• Eric Biggers's avatar
    fs/userfaultfd.c: disable irqs for fault_pending and event locks · cbcfa130
    Eric Biggers authored
    When IOCB_CMD_POLL is used on a userfaultfd, aio_poll() disables IRQs
    and takes kioctx::ctx_lock, then userfaultfd_ctx::fd_wqh.lock.
    
    This may have to wait for userfaultfd_ctx::fd_wqh.lock to be released by
    userfaultfd_ctx_read(), which in turn can be waiting for
    userfaultfd_ctx::fault_pending_wqh.lock or
    userfaultfd_ctx::event_wqh.lock.
    
    But elsewhere the fault_pending_wqh and event_wqh locks are taken with
    IRQs enabled.  Since the IRQ handler may take kioctx::ctx_lock, lockdep
    reports that a deadlock is possible.
    
    Fix it by always disabling IRQs when taking the fault_pending_wqh and
    event_wqh locks.
    
    Commit ae62c16e ("userfaultfd: disable irqs when taking the
    waitqueue lock") didn't fix this because it only accounted for the
    fd_wqh lock, not the other locks nested inside it.
    
    Link: http://lkml.kernel.org/r/20190627075004.21259-1-ebiggers@kernel.org
    Fixes: bfe4037e ("aio: implement IOCB_CMD_POLL")
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Reported-by: syzbot+fab6de82892b6b9c6191@syzkaller.appspotmail.com
    Reported-by: syzbot+53c0b767f7ca0dc0c451@syzkaller.appspotmail.com
    Reported-by: syzbot+a3accb352f9c22041cfa@syzkaller.appspotmail.com
    Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: <stable@vger.kernel.org>	[4.19+]
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    cbcfa130
userfaultfd.c 51.1 KB