Waiman Long d3ec10aa95 KEYS: Don't write out to userspace while holding key semaphore ... A lockdep circular locking dependency report was seen when running a keyutils test: [12537.027242] ====================================================== [12537.059309] WARNING: possible circular locking dependency detected [12537.088148] 4.18.0-147.7.1.el8_1.x86_64+debug #1 Tainted: G OE --------- - - [12537.125253] ------------------------------------------------------ [12537.153189] keyctl/25598 is trying to acquire lock: [12537.175087] 000000007c39f96c (&mm->mmap_sem){++++}, at: __might_fault+0xc4/0x1b0 [12537.208365] [12537.208365] but task is already holding lock: [12537.234507] 000000003de5b58d (&type->lock_class){++++}, at: keyctl_read_key+0x15a/0x220 [12537.270476] [12537.270476] which lock already depends on the new lock. [12537.270476] [12537.307209] [12537.307209] the existing dependency chain (in reverse order) is: [12537.340754] [12537.340754] -> #3 (&type->lock_class){++++}: [12537.367434] down_write+0x4d/0x110 [12537.385202] __key_link_begin+0x87/0x280 [12537.405232] request_key_and_link+0x483/0xf70 [12537.427221] request_key+0x3c/0x80 [12537.444839] dns_query+0x1db/0x5a5 [dns_resolver] [12537.468445] dns_resolve_server_name_to_ip+0x1e1/0x4d0 [cifs] [12537.496731] cifs_reconnect+0xe04/0x2500 [cifs] [12537.519418] cifs_readv_from_socket+0x461/0x690 [cifs] [12537.546263] cifs_read_from_socket+0xa0/0xe0 [cifs] [12537.573551] cifs_demultiplex_thread+0x311/0x2db0 [cifs] [12537.601045] kthread+0x30c/0x3d0 [12537.617906] ret_from_fork+0x3a/0x50 [12537.636225] [12537.636225] -> #2 (root_key_user.cons_lock){+.+.}: [12537.664525] __mutex_lock+0x105/0x11f0 [12537.683734] request_key_and_link+0x35a/0xf70 [12537.705640] request_key+0x3c/0x80 [12537.723304] dns_query+0x1db/0x5a5 [dns_resolver] [12537.746773] dns_resolve_server_name_to_ip+0x1e1/0x4d0 [cifs] [12537.775607] cifs_reconnect+0xe04/0x2500 [cifs] [12537.798322] cifs_readv_from_socket+0x461/0x690 [cifs] [12537.823369] cifs_read_from_socket+0xa0/0xe0 [cifs] [12537.847262] cifs_demultiplex_thread+0x311/0x2db0 [cifs] [12537.873477] kthread+0x30c/0x3d0 [12537.890281] ret_from_fork+0x3a/0x50 [12537.908649] [12537.908649] -> #1 (&tcp_ses->srv_mutex){+.+.}: [12537.935225] __mutex_lock+0x105/0x11f0 [12537.954450] cifs_call_async+0x102/0x7f0 [cifs] [12537.977250] smb2_async_readv+0x6c3/0xc90 [cifs] [12538.000659] cifs_readpages+0x120a/0x1e50 [cifs] [12538.023920] read_pages+0xf5/0x560 [12538.041583] __do_page_cache_readahead+0x41d/0x4b0 [12538.067047] ondemand_readahead+0x44c/0xc10 [12538.092069] filemap_fault+0xec1/0x1830 [12538.111637] __do_fault+0x82/0x260 [12538.129216] do_fault+0x419/0xfb0 [12538.146390] __handle_mm_fault+0x862/0xdf0 [12538.167408] handle_mm_fault+0x154/0x550 [12538.187401] __do_page_fault+0x42f/0xa60 [12538.207395] do_page_fault+0x38/0x5e0 [12538.225777] page_fault+0x1e/0x30 [12538.243010] [12538.243010] -> #0 (&mm->mmap_sem){++++}: [12538.267875] lock_acquire+0x14c/0x420 [12538.286848] __might_fault+0x119/0x1b0 [12538.306006] keyring_read_iterator+0x7e/0x170 [12538.327936] assoc_array_subtree_iterate+0x97/0x280 [12538.352154] keyring_read+0xe9/0x110 [12538.370558] keyctl_read_key+0x1b9/0x220 [12538.391470] do_syscall_64+0xa5/0x4b0 [12538.410511] entry_SYSCALL_64_after_hwframe+0x6a/0xdf [12538.435535] [12538.435535] other info that might help us debug this: [12538.435535] [12538.472829] Chain exists of: [12538.472829] &mm->mmap_sem --> root_key_user.cons_lock --> &type->lock_class [12538.472829] [12538.524820] Possible unsafe locking scenario: [12538.524820] [12538.551431] CPU0 CPU1 [12538.572654] ---- ---- [12538.595865] lock(&type->lock_class); [12538.613737] lock(root_key_user.cons_lock); [12538.644234] lock(&type->lock_class); [12538.672410] lock(&mm->mmap_sem); [12538.687758] [12538.687758] *** DEADLOCK *** [12538.687758] [12538.714455] 1 lock held by keyctl/25598: [12538.732097] #0: 