• Linus Torvalds's avatar
    Fix race in tty_fasync() properly · 80e1e823
    Linus Torvalds authored
    This reverts commit 70362511 ("tty: fix race in tty_fasync") and
    commit b04da8bf ("fnctl: f_modown should call write_lock_irqsave/
    restore") that tried to fix up some of the fallout but was incomplete.
    
    It turns out that we really cannot hold 'tty->ctrl_lock' over calling
    __f_setown, because not only did that cause problems with interrupt
    disables (which the second commit fixed), it also causes a potential
    ABBA deadlock due to lock ordering.
    
    Thanks to Tetsuo Handa for following up on the issue, and running
    lockdep to show the problem.  It goes roughly like this:
    
     - f_getown gets filp->f_owner.lock for reading without interrupts
       disabled, so an interrupt that happens while that lock is held can
       cause a lockdep chain from f_owner.lock -> sighand->siglock.
    
     - at the same time, the tty->ctrl_lock -> f_owner.lock chain that
       commit 70362511 introduced, together with the pre-existing
       sighand->siglock -> tty->ctrl_lock chain means that we have a lock
       dependency the other way too.
    
    So instead of extending tty->ctrl_lock over the whole __f_setown() call,
    we now just take a reference to the 'pid' structure while holding the
    lock, and then release it after having done the __f_setown.  That still
    guarantees that 'struct pid' won't go away from under us, which is all
    we really ever needed.
    Reported-and-tested-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Acked-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
    Acked-by: default avatarAmérico Wang <xiyou.wangcong@gmail.com>
    Cc: stable@kernel.org
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    80e1e823
tty_io.c 77.8 KB