Re: 2.6.23-rc2-mm1: sleeping function called from invalid context at kernel/mutex.c:86

[Alexey Dobriyan]

On Fri, Aug 10, 2007 at 12:55:17AM -0700, Andrew Morton wrote:
> On Fri, 10 Aug 2007 09:40:00 +0200 Ingo Molnar <mingo@xxxxxxx> wrote:
> 
> > 
> > * Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
> > 
> > > We seem to have made a mess in there.  timer_list_show() ends up 
> > > calling lookup_module_symbol_name(), which takes a mutex.  However 
> > > print_symbol() (which is called at oops time, interrupt time, etc) 
> > > calls module_address_lookup(), which is basically the same, only it 
> > > doesn't take the mutex.
> > 
> > hm, current upstream does:
> > 
> >  static void print_name_offset(struct seq_file *m, void *sym)
> >  {
> >          char symname[KSYM_NAME_LEN];
> > 
> >          if (lookup_symbol_name((unsigned long)sym, symname) < 0)
> > 
> > why was that changed?
> 
> It wasn't.

Oh no, it was! commit 9d65cb4a1718a072898c7a57a3bc61b2dc4bcd4d

	Fix race between cat /proc/*/wchan and rmmod et al

	kallsyms_lookup() can go iterating over modules list unprotected which is OK
	for emergency situations (oops), but not OK for regular stuff like
	/proc/*/wchan.

> lookup_symbol_name() calls lookup_module_symbol_name() which
> calls mutex_lock().
> 
> > I think symbol lookups for debug purposes have to 
> > be lockless, fundamentally.
> > 
> 
> Sure, especially a sysrq thingy.

I imagine user running powertop which IIRC trolls /proc/timer_list and
doing rmmod following powertop instructions.

> It's a bit nasty to just go in there and start walking data structures
> without holding the needed lock though.

Yep.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/