Re: [PATCH v2] fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

[Oleg Nesterov]

perhaps it is time to add pid->tasks_lock or abuse pid->lock we already
have (we would need to make it irq-safe) but this doesn't look nice...

Oleg.

On 10/12, Oleg Nesterov wrote:
>
> On 10/13, Mingyu Wang wrote:
> >
> > report7.txt corresponds to the warning quoted in my previous reply
> > (syz.2.658/3606).
>
> ...
>
> >   kill_fasync fs/fcntl.c:1159 [inline]
> >   kill_fasync+0x13c/0x520 fs/fcntl.c:1152
> >   __pass_event drivers/input/evdev.c:240 [inline]
> >   evdev_pass_values.part.0+0x62a/0x8f0 drivers/input/evdev.c:278
> >   evdev_pass_values drivers/input/evdev.c:253 [inline]
> >   evdev_events+0x3ba/0x440 drivers/input/evdev.c:306
> >   input_pass_values+0x70c/0x860 drivers/input/input.c:128
> >   input_event_dispose drivers/input/input.c:353 [inline]
> >   input_handle_event+0xdb3/0x1490 drivers/input/input.c:370
> >   input_inject_event+0x1ea/0x3b0 drivers/input/input.c:424
> >   evdev_do_ioctl+0x547/0x1980 drivers/input/evdev.c:1070
> >   evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
> >   evdev_ioctl+0x14f/0x1b0 drivers/input/evdev.c:1279
> >   vfs_ioctl fs/ioctl.c:51 [inline]
> >   __do_sys_ioctl fs/ioctl.c:597 [inline]
> >   __se_sys_ioctl fs/ioctl.c:583 [inline]
> >   __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:583
>
> Thanks. So yes, this is what I suspected...
>
> kill_fasync() is called under dev->event_lock (input_inject_event() abobe)
> in process contect.
>
> If another CPU takes the same dev->event_lock in softirq context and we race
> with write_lock(tasklist) on yet another CPU, deadlock is indeed possible...
>
> I'll try to take a look, but I can't promise too much ;)
>
> Oleg.