Messages in this thread Patch in this message |  | | From | Joel Fernandes <> | | Subject | [PATCH] ashmem: Fix lockdep issue during llseek | | Date | Thu, 25 Jan 2018 18:46:49 -0800 |
| |
ashmem_mutex create a chain of dependencies like so:
(1) mmap syscall -> mmap_sem -> (acquired) ashmem_mmap ashmem_mutex (try to acquire) (block)
(2) llseek syscall -> ashmem_llseek -> ashmem_mutex -> (acquired) inode_lock -> inode->i_rwsem (try to acquire) (block)
(3) getdents -> iterate_dir -> inode_lock -> inode->i_rwsem (acquired) copy_to_user -> mmap_sem (try to acquire)
There is a lock ordering created between mmap_sem and inode->i_rwsem during a syzcaller test, this patch fixes the issue by releasing the ashmem_mutex before the call to vfs_llseek, and reacquiring it after.
Cc: Todd Kjos <tkjos@google.com> Cc: Arve Hjonnevag <arve@android.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reported-by: syzbot+8ec30bb7bf1a981a2012@syzkaller.appspotmail.com Signed-off-by: Joel Fernandes <joelaf@google.com> --- drivers/staging/android/ashmem.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 0f695df14c9d..248983cf2db1 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -343,7 +343,9 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) goto out; } + mutex_unlock(&ashmem_mutex); ret = vfs_llseek(asma->file, offset, origin); + mutex_lock(&ashmem_mutex); if (ret < 0) goto out; -- 2.16.0.rc1.238.g530d649a79-goog
|  |