linux/mm
Joel Fernandes (Google) 8900ab9952 mm: shmem.c: Correctly annotate new inodes for lockdep
commit b45d71fb89 upstream.

Directories and inodes don't necessarily need to be in the same lockdep
class.  For ex, hugetlbfs splits them out too to prevent false positives
in lockdep.  Annotate correctly after new inode creation.  If its a
directory inode, it will be put into a different class.

This should fix a lockdep splat reported by syzbot:

> ======================================================
> WARNING: possible circular locking dependency detected
> 4.18.0-rc8-next-20180810+ #36 Not tainted
> ------------------------------------------------------
> syz-executor900/4483 is trying to acquire lock:
> 00000000d2bfc8fe (&sb->s_type->i_mutex_key#9){++++}, at: inode_lock
> include/linux/fs.h:765 [inline]
> 00000000d2bfc8fe (&sb->s_type->i_mutex_key#9){++++}, at:
> shmem_fallocate+0x18b/0x12e0 mm/shmem.c:2602
>
> but task is already holding lock:
> 0000000025208078 (ashmem_mutex){+.+.}, at: ashmem_shrink_scan+0xb4/0x630
> drivers/staging/android/ashmem.c:448
>
> which lock already depends on the new lock.
>
> -> #2 (ashmem_mutex){+.+.}:
>        __mutex_lock_common kernel/locking/mutex.c:925 [inline]
>        __mutex_lock+0x171/0x1700 kernel/locking/mutex.c:1073
>        mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1088
>        ashmem_mmap+0x55/0x520 drivers/staging/android/ashmem.c:361
>        call_mmap include/linux/fs.h:1844 [inline]
>        mmap_region+0xf27/0x1c50 mm/mmap.c:1762
>        do_mmap+0xa10/0x1220 mm/mmap.c:1535
>        do_mmap_pgoff include/linux/mm.h:2298 [inline]
>        vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357
>        ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1585
>        __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
>        __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
>        __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91
>        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
>        entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> -> #1 (&mm->mmap_sem){++++}:
>        __might_fault+0x155/0x1e0 mm/memory.c:4568
>        _copy_to_user+0x30/0x110 lib/usercopy.c:25
>        copy_to_user include/linux/uaccess.h:155 [inline]
>        filldir+0x1ea/0x3a0 fs/readdir.c:196
>        dir_emit_dot include/linux/fs.h:3464 [inline]
>        dir_emit_dots include/linux/fs.h:3475 [inline]
>        dcache_readdir+0x13a/0x620 fs/libfs.c:193
>        iterate_dir+0x48b/0x5d0 fs/readdir.c:51
>        __do_sys_getdents fs/readdir.c:231 [inline]
>        __se_sys_getdents fs/readdir.c:212 [inline]
>        __x64_sys_getdents+0x29f/0x510 fs/readdir.c:212
>        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
>        entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> -> #0 (&sb->s_type->i_mutex_key#9){++++}:
>        lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924
>        down_write+0x8f/0x130 kernel/locking/rwsem.c:70
>        inode_lock include/linux/fs.h:765 [inline]
>        shmem_fallocate+0x18b/0x12e0 mm/shmem.c:2602
>        ashmem_shrink_scan+0x236/0x630 drivers/staging/android/ashmem.c:455
>        ashmem_ioctl+0x3ae/0x13a0 drivers/staging/android/ashmem.c:797
>        vfs_ioctl fs/ioctl.c:46 [inline]
>        file_ioctl fs/ioctl.c:501 [inline]
>        do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:685
>        ksys_ioctl+0xa9/0xd0 fs/ioctl.c:702
>        __do_sys_ioctl fs/ioctl.c:709 [inline]
>        __se_sys_ioctl fs/ioctl.c:707 [inline]
>        __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:707
>        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
>        entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> other info that might help us debug this:
>
> Chain exists of:
>   &sb->s_type->i_mutex_key#9 --> &mm->mmap_sem --> ashmem_mutex
>
>  Possible unsafe locking scenario:
>
>        CPU0                    CPU1
>        ----                    ----
>   lock(ashmem_mutex);
>                                lock(&mm->mmap_sem);
>                                lock(ashmem_mutex);
>   lock(&sb->s_type->i_mutex_key#9);
>
>  *** DEADLOCK ***
>
> 1 lock held by syz-executor900/4483:
>  #0: 0000000025208078 (ashmem_mutex){+.+.}, at:
> ashmem_shrink_scan+0xb4/0x630 drivers/staging/android/ashmem.c:448

