recall that the use of info->lock to guard info->flags in > shmem_lock() dates from pre-3.1 days, when races with SHMEM_PAGEIN and > SHMEM_TRUNCATE could occur: nowadays it serves no purpose, the only flag > added or removed is VM_LOCKED itself, and calls to shmem_lock() an inode > are already serialized by the caller. Take info->lock out of the chain > and the possibility of deadlock or lockdep warning goes away. > > Reported-by: syzbot+c8a8197c8852f566b9d9@syzkaller.appspotmail.com > Link: https://lore.kernel.org/lkml/000000000000e5838c05a3152f53@google.com/ > Reported-by: syzbot+40b71e145e73f78f81ad@syzkaller.appspotmail.com > Link: https://lore.kernel.org/lkml/0000000000003712b305a331d3b1@google.com/ > Fixes: 4595ef88d136 ("shmem: make shmem_inode_info::lock irq-safe") > Signed-off-by: Hugh Dickins > Cc: Yang Shi > --- > > mm/shmem.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) Acked-by: Yang Shi > > --- 5.7-rc1/mm/shmem.c 2020-04-11 12:58:26.415524805 -0700 > +++ linux/mm/shmem.c 2020-04-16 11:04:06.729738730 -0700 > @@ -2179,7 +2179,11 @@ int shmem_lock(struct file *file, int lo > struct shmem_inode_info *info = SHMEM_I(inode); > int retval = -ENOMEM; > > - spin_lock_irq(&info->lock); > + /* > + * What serializes the accesses to info->flags? > + * ipc_lock_object() when called from shmctl_do_lock(), > + * no serialization needed when called from shm_destroy(). > + */ > if (lock && !(info->flags & VM_LOCKED)) { > if (!user_shm_lock(inode->i_size, user)) > goto out_nomem; > @@ -2194,7 +2198,6 @@ int shmem_lock(struct file *file, int lo > retval = 0; > > out_nomem: > - spin_unlock_irq(&info->lock); > return retval; > } >