Tetsuo Handa
04aa8187eb
workqueue: don't skip lockdep work dependency in cancel_work_sync()
...
[ Upstream commit c0feea594e058223973db94c1c32a830c9807c86 ]
Like Hillf Danton mentioned
syzbot should have been able to catch cancel_work_sync() in work context
by checking lockdep_map in __flush_work() for both flush and cancel.
in [1], being unable to report an obvious deadlock scenario shown below is
broken. From locking dependency perspective, sync version of cancel request
should behave as if flush request, for it waits for completion of work if
that work has already started execution.
----------
#include <linux/module.h>
#include <linux/sched.h>
static DEFINE_MUTEX(mutex);
static void work_fn(struct work_struct *work)
{
schedule_timeout_uninterruptible(HZ / 5);
mutex_lock(&mutex);
mutex_unlock(&mutex);
}
static DECLARE_WORK(work, work_fn);
static int __init test_init(void)
{
schedule_work(&work);
schedule_timeout_uninterruptible(HZ / 10);
mutex_lock(&mutex);
cancel_work_sync(&work);
mutex_unlock(&mutex);
return -EINVAL;
}
module_init(test_init);
MODULE_LICENSE("GPL");
----------
The check this patch restores was added by commit 0976dfc1d0
("workqueue: Catch more locking problems with flush_work()").
Then, lockdep's crossrelease feature was added by commit b09be676e0
("locking/lockdep: Implement the 'crossrelease' feature"). As a result,
this check was once removed by commit fd1a5b04df ("workqueue: Remove
now redundant lock acquisitions wrt. workqueue flushes").
But lockdep's crossrelease feature was removed by commit e966eaeeb6
("locking/lockdep: Remove the cross-release locking checks"). At this
point, this check should have been restored.
Then, commit d6e89786be ("workqueue: skip lockdep wq dependency in
cancel_work_sync()") introduced a boolean flag in order to distinguish
flush_work() and cancel_work_sync(), for checking "struct workqueue_struct"
dependency when called from cancel_work_sync() was causing false positives.
Then, commit 87915adc3f ("workqueue: re-add lockdep dependencies for
flushing") tried to restore "struct work_struct" dependency check, but by
error checked this boolean flag. Like an example shown above indicates,
"struct work_struct" dependency needs to be checked for both flush_work()
and cancel_work_sync().
Link: https://lkml.kernel.org/r/20220504044800.4966-1-hdanton@sina.com [1]
Reported-by: Hillf Danton <hdanton@sina.com>
Suggested-by: Lai Jiangshan <jiangshanlai@gmail.com>
Fixes: 87915adc3f ("workqueue: re-add lockdep dependencies for flushing")
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-09-28 11:04:09 +02:00
..
bpf
bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
2022-08-11 12:57:51 +02:00
cgroup
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
2022-09-28 11:03:59 +02:00
configs
debug
lockdown: also lock down previous kgdb use
2022-06-06 08:33:48 +02:00
dma
dma-debug: make things less spammy under memory pressure
2022-06-22 14:11:19 +02:00
events
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
2022-07-29 17:14:10 +02:00
gcov
gcov: re-fix clang-11+ support
2021-04-14 08:24:10 +02:00
irq
genirq: Don't return error on missing optional irq_request_resources()
2022-08-25 11:17:29 +02:00
livepatch
livepatch: Nullify obj->mod in klp_module_coming()'s error path
2019-08-19 13:03:37 +02:00
locking
locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-17 09:48:28 +01:00
power
PM: hibernate: defer device probing when resuming from hibernation
2022-08-25 11:17:32 +02:00
printk
printk: fix return value of printk.devkmsg __setup handler
2022-04-15 14:18:08 +02:00
rcu
rcu: Don't deboost before reporting expedited quiescent state
2022-03-28 08:46:48 +02:00
sched
sched/deadline: Fix priority inheritance with multiple scheduling classes
2022-09-05 10:27:39 +02:00
time
timekeeping: contribute wall clock to rng on time change
2022-08-25 11:18:15 +02:00
trace
tracing: hold caller_addr to hardirq_{enable,disable}_ip
2022-09-28 11:03:57 +02:00
.gitignore
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
acct.c
async.c
Revert "module, async: async_synchronize_full() on module init iff async is used"
2022-02-23 11:59:56 +01:00
audit.c
audit: improve audit queue handling when "audit=1" on cmdline
2022-02-08 18:24:26 +01:00
audit.h
audit: log AUDIT_TIME_* records only from rules
2022-04-15 14:18:04 +02:00
audit_fsnotify.c
audit: fix potential double free on error path from fsnotify_add_inode_mark
2022-09-05 10:27:38 +02:00
audit_tree.c
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:08:16 +02:00
audit_watch.c
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
2020-10-01 13:17:32 +02:00
auditfilter.c
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
auditsc.c
audit: log AUDIT_TIME_* records only from rules
2022-04-15 14:18:04 +02:00
backtracetest.c
bounds.c
capability.c
compat.c
configs.c
kernel/configs: Replace GPL boilerplate code with SPDX identifier
2019-07-30 18:34:15 +02:00
context_tracking.c
cpu.c
random: clear fast pool, crng, and batches in cpuhp bring up
2022-06-22 14:11:12 +02:00
cpu_pm.c
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-06-22 09:31:22 +02:00
crash_core.c
crash_dump.c
cred.c
keys: Fix request_key() cache
2020-01-17 19:48:42 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c
don't dump the threads that had been already exiting when zapped.
