Commit 16dbc6c9 authored by Nick Piggin's avatar Nick Piggin Committed by Linus Torvalds

inotify: fix lock ordering wrt do_page_fault's mmap_sem

Fix inotify lock order reversal with mmap_sem due to holding locks over
copy_to_user.
Signed-off-by: default avatarNick Piggin <npiggin@suse.de>
Reported-by: default avatar"Daniel J Blueman" <daniel.blueman@gmail.com>
Tested-by: default avatar"Daniel J Blueman" <daniel.blueman@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 08650869
...@@ -323,7 +323,7 @@ static void inotify_dev_queue_event(struct inotify_watch *w, u32 wd, u32 mask, ...@@ -323,7 +323,7 @@ static void inotify_dev_queue_event(struct inotify_watch *w, u32 wd, u32 mask,
} }
/* /*
* remove_kevent - cleans up and ultimately frees the given kevent * remove_kevent - cleans up the given kevent
* *
* Caller must hold dev->ev_mutex. * Caller must hold dev->ev_mutex.
*/ */
...@@ -334,7 +334,13 @@ static void remove_kevent(struct inotify_device *dev, ...@@ -334,7 +334,13 @@ static void remove_kevent(struct inotify_device *dev,
dev->event_count--; dev->event_count--;
dev->queue_size -= sizeof(struct inotify_event) + kevent->event.len; dev->queue_size -= sizeof(struct inotify_event) + kevent->event.len;
}
/*
* free_kevent - frees the given kevent.
*/
static void free_kevent(struct inotify_kernel_event *kevent)
{
kfree(kevent->name); kfree(kevent->name);
kmem_cache_free(event_cachep, kevent); kmem_cache_free(event_cachep, kevent);
} }
...@@ -350,6 +356,7 @@ static void inotify_dev_event_dequeue(struct inotify_device *dev) ...@@ -350,6 +356,7 @@ static void inotify_dev_event_dequeue(struct inotify_device *dev)
struct inotify_kernel_event *kevent; struct inotify_kernel_event *kevent;
kevent = inotify_dev_get_event(dev); kevent = inotify_dev_get_event(dev);
remove_kevent(dev, kevent); remove_kevent(dev, kevent);
free_kevent(kevent);
} }
} }
...@@ -433,17 +440,15 @@ static ssize_t inotify_read(struct file *file, char __user *buf, ...@@ -433,17 +440,15 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
dev = file->private_data; dev = file->private_data;
while (1) { while (1) {
int events;
prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE); prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE);
mutex_lock(&dev->ev_mutex); mutex_lock(&dev->ev_mutex);
events = !list_empty(&dev->events); if (!list_empty(&dev->events)) {
mutex_unlock(&dev->ev_mutex);
if (events) {
ret = 0; ret = 0;
break; break;
} }
mutex_unlock(&dev->ev_mutex);
if (file->f_flags & O_NONBLOCK) { if (file->f_flags & O_NONBLOCK) {
ret = -EAGAIN; ret = -EAGAIN;
...@@ -462,7 +467,6 @@ static ssize_t inotify_read(struct file *file, char __user *buf, ...@@ -462,7 +467,6 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
if (ret) if (ret)
return ret; return ret;
mutex_lock(&dev->ev_mutex);
while (1) { while (1) {
struct inotify_kernel_event *kevent; struct inotify_kernel_event *kevent;
...@@ -481,6 +485,13 @@ static ssize_t inotify_read(struct file *file, char __user *buf, ...@@ -481,6 +485,13 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
} }
break; break;
} }
remove_kevent(dev, kevent);
/*
* Must perform the copy_to_user outside the mutex in order
* to avoid a lock order reversal with mmap_sem.
*/
mutex_unlock(&dev->ev_mutex);
if (copy_to_user(buf, &kevent->event, event_size)) { if (copy_to_user(buf, &kevent->event, event_size)) {
ret = -EFAULT; ret = -EFAULT;
...@@ -498,7 +509,9 @@ static ssize_t inotify_read(struct file *file, char __user *buf, ...@@ -498,7 +509,9 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
count -= kevent->event.len; count -= kevent->event.len;
} }
remove_kevent(dev, kevent); free_kevent(kevent);
mutex_lock(&dev->ev_mutex);
} }
mutex_unlock(&dev->ev_mutex); mutex_unlock(&dev->ev_mutex);
......
...@@ -7,6 +7,7 @@ ...@@ -7,6 +7,7 @@
#include <linux/compiler.h> #include <linux/compiler.h>
#include <linux/errno.h> #include <linux/errno.h>
#include <linux/prefetch.h> #include <linux/prefetch.h>
#include <linux/lockdep.h>
#include <asm/page.h> #include <asm/page.h>
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment