• Eric W. Biederman's avatar
    exec: Transform exec_update_mutex into a rw_semaphore · f7cfd871
    Eric W. Biederman authored
    Recently syzbot reported[0] that there is a deadlock amongst the users
    of exec_update_mutex.  The problematic lock ordering found by lockdep
    was:
    
       perf_event_open  (exec_update_mutex -> ovl_i_mutex)
       chown            (ovl_i_mutex       -> sb_writes)
       sendfile         (sb_writes         -> p->lock)
         by reading from a proc file and writing to overlayfs
       proc_pid_syscall (p->lock           -> exec_update_mutex)
    
    While looking at possible solutions it occured to me that all of the
    users and possible users involved only wanted to state of the given
    process to remain the same.  They are all readers.  The only writer is
    exec.
    
    There is no reason for readers to block on each other.  So fix
    this deadlock by transforming exec_update_mutex into a rw_semaphore
    named exec_update_lock that only exec takes for writing.
    
    Cc: Jann Horn <jannh@google.com>
    Cc: Vasiliy Kulikov <segoon@openwall.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Bernd Edlinger <bernd.edlinger@hotmail.de>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Christopher Yeoh <cyeoh@au1.ibm.com>
    Cc: Cyrill Gorcunov <gorcunov@gmail.com>
    Cc: Sargun Dhillon <sargun@sargun.me>
    Cc: Christian Brauner <christian.brauner@ubuntu.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
    Fixes: eea96732 ("exec: Add exec_update_mutex to replace cred_guard_mutex")
    [0] https://lkml.kernel.org/r/00000000000063640c05ade8e3de@google.com
    Reported-by: syzbot+db9cdf3dd1f64252c6ef@syzkaller.appspotmail.com
    Link: https://lkml.kernel.org/r/87ft4mbqen.fsf@x220.int.ebiederm.orgSigned-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
    f7cfd871
core.c 311 KB