From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-2780611-1518483709-2-1711687976253596367 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES ensv, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1518483709; b=T6KAg7d4ksmAuPnKcsmwbtgU/Z3quirvCKiVXD82NiSSHmE 3GbQjR85nLZrhQuzxuDsewZTDsicwnr11d0upQv73O74b3zusjEg2PzXNGkbovxR oryCuJMnNC+rF9zajNuOv9c36TWd3PhPkZgGVDHxIiM9qv1eRp3+b8kP9al67Mya OSri5QDk8iz7XbNC/m+C1xFNgdk1/0NtRNGwpPSdLO7sl7PnSDPjLdignHS83OP5 +CsuLMF+eFjj15BJ8C08B98z5gKBk9RkaRK+XkiDGLnqVUO4P0UiSMIgToouja2p bc09BCRkYn/R6oCaVxuCC92Y7ZPwGXD+KGT+8RA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id:sender :list-id; s=arctest; t=1518483709; bh=gqiuCiqA35idjXgm6Iermo2hB/ UhTpxV+C0NYrG1yRE=; b=oSSDKR3nZq7p53DDkB+rryZrGdZhiACqmndjEvjtd7 qy4XuSPUYtd6mPNUTVE+FUdUZ5x1qfoN4YkPVr3XFz/ZCghteTpHBNW769430G4t ywjn9b5ykgD4FjT0Uc7ZhVwznc6220yLM+ypJYG45Z581LxtPRCJn82yRDJ9eyfI XZBQcH8WuRUNgzOnDkdsqaEXHIZzx78tz/TteLNojFE221vcPIQoZzrPFSHR9Q+P afBEoa2qOL1qwsA/prk7FPzqoLnWPlGfVMVQfDnnM5IeKxi4pRj/FB7gJYFJAAzS kYqxrsKWW4QLtQ0E3KwfrlcIkfJJh2F+rDQ8i7OLVqYA== ARC-Authentication-Results: i=1; mx3.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=google.com header.i=@google.com header.b=kaA51MCu x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=google.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=DkG9She8; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=google.com header.result=pass header_is_org_domain=yes Authentication-Results: mx3.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=google.com header.i=@google.com header.b=kaA51MCu x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=google.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=DkG9She8; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=google.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932957AbeBMBBo (ORCPT ); Mon, 12 Feb 2018 20:01:44 -0500 Received: from mail-pl0-f65.google.com ([209.85.160.65]:42270 "EHLO mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932736AbeBMBBn (ORCPT ); Mon, 12 Feb 2018 20:01:43 -0500 X-Google-Smtp-Source: AH8x225kcXT0XjaTXBHN7NkcX4Fj4tSOrMoKKtEM1u/l48CLPBvYEfXOGDDXq5U5y3FTfN8vUzcXOg== From: Joel Fernandes To: linux-kernel@vger.kernel.org Cc: Joel Fernandes , Todd Kjos , Arve Hjonnevag , Greg Hackmann , Greg Kroah-Hartman , stable@vger.kernel.org Subject: [PATCH] staging: ashmem: Fix lockdep issue during llseek Date: Mon, 12 Feb 2018 17:01:25 -0800 Message-Id: <20180213010125.174811-1-joelaf@google.com> X-Mailer: git-send-email 2.16.0.rc1.238.g530d649a79-goog Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: ashmem_mutex create a chain of dependencies like so: (1) mmap syscall -> mmap_sem -> (acquired) ashmem_mmap ashmem_mutex (try to acquire) (block) (2) llseek syscall -> ashmem_llseek -> ashmem_mutex -> (acquired) inode_lock -> inode->i_rwsem (try to acquire) (block) (3) getdents -> iterate_dir -> inode_lock -> inode->i_rwsem (acquired) copy_to_user -> mmap_sem (try to acquire) There is a lock ordering created between mmap_sem and inode->i_rwsem causing a lockdep splat [2] during a syzcaller test, this patch fixes the issue by unlocking the mutex earlier. Functionally that's Ok since we don't need to protect vfs_llseek. [1] https://patchwork.kernel.org/patch/10185031/ [2] https://lkml.org/lkml/2018/1/10/48 Cc: Todd Kjos Cc: Arve Hjonnevag Cc: Greg Hackmann Cc: Greg Kroah-Hartman Cc: stable@vger.kernel.org Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com Signed-off-by: Joel Fernandes --- drivers/staging/android/ashmem.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 372ce9913e6d..6921f86b4aa1 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -334,24 +334,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) mutex_lock(&ashmem_mutex); if (asma->size == 0) { - ret = -EINVAL; - goto out; + mutex_unlock(&ashmem_mutex); + return -EINVAL; } if (!asma->file) { - ret = -EBADF; - goto out; + mutex_unlock(&ashmem_mutex); + return -EBADF; } + mutex_unlock(&ashmem_mutex); + ret = vfs_llseek(asma->file, offset, origin); if (ret < 0) - goto out; + return ret; /** Copy f_pos from backing file, since f_ops->llseek() sets it */ file->f_pos = asma->file->f_pos; - -out: - mutex_unlock(&ashmem_mutex); return ret; } -- 2.16.0.rc1.238.g530d649a79-goog