Commit 80e1e823 authored by Linus Torvalds's avatar Linus Torvalds

Fix race in tty_fasync() properly

This reverts commit 70362511 ("tty: fix race in tty_fasync") and
commit b04da8bf ("fnctl: f_modown should call write_lock_irqsave/
restore") that tried to fix up some of the fallout but was incomplete.

It turns out that we really cannot hold 'tty->ctrl_lock' over calling
__f_setown, because not only did that cause problems with interrupt
disables (which the second commit fixed), it also causes a potential
ABBA deadlock due to lock ordering.

Thanks to Tetsuo Handa for following up on the issue, and running
lockdep to show the problem.  It goes roughly like this:

 - f_getown gets filp->f_owner.lock for reading without interrupts
   disabled, so an interrupt that happens while that lock is held can
   cause a lockdep chain from f_owner.lock -> sighand->siglock.

 - at the same time, the tty->ctrl_lock -> f_owner.lock chain that
   commit 70362511 introduced, together with the pre-existing
   sighand->siglock -> tty->ctrl_lock chain means that we have a lock
   dependency the other way too.

So instead of extending tty->ctrl_lock over the whole __f_setown() call,
we now just take a reference to the 'pid' structure while holding the
lock, and then release it after having done the __f_setown.  That still
guarantees that 'struct pid' won't go away from under us, which is all
we really ever needed.
Reported-and-tested-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
Acked-by: default avatarAmérico Wang <xiyou.wangcong@gmail.com>
Cc: stable@kernel.org
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 29275254
...@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on) ...@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
pid = task_pid(current); pid = task_pid(current);
type = PIDTYPE_PID; type = PIDTYPE_PID;
} }
retval = __f_setown(filp, pid, type, 0); get_pid(pid);
spin_unlock_irqrestore(&tty->ctrl_lock, flags); spin_unlock_irqrestore(&tty->ctrl_lock, flags);
retval = __f_setown(filp, pid, type, 0);
put_pid(pid);
if (retval) if (retval)
goto out; goto out;
} else { } else {
......
...@@ -199,9 +199,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg) ...@@ -199,9 +199,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
int force) int force)
{ {
unsigned long flags; write_lock_irq(&filp->f_owner.lock);
write_lock_irqsave(&filp->f_owner.lock, flags);
if (force || !filp->f_owner.pid) { if (force || !filp->f_owner.pid) {
put_pid(filp->f_owner.pid); put_pid(filp->f_owner.pid);
filp->f_owner.pid = get_pid(pid); filp->f_owner.pid = get_pid(pid);
...@@ -213,7 +211,7 @@ static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, ...@@ -213,7 +211,7 @@ static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
filp->f_owner.euid = cred->euid; filp->f_owner.euid = cred->euid;
} }
} }
write_unlock_irqrestore(&filp->f_owner.lock, flags); write_unlock_irq(&filp->f_owner.lock);
} }
int __f_setown(struct file *filp, struct pid *pid, enum pid_type type, int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment