From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964994AbeAXRsY (ORCPT ); Wed, 24 Jan 2018 12:48:24 -0500 Received: from mail-pg0-f65.google.com ([74.125.83.65]:44854 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964826AbeAXRsX (ORCPT ); Wed, 24 Jan 2018 12:48:23 -0500 X-Google-Smtp-Source: AH8x226RnRYrLuhxOAHFfLvkZGrpM/qTO8Z0aOeZg1HJaPvmcly3J5zi7bpwWg4fK9UjP21HQw3UYA== From: Joel Fernandes To: linux-kernel@vger.kernel.org, syzbot , hughd@google.com, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Cc: Dmitry Vyukov , Joel Fernandes Subject: Re: possible deadlock in shmem_file_llseek Date: Wed, 24 Jan 2018 09:47:23 -0800 Message-Id: <20180124174723.25289-1-joelaf@google.com> X-Mailer: git-send-email 2.16.0.rc1.238.g530d649a79-goog In-Reply-To: <001a1144d6e854b3c90562668d74@google.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org #syz test: https://github.com/joelagnel/linux.git test-ashmem --->8---- >>From 55dd7e77e0e46af101ef2195d618d5f56af1023d Mon Sep 17 00:00:00 2001 From: Joel Fernandes Date: Tue, 23 Jan 2018 17:45:04 -0800 Subject: [PATCH] ashmem: Fix lockdep issue during llseek ashmem_mutex create a chain of dependencies like so: (1) mmap syscall -> mmap_sem -> (acquired) ashmem_mmap ashmem_mutex (try to acquire) (block) (2) llseek syscall -> ashmem_llseek -> ashmem_mutex -> (acquired) inode_lock -> inode->i_rwsem (try to acquire) (block) (3) getdents -> iterate_dir -> inode_lock -> inode->i_rwsem (acquired) copy_to_user -> mmap_sem (try to acquire) There is a lock ordering created between mmap_sem and inode->i_rwsem during a syzcaller test, this patch fixes the issue by releasing the ashmem_mutex before the call the vfs_llseek, and reacquiring it after. Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com Signed-off-by: Joel Fernandes --- drivers/staging/android/ashmem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 0f695df14c9d..248983cf2db1 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -343,7 +343,9 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) goto out; } + mutex_unlock(&ashmem_mutex); ret = vfs_llseek(asma->file, offset, origin); + mutex_lock(&ashmem_mutex); if (ret < 0) goto out; -- 2.16.0.rc1.238.g530d649a79-goog