• Zhenzhong Duan's avatar
    ttyprintk: fix a potential deadlock in interrupt context issue · 9a655c77
    Zhenzhong Duan authored
    tpk_write()/tpk_close() could be interrupted when holding a mutex, then
    in timer handler tpk_write() may be called again trying to acquire same
    mutex, lead to deadlock.
    
    Google syzbot reported this issue with CONFIG_DEBUG_ATOMIC_SLEEP
    enabled:
    
    BUG: sleeping function called from invalid context at
    kernel/locking/mutex.c:938
    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1
    1 lock held by swapper/1/0:
    ...
    Call Trace:
      <IRQ>
      dump_stack+0x197/0x210
      ___might_sleep.cold+0x1fb/0x23e
      __might_sleep+0x95/0x190
      __mutex_lock+0xc5/0x13c0
      mutex_lock_nested+0x16/0x20
      tpk_write+0x5d/0x340
      resync_tnc+0x1b6/0x320
      call_timer_fn+0x1ac/0x780
      run_timer_softirq+0x6c3/0x1790
      __do_softirq+0x262/0x98c
      irq_exit+0x19b/0x1e0
      smp_apic_timer_interrupt+0x1a3/0x610
      apic_timer_interrupt+0xf/0x20
      </IRQ>
    
    See link https://syzkaller.appspot.com/bug?extid=2eeef62ee31f9460ad65 for
    more details.
    
    Fix it by using spinlock in process context instead of mutex and having
    interrupt disabled in critical section.
    
    Reported-by: syzbot+2eeef62ee31f9460ad65@syzkaller.appspotmail.com
    Signed-off-by: default avatarZhenzhong Duan <zhenzhong.duan@gmail.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://lore.kernel.org/r/20200113034842.435-1-zhenzhong.duan@gmail.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    9a655c77
ttyprintk.c 4.82 KB