mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
![Robert Richter](/assets/img/avatar_default.png)
The lockdep warning below detects a possible A->B/B->A locking dependency of mm->mmap_sem and dcookie_mutex. The order in sync_buffer() is mm->mmap_sem/dcookie_mutex, while in sys_lookup_dcookie() it is vice versa. Fixing it in sys_lookup_dcookie() by unlocking dcookie_mutex before copy_to_user(). oprofiled/4432 is trying to acquire lock: (&mm->mmap_sem){++++++}, at: [<ffffffff810b444b>] might_fault+0x53/0xa3 but task is already holding lock: (dcookie_mutex){+.+.+.}, at: [<ffffffff81124d28>] sys_lookup_dcookie+0x45/0x149 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (dcookie_mutex){+.+.+.}: [<ffffffff8106557f>] lock_acquire+0xf8/0x11e [<ffffffff814634f0>] mutex_lock_nested+0x63/0x309 [<ffffffff81124e5c>] get_dcookie+0x30/0x144 [<ffffffffa0000fba>] sync_buffer+0x196/0x3ec [oprofile] [<ffffffffa0001226>] task_exit_notify+0x16/0x1a [oprofile] [<ffffffff81467b96>] notifier_call_chain+0x37/0x63 [<ffffffff8105803d>] __blocking_notifier_call_chain+0x50/0x67 [<ffffffff81058068>] blocking_notifier_call_chain+0x14/0x16 [<ffffffff8105a718>] profile_task_exit+0x1a/0x1c [<ffffffff81039e8f>] do_exit+0x2a/0x6fc [<ffffffff8103a5e4>] do_group_exit+0x83/0xae [<ffffffff8103a626>] sys_exit_group+0x17/0x1b [<ffffffff8146ad4b>] system_call_fastpath+0x16/0x1b -> #0 (&mm->mmap_sem){++++++}: [<ffffffff81064dfb>] __lock_acquire+0x1085/0x1711 [<ffffffff8106557f>] lock_acquire+0xf8/0x11e [<ffffffff810b4478>] might_fault+0x80/0xa3 [<ffffffff81124de7>] sys_lookup_dcookie+0x104/0x149 [<ffffffff8146ad4b>] system_call_fastpath+0x16/0x1b other info that might help us debug this: 1 lock held by oprofiled/4432: #0: (dcookie_mutex){+.+.+.}, at: [<ffffffff81124d28>] sys_lookup_dcookie+0x45/0x149 stack backtrace: Pid: 4432, comm: oprofiled Not tainted 2.6.39-00008-ge5a450d #9 Call Trace: [<ffffffff81063193>] print_circular_bug+0xae/0xbc [<ffffffff81064dfb>] __lock_acquire+0x1085/0x1711 [<ffffffff8102ef13>] ? get_parent_ip+0x11/0x42 [<ffffffff810b444b>] ? might_fault+0x53/0xa3 [<ffffffff8106557f>] lock_acquire+0xf8/0x11e [<ffffffff810b444b>] ? might_fault+0x53/0xa3 [<ffffffff810d7d54>] ? path_put+0x22/0x27 [<ffffffff810b4478>] might_fault+0x80/0xa3 [<ffffffff810b444b>] ? might_fault+0x53/0xa3 [<ffffffff81124de7>] sys_lookup_dcookie+0x104/0x149 [<ffffffff8146ad4b>] system_call_fastpath+0x16/0x1b References: https://bugzilla.kernel.org/show_bug.cgi?id=13809 Cc: <stable@kernel.org> # .27+ Signed-off-by: Robert Richter <robert.richter@amd.com>
345 lines
6.8 KiB
C
345 lines
6.8 KiB
C
/*
|
|
* dcookies.c
|
|
*
|
|
* Copyright 2002 John Levon <levon@movementarian.org>
|
|
*
|
|
* Persistent cookie-path mappings. These are used by
|
|
* profilers to convert a per-task EIP value into something
|
|
* non-transitory that can be processed at a later date.
|
|
* This is done by locking the dentry/vfsmnt pair in the
|
|
* kernel until released by the tasks needing the persistent
|
|
* objects. The tag is simply an unsigned long that refers
|
|
* to the pair and can be looked up from userspace.
