Re: [PATCH v2] fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

[Oleg Nesterov]

On 10/13, Mingyu Wang wrote:
>
> report7.txt corresponds to the warning quoted in my previous reply
> (syz.2.658/3606).

...

>   kill_fasync fs/fcntl.c:1159 [inline]
>   kill_fasync+0x13c/0x520 fs/fcntl.c:1152
>   __pass_event drivers/input/evdev.c:240 [inline]
>   evdev_pass_values.part.0+0x62a/0x8f0 drivers/input/evdev.c:278
>   evdev_pass_values drivers/input/evdev.c:253 [inline]
>   evdev_events+0x3ba/0x440 drivers/input/evdev.c:306
>   input_pass_values+0x70c/0x860 drivers/input/input.c:128
>   input_event_dispose drivers/input/input.c:353 [inline]
>   input_handle_event+0xdb3/0x1490 drivers/input/input.c:370
>   input_inject_event+0x1ea/0x3b0 drivers/input/input.c:424
>   evdev_do_ioctl+0x547/0x1980 drivers/input/evdev.c:1070
>   evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
>   evdev_ioctl+0x14f/0x1b0 drivers/input/evdev.c:1279
>   vfs_ioctl fs/ioctl.c:51 [inline]
>   __do_sys_ioctl fs/ioctl.c:597 [inline]
>   __se_sys_ioctl fs/ioctl.c:583 [inline]
>   __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:583

Thanks. So yes, this is what I suspected...

kill_fasync() is called under dev->event_lock (input_inject_event() abobe)
in process contect.

If another CPU takes the same dev->event_lock in softirq context and we race
with write_lock(tasklist) on yet another CPU, deadlock is indeed possible...

I'll try to take a look, but I can't promise too much ;)

Oleg.