000000003de5b58d (&type->lock_class){++++}, at: keyctl_read_key+0x15a/0x220 [12538.770573] [12538.770573] stack backtrace: [12538.790136] CPU: 2 PID: 25598 Comm: keyctl Kdump: loaded Tainted: G [12538.844855] Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 12/27/2015 [12538.881963] Call Trace: [12538.892897] dump_stack+0x9a/0xf0 [12538.907908] print_circular_bug.isra.25.cold.50+0x1bc/0x279 [12538.932891] ? save_trace+0xd6/0x250 [12538.948979] check_prev_add.constprop.32+0xc36/0x14f0 [12538.971643] ? keyring_compare_object+0x104/0x190 [12538.992738] ? check_usage+0x550/0x550 [12539.009845] ? sched_clock+0x5/0x10 [12539.025484] ? sched_clock_cpu+0x18/0x1e0 [12539.043555] __lock_acquire+0x1f12/0x38d0 [12539.061551] ? trace_hardirqs_on+0x10/0x10 [12539.080554] lock_acquire+0x14c/0x420 [12539.100330] ? __might_fault+0xc4/0x1b0 [12539.119079] __might_fault+0x119/0x1b0 [12539.135869] ? __might_fault+0xc4/0x1b0 [12539.153234] keyring_read_iterator+0x7e/0x170 [12539.172787] ? keyring_read+0x110/0x110 [12539.190059] assoc_array_subtree_iterate+0x97/0x280 [12539.211526] keyring_read+0xe9/0x110 [12539.227561] ? keyring_gc_check_iterator+0xc0/0xc0 [12539.249076] keyctl_read_key+0x1b9/0x220 [12539.266660] do_syscall_64+0xa5/0x4b0 [12539.283091] entry_SYSCALL_64_after_hwframe+0x6a/0xdf One way to prevent this deadlock scenario from happening is to not allow writing to userspace while holding the key semaphore. Instead, an internal buffer is allocated for getting the keys out from the read method first before copying them out to userspace without holding the lock. That requires taking out the __user modifier from all the relevant read methods as well as additional changes to not use any userspace write helpers. That is, 1) The put_user() call is replaced by a direct copy. 2) The copy_to_user() call is replaced by memcpy(). 3) All the fault handling code is removed. Compiling on a x86-64 system, the size of the rxrpc_read() function is reduced from 3795 bytes to 2384 bytes with this patch. Fixes: ^1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com>		2020-03-29 12:40:41 +01:00
..
6lowpan	6lowpan: no need to check return value of debugfs_create functions	2019-07-06 12:50:01 +02:00
9p	9p pull request for inclusion in 5.4	2019-09-27 15:10:34 -07:00
802	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-01-09 12:13:43 -08:00
appletalk	appletalk: enforce CAP_NET_RAW for raw sockets	2019-09-24 16:37:18 +02:00
atm	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
ax25	net: Make sock protocol value checks more specific	2020-01-09 18:41:40 -08:00
batman-adv	batman-adv: Don't schedule OGM for disabled interface	2020-02-18 09:07:55 +01:00
bluetooth	Bluetooth: Fix race condition in hci_release_sock()	2020-01-26 10:34:17 +02:00
bpf	bpf: Allow to change skb mark in test_run	2019-12-18 17:05:58 -08:00
bpfilter	net/bpfilter: fix dprintf usage for /dev/kmsg	2020-03-14 20:58:10 -07:00
bridge	net: bridge: fix stale eth hdr pointer in br_dev_xmit	2020-02-24 11:11:19 -08:00
caif	net: caif: Add lockdep expression to RCU traversal primitive	2020-03-11 22:55:25 -07:00
can	can: j1939: j1939_sk_bind(): take priv after lock is held	2019-12-08 11:52:02 +01:00
ceph	Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-02-08 13:26:41 -08:00
core	net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build	2020-03-25 12:24:33 -07:00
dcb
dccp	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
decnet	net: Make sock protocol value checks more specific	2020-01-09 18:41:40 -08:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-03-29 12:40:41 +01:00
dsa	net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop	2020-03-24 16:19:01 -07:00
ethernet	net: remove eth_change_mtu	2020-01-27 11:09:31 +01:00
ethtool	ethtool: fix reference leak in some *_SET handlers	2020-03-23 21:50:14 -07:00
hsr	hsr: fix general protection fault in hsr_addr_is_self()	2020-03-21 19:49:34 -07:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-03 13:28:48 -08:00