|
|
*/
|
|
|
|
#include <linux/syscalls.h>
|
|
#include <linux/module.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/list.h>
|
|
#include <linux/mount.h>
|
|
#include <linux/capability.h>
|
|
#include <linux/dcache.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/err.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/dcookies.h>
|
|
#include <linux/mutex.h>
|
|
#include <linux/path.h>
|
|
#include <asm/uaccess.h>
|
|
|
|
/* The dcookies are allocated from a kmem_cache and
|
|
* hashed onto a small number of lists. None of the
|
|
* code here is particularly performance critical
|
|
*/
|
|
struct dcookie_struct {
|
|
struct path path;
|
|
struct list_head hash_list;
|
|
};
|
|
|
|
static LIST_HEAD(dcookie_users);
|
|
static DEFINE_MUTEX(dcookie_mutex);
|
|
static struct kmem_cache *dcookie_cache __read_mostly;
|
|
static struct list_head *dcookie_hashtable __read_mostly;
|
|
static size_t hash_size __read_mostly;
|
|
|
|
static inline int is_live(void)
|
|
{
|
|
return !(list_empty(&dcookie_users));
|
|
}
|
|
|
|
|
|
/* The dentry is locked, its address will do for the cookie */
|
|
static inline unsigned long dcookie_value(struct dcookie_struct * dcs)
|
|
{
|
|
return (unsigned long)dcs->path.dentry;
|
|
}
|
|
|
|
|
|
static size_t dcookie_hash(unsigned long dcookie)
|
|
{
|
|
return (dcookie >> L1_CACHE_SHIFT) & (hash_size - 1);
|
|
}
|
|
|
|
|
|
static struct dcookie_struct * find_dcookie(unsigned long dcookie)
|
|
{
|
|
struct dcookie_struct *found = NULL;
|
|
struct dcookie_struct * dcs;
|
|
struct list_head * pos;
|
|
struct list_head * list;
|
|
|
|
list = dcookie_hashtable + dcookie_hash(dcookie);
|
|
|
|
list_for_each(pos, list) {
|
|
dcs = list_entry(pos, struct dcookie_struct, hash_list);
|
|
if (dcookie_value(dcs) == dcookie) {
|
|
found = dcs;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return found;
|
|
}
|
|
|
|
|
|
static void hash_dcookie(struct dcookie_struct * dcs)
|
|
{
|
|
struct list_head * list = dcookie_hashtable + dcookie_hash(dcookie_value(dcs));
|
|
list_add(&dcs->hash_list, list);
|
|
}
|
|
|
|
|
|
static struct dcookie_struct *alloc_dcookie(struct path *path)
|
|
{
|
|
struct dcookie_struct *dcs = kmem_cache_alloc(dcookie_cache,
|
|
GFP_KERNEL);
|
|
struct dentry *d;
|
|
if (!dcs)
|
|
return NULL;
|
|
|
|
d = path->dentry;
|
|
spin_lock(&d->d_lock);
|
|
d->d_flags |= DCACHE_COOKIE;
|
|
spin_unlock(&d->d_lock);
|
|
|
|
dcs->path = *path;
|
|
path_get(path);
|
|
hash_dcookie(dcs);
|
|
return dcs;
|
|
}
|
|
|
|
|
|
/* This is the main kernel-side routine that retrieves the cookie
|
|
* value for a dentry/vfsmnt pair.
|
|
*/
|
|
int get_dcookie(struct path *path, unsigned long *cookie)
|
|
{
|
|
int err = 0;
|
|
struct dcookie_struct * dcs;
|
|
|
|
mutex_lock(&dcookie_mutex);
|
|
|
|
if (!is_live()) {
|
|
err = -EINVAL;
|
|
goto out;
|
|
}
|
|
|
|
if (path->dentry->d_flags & DCACHE_COOKIE) {
|
|
dcs = find_dcookie((unsigned long)path->dentry);
|
|
} else {
|
|
dcs = alloc_dcookie(path);
|
|
if (!dcs) {
|
|
err = -ENOMEM;
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
*cookie = dcookie_value(dcs);
|
|
|
|
out:
|
|
mutex_unlock(&dcookie_mutex);
|
|
return err;
|
|
}
|
|
|
|
|
|
/* And here is where the userspace process can look up the cookie value
|
|
* to retrieve the path.
|
|
*/
|
|
SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
|
|
{
|
|
unsigned long cookie = (unsigned long)cookie64;
|
|
int err = -EINVAL;
|
|
char * kbuf;
|
|
char * path;
|
|
size_t pathlen;
|
|
struct dcookie_struct * dcs;
|
|
|
|
/* we could leak path information to users
|
|
* without dir read permission without this
|
|
*/
|
|
if (!capable(CAP_SYS_ADMIN))
|
|
return -EPERM;
|
|
|
|
mutex_lock(&dcookie_mutex);
|
|
|
|
if (!is_live()) {
|
|
err = -EINVAL;
|
|
goto out;
|
|
}
|
|
|
|
if (!(dcs = find_dcookie(cookie)))
|
|
goto out;
|
|
|
|
err = -ENOMEM;
|
|
kbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
|
|
if (!kbuf)
|
|
goto out;
|
|
|
|
/* FIXME: (deleted) ? */
|
|
path = d_path(&dcs->path, kbuf, PAGE_SIZE);
|
|
|
|
mutex_unlock(&dcookie_mutex);
|
|
|
|
if (IS_ERR(path)) {
|
|
err = PTR_ERR(path);
|
|
goto out_free;
|
|
}
|
|
|
|
err = -ERANGE;
|
|
|
|
pathlen = kbuf + PAGE_SIZE - path;
|
|
if (pathlen <= len) {
|
|
err = pathlen;
|
|
if (copy_to_user(buf, path, pathlen))
|
|
err = -EFAULT;
|
|
}
|
|
|
|
out_free:
|
|
kfree(kbuf);
|
|
return err;
|
|
out:
|
|
mutex_unlock(&dcookie_mutex);
|
|
return err;
|
|
}
|
|
#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
|
|
asmlinkage long SyS_lookup_dcookie(u64 cookie64, long buf, long len)
|
|
{
|
|
return SYSC_lookup_dcookie(cookie64, (char __user *) buf, (size_t) len);
|
|
}
|
|
SYSCALL_ALIAS(sys_lookup_dcookie, SyS_lookup_dcookie);
|
|
#endif
|
|
|
|
static int dcookie_init(void)
|
|
{
|
|
struct list_head * d;
|
|
unsigned int i, hash_bits;
|
|
int err = -ENOMEM;
|
|
|
|
dcookie_cache = kmem_cache_create("dcookie_cache",
|
|
sizeof(struct dcookie_struct),
|
|
0, 0, NULL);
|
|
|
|
if (!dcookie_cache)
|
|
goto out;
|
|
|
|
dcookie_hashtable = kmalloc(PAGE_SIZE, GFP_KERNEL);
|
|
if (!dcookie_hashtable)
|
|
goto out_kmem;
|
|
|
|
err = 0;
|
|
|
|
/*
|
|
* Find the power-of-two list-heads that can fit into the allocation..