2020-11-18 19:20:31 +01:00
extable.c
extable: Add function to search only kernel exception table
2019-08-21 22:23:48 +10:00
fail_function.c
fail_function: Remove a redundant mutex unlock
2020-11-24 13:29:18 +01:00
fork.c
copy_process(): Move fd_install() out of sighand->siglock critical section
2022-02-23 12:00:00 +01:00
freezer.c
Revert "libata, freezer: avoid block device removal while system is frozen"
2019-10-06 09:11:37 -06:00
futex.c
mm, futex: fix shared futex pgoff on shmem huge page
2021-06-30 08:47:55 -04:00
gen_kheaders.sh
kbuild: add variables for compression tools
2020-09-03 11:27:10 +02:00
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
jump_label: Don't warn on __exit jump entries
2019-08-29 15:10:10 +01:00
kallsyms.c
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
kcmp.c
exec: Transform exec_update_mutex into a rw_semaphore
2021-01-09 13:44:55 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
sched/rt, Kconfig: Unbreak def/oldconfig with CONFIG_PREEMPT=y
2019-07-22 18:05:11 +02:00
kcov.c
kexec.c
kexec_load: Disable at runtime if the kernel is locked down
2019-08-19 21:54:15 -07:00
kexec_core.c
kernel: kexec: remove the lock operation of system_transition_mutex
2021-02-03 23:25:56 +01:00
kexec_elf.c
kexec_elf: support 32 bit ELF files
2019-09-06 23:58:44 +02:00
kexec_file.c
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
2022-07-02 16:28:50 +02:00
kexec_internal.h
kheaders.c
kmod.c
kmod: make request_module() return an error when autoloading is disabled
2020-04-17 10:50:22 +02:00
kprobes.c
kprobes: Prohibit probes in gate area
2022-09-15 12:04:54 +02:00
ksysfs.c
kthread.c
kthread: Fix PF_KTHREAD vs to_kthread() race
2021-09-12 08:56:39 +02:00
latencytop.c
Makefile
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
module-internal.h
module.c
module/ftrace: handle patchable-function-entry
2022-02-23 11:59:56 +01:00
module_signature.c
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
module_signing.c
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
notifier.c
kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
2020-10-01 13:17:23 +02:00
nsproxy.c
padata.c
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
2020-06-17 16:40:22 +02:00
panic.c
panic: ensure preemption is disabled during panic()
2019-10-07 15:47:19 -07:00
params.c
lockdown: Lock down module params that specify hardware parameters (eg. ioport)
2019-08-19 21:54:16 -07:00
pid.c
pid_namespace.c
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 12:26:37 +02:00
profile.c
profiling: fix shift too large makes kernel panic
2022-08-25 11:18:02 +02:00
ptrace.c
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 18:11:24 +02:00
range.c
reboot.c
reboot: fix overflow parsing reboot cpu number
2020-11-18 19:20:30 +01:00
relay.c
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:40:51 +02:00
resource.c
/dev/mem: Revoke mappings when a driver claims the region
2020-06-24 17:50:35 +02:00
rseq.c
seccomp.c
seccomp: Invalidate seccomp mode to catch death failures
2022-02-16 12:52:53 +01:00
signal.c
signal handling: don't use BUG_ON() for debugging
2022-07-21 20:59:27 +02:00
smp.c
smp: Fix offline cpu check in flush_smp_call_function_queue()
2022-04-20 09:19:39 +02:00
smpboot.c
kthread: Extract KTHREAD_IS_PER_CPU
2021-02-07 15:35:49 +01:00
smpboot.h
softirq.c
stackleak.c
stacktrace.c
stacktrace: Don't skip first entry on noncurrent tasks
2019-11-04 21:19:25 +01:00
stop_machine.c
stop_machine: Avoid potential race behaviour
2019-10-17 12:47:12 +02:00
sys.c
prctl: allow to setup brk for et_dyn executables
2021-09-26 14:07:08 +02:00
sys_ni.c
kernel/sys_ni: add compat entry for fadvise64_64
2022-09-05 10:27:38 +02:00
sysctl-test.c
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
2020-10-01 13:17:10 +02:00
sysctl.c
mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE
2022-07-21 20:59:24 +02:00
sysctl_binary.c
task_work.c
taskstats.c
taskstats: fix data-race
2020-01-09 10:19:54 +01:00
test_kprobes.c
torture.c
torture: Remove exporting of internal functions
2019-08-01 14:30:22 -07:00
tracepoint.c
tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2021-07-14 16:53:08 +02:00
tsacct.c
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:59:57 +01:00
ucount.c
proc/sysctl: add shared variables for range check
2019-07-18 17:08:07 -07:00
uid16.c
uid16.h
umh.c
usermodehelper: reset umask to default before executing user process
2020-10-14 10:32:58 +02:00
up.c
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
user-return-notifier.c
user.c
user_namespace.c
utsname.c
utsname_sysctl.c
watchdog.c
watchdog: export lockup_detector_reconfigure
2022-08-25 11:18:37 +02:00
watchdog_hld.c
workqueue.c
workqueue: don't skip lockdep work dependency in cancel_work_sync()
2022-09-28 11:04:09 +02:00
workqueue_internal.h