ife	net: Fix Kconfig indentation	2019-09-26 08:56:17 +02:00
ipv4	ipv4: fix a RCU-list lock in inet_dump_fib()	2020-03-23 20:59:40 -07:00
ipv6	seg6: fix SRv6 L2 tunnels to use IANA-assigned protocol number	2020-03-11 23:49:30 -07:00
iucv	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
kcm	kcm: disable preemption in kcm_parse_func_strparser()	2019-09-27 10:27:14 +02:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-07-08 19:48:57 -07:00
l2tp	l2tp: Allow duplicate session creation with UDP	2020-02-04 12:35:49 +01:00
l3mdev	ipv6: convert major tx path to use RT6_LOOKUP_F_DST_NOREF	2019-06-23 13:24:17 -07:00
lapb	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-17 20:20:36 -07:00
llc	llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)	2019-12-20 21:19:36 -08:00
mac80211	mac80211: Do not send mesh HWMP PREQ if HWMP is disabled	2020-03-11 09:04:14 +01:00
mac802154
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-04 12:27:13 -08:00
mptcp	mptcp: always include dack if possible.	2020-03-05 21:34:42 -08:00
ncsi	net/ncsi: Support for multi host mellanox card	2020-01-09 18:36:22 -08:00
netfilter	net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build	2020-03-25 12:24:33 -07:00
netlabel	netlabel_domainhash.c: Use built-in RCU list checking	2020-02-18 12:44:23 -08:00
netlink	netlink: allow extack cookie also for error messages	2020-03-16 02:04:24 -07:00
netrom	net: core: add generic lockdep keys	2019-10-24 14:53:48 -07:00
nfc	net: nfc: fix bounds checking bugs on "pipe"	2020-03-05 21:32:42 -08:00
nsh	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
openvswitch	openvswitch: add missing attribute validation for hash	2020-03-03 13:28:48 -08:00
packet	net/packet: tpacket_rcv: avoid a producer race condition	2020-03-15 00:25:25 -07:00
phonet	net: Remove redundant BUG_ON() check in phonet_pernet	2020-01-03 12:25:50 -08:00
psample	net: psample: fix skb_over_panic	2019-11-26 14:40:13 -08:00
qrtr	net: qrtr: Remove receive worker	2020-01-14 18:36:42 -08:00
rds	net/rds: Track user mapped pages through special API	2020-02-16 18:37:09 -08:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2019-12-16 10:15:49 +01:00
rose	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-01-26 10:40:21 +01:00
rxrpc	KEYS: Don't write out to userspace while holding key semaphore	2020-03-29 12:40:41 +01:00
sched	net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build	2020-03-25 12:24:33 -07:00
sctp	inet_diag: return classid for all socket types	2020-03-08 21:57:48 -07:00
smc	net/smc: cancel event worker during device removal	2020-03-10 15:40:33 -07:00
strparser	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
sunrpc	xprtrdma: Fix DMA scatter-gather list mapping imbalance	2020-02-13 15:35:33 -05:00
switchdev
tipc	tipc: add missing attribute validation for MTU property	2020-03-03 13:28:49 -08:00
tls	net/tls: Fix to avoid gettig invalid tls record	2020-02-19 16:32:06 -08:00
unix	unix: It's CONFIG_PROC_FS not CONFIG_PROCFS	2020-02-27 11:52:35 -08:00
vmw_vsock	vsock: fix potential deadlock in transport->release()	2020-02-27 12:03:56 -08:00
wimax	wimax: no need to check return value of debugfs_create functions	2019-08-10 15:25:47 -07:00
wireless	nl80211: add missing attribute validation for channel switch	2020-03-11 08:58:39 +01:00
x25	net/x25: fix nonblocking connect	2020-01-09 18:39:33 -08:00
xdp	xsk: Publish global consumer pointers when NAPI is finished	2020-02-11 15:51:11 +01:00
xfrm	xfrm: interface: use icmp_ndo_send helper	2020-02-13 14:19:00 -08:00
compat.c	y2038: socket: use __kernel_old_timespec instead of timespec	2019-11-15 14:38:29 +01:00
Kconfig	net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build	2020-03-25 12:24:33 -07:00
Makefile	mptcp: Add MPTCP socket stubs	2020-01-24 13:44:07 +01:00
socket.c	io_uring: make sure accept honor rlimit nofile	2020-03-20 08:48:36 -06:00
sysctl_net.c