|
|
* We don't guarantee that "sizeof(struct list_head)" is necessarily
|
|
* a power-of-two.
|
|
*/
|
|
hash_size = PAGE_SIZE / sizeof(struct list_head);
|
|
hash_bits = 0;
|
|
do {
|
|
hash_bits++;
|
|
} while ((hash_size >> hash_bits) != 0);
|
|
hash_bits--;
|
|
|
|
/*
|
|
* Re-calculate the actual number of entries and the mask
|
|
* from the number of bits we can fit.
|
|
*/
|
|
hash_size = 1UL << hash_bits;
|
|
|
|
/* And initialize the newly allocated array */
|
|
d = dcookie_hashtable;
|
|
i = hash_size;
|
|
do {
|
|
INIT_LIST_HEAD(d);
|
|
d++;
|
|
i--;
|
|
} while (i);
|
|
|
|
out:
|
|
return err;
|
|
out_kmem:
|
|
kmem_cache_destroy(dcookie_cache);
|
|
goto out;
|
|
}
|
|
|
|
|
|
static void free_dcookie(struct dcookie_struct * dcs)
|
|
{
|
|
struct dentry *d = dcs->path.dentry;
|
|
|
|
spin_lock(&d->d_lock);
|
|
d->d_flags &= ~DCACHE_COOKIE;
|
|
spin_unlock(&d->d_lock);
|
|
|
|
path_put(&dcs->path);
|
|
kmem_cache_free(dcookie_cache, dcs);
|
|
}
|
|
|
|
|
|
static void dcookie_exit(void)
|
|
{
|
|
struct list_head * list;
|
|
struct list_head * pos;
|
|
struct list_head * pos2;
|
|
struct dcookie_struct * dcs;
|
|
size_t i;
|
|
|
|
for (i = 0; i < hash_size; ++i) {
|
|
list = dcookie_hashtable + i;
|
|
list_for_each_safe(pos, pos2, list) {
|
|
dcs = list_entry(pos, struct dcookie_struct, hash_list);
|
|
list_del(&dcs->hash_list);
|
|
free_dcookie(dcs);
|
|
}
|
|
}
|
|
|
|
kfree(dcookie_hashtable);
|
|
kmem_cache_destroy(dcookie_cache);
|
|
}
|
|
|
|
|
|
struct dcookie_user {
|
|
struct list_head next;
|
|
};
|
|
|
|
struct dcookie_user * dcookie_register(void)
|
|
{
|
|
struct dcookie_user * user;
|
|
|
|
mutex_lock(&dcookie_mutex);
|
|
|
|
user = kmalloc(sizeof(struct dcookie_user), GFP_KERNEL);
|
|
if (!user)
|
|
goto out;
|
|
|
|
if (!is_live() && dcookie_init())
|
|
goto out_free;
|
|
|
|
list_add(&user->next, &dcookie_users);
|
|
|
|
out:
|
|
mutex_unlock(&dcookie_mutex);
|
|
return user;
|
|
out_free:
|
|
kfree(user);
|
|
user = NULL;
|
|
goto out;
|
|
}
|
|
|
|
|
|
void dcookie_unregister(struct dcookie_user * user)
|
|
{
|
|
mutex_lock(&dcookie_mutex);
|
|
|
|
list_del(&user->next);
|
|
kfree(user);
|
|
|
|
if (!is_live())
|
|
dcookie_exit();
|
|
|
|
mutex_unlock(&dcookie_mutex);
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(dcookie_register);
|
|
EXPORT_SYMBOL_GPL(dcookie_unregister);
|
|
EXPORT_SYMBOL_GPL(get_dcookie);
|