Link: http://lkml.kernel.org/r/20180821231835.166639-1-joel@joelfernandes.org
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: NeilBrown <neilb@suse.com>
Suggested-by: NeilBrown <neilb@suse.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-12-16 22:09:24 +00:00
..
backing-dev.c block: fix bdi vs gendisk lifetime mismatch 2016-11-20 01:17:05 +00:00
balloon_compaction.c mm/balloon_compaction: fix deflation when compaction is disabled 2016-06-15 21:29:35 +01:00
bootmem.c mem-hotplug: reset node managed pages when hot-adding a new pgdat 2014-11-27 11:21:50 +00:00
cleancache.c mm: dump page when hitting a VM_BUG_ON using VM_BUG_ON_PAGE 2014-01-23 16:36:50 -08:00
compaction.c mm/balloon_compaction: redesign ballooned pages management 2016-06-15 21:29:35 +01:00
debug-pagealloc.c mm, x86: Remove debug_pagealloc_enabled 2011-12-06 09:24:07 +01:00
dmapool.c Fix unbalanced mutex in dma_pool_create(). 2014-10-05 13:41:09 -07:00
early_ioremap.c mm: create generic early_ioremap() support 2014-04-07 16:36:15 -07:00
fadvise.c teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long 2013-03-03 22:46:22 -05:00
failslab.c switch debugfs to umode_t 2012-01-03 22:54:56 -05:00
filemap.c mm/filemap.c: fix NULL pointer in page_cache_tree_insert() 2018-10-21 08:45:34 +01:00
filemap_xip.c mm: drop vm_ops->remap_pages and generic_file_remap_pages() stub 2018-10-03 04:09:51 +01:00
frontswap.c mm: frontswap: invalidate expired data on a dup-store failure 2014-12-10 17:49:41 +00:00
gup.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2018-10-03 04:09:52 +01:00
highmem.c Some nice cleanups, and even a patch my wife did as a "live" demo for 2012-12-20 08:37:05 -08:00
huge_memory.c mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() 2018-01-01 20:52:09 +00:00
hugetlb.c mm: hugetlb: yield when prepping struct pages 2018-11-20 18:05:34 +00:00
hugetlb_cgroup.c cgroup: remove css_parent() 2014-05-16 13:22:48 -04:00
hwpoison-inject.c mm/hwpoison: add '#' to hwpoison_inject 2014-01-21 16:19:48 -08:00
init-mm.c mm: Add a user_ns owner to mm_struct and fix ptrace permission checks 2018-01-01 20:52:10 +00:00
internal.h mm, compaction: properly signal and act upon lock and need_sched() contention 2014-06-04 16:54:11 -07:00
interval_tree.c mm: replace vma->sharead.linear with vma->shared 2018-10-03 04:09:52 +01:00
iov_iter.c Fix thinko in iov_iter_single_seg_count 2014-11-27 11:21:48 +00:00
Kconfig mm/zsmalloc: make zsmalloc module-buildable 2014-06-04 16:54:14 -07:00
Kconfig.debug mm: more intensive memory corruption debugging 2012-01-10 16:30:42 -08:00
kmemcheck.c kmemcheck: Fix build errors due to missing slab.h 2010-03-30 22:02:32 +09:00
kmemleak-test.c mm/kmemleak-test.c: use pr_fmt for logging 2014-06-06 16:08:18 -07:00
kmemleak.c mm: kmemleak: allow safe memory scanning during kmemleak disabling 2015-07-15 10:00:54 +01:00
ksm.c mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm() 2018-11-20 18:05:14 +00:00
list_lru.c mm: keep page cache radix tree nodes in check 2014-04-03 16:21:01 -07:00
maccess.c mm: Map most files to use export.h instead of module.h 2011-10-31 09:20:12 -04:00
madvise.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2018-10-03 04:09:52 +01:00
Makefile mm: replace remap_file_pages() syscall with emulation 2018-10-03 04:09:50 +01:00
memblock.c memblock, memhotplug: fix wrong type in memblock_find_in_range_node(). 2014-10-05 13:41:03 -07:00
memcontrol.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2018-10-03 04:09:52 +01:00
memory-failure.c mm/memory-failure.c: use compound_head() flags for huge pages 2017-09-15 18:30:12 +01:00
memory.c mm/tlb: Remove tlb_remove_table() non-concurrent condition 2018-12-16 22:08:52 +00:00
memory_hotplug.c mm/memory_hotplug: define find_{smallest|biggest}_section_pfn as unsigned long 2018-01-01 20:51:48 +00:00
mempolicy.c mm/mempolicy.c: avoid use uninitialized preferred_node 2018-06-16 22:22:47 +01:00
mempool.c mm/mempool.c: update the kmemleak stack trace for mempool allocations 2014-06-06 16:08:17 -07:00
migrate.c rmap: drop support of non-linear mappings 2018-10-03 04:09:51 +01:00
mincore.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2018-10-03 04:09:52 +01:00
mlock.c mm: do not bug_on on incorrect length in __mm_populate() 2018-11-20 18:05:41 +00:00
mm_init.c mm: bring back /sys/kernel/mm 2014-01-27 21:02:39 -08:00
mmap.c mm: do not bug_on on incorrect length in __mm_populate() 2018-11-20 18:05:41 +00:00
mmu_context.c mm/mmu_context, sched/core: Fix mmu_context.h assumption 2018-01-09 00:35:08 +00:00
mmu_notifier.c mm: audit/fix non-modular users of module_init in core code 2014-01-23 16:36:52 -08:00
mmzone.c mm: numa: Change page last {nid,pid} into {cpu,pid} 2013-10-09 14:47:45 +02:00
mprotect.c x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings 2018-10-03 04:10:02 +01:00
mremap.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2018-10-03 04:09:52 +01:00
msync.c mm: remove rest usage of VM_NONLINEAR and pte_file() 2018-10-03 04:09:52 +01:00
nobootmem.c mem-hotplug: reset node managed pages when hot-adding a new pgdat 2014-11-27 11:21:50 +00:00
nommu.c mm: replace remap_file_pages() syscall with emulation 2018-10-03 04:09:50 +01:00
oom_kill.c OOM, PM: OOM killed task shouldn't escape PM suspend 2014-11-05 11:43:09 +00:00
page-writeback.c writeback: use |1 instead of +1 to protect against div by zero 2015-05-20 13:25:57 +01:00
page_alloc.c mm, page_alloc: do not break __GFP_THISNODE by zonelist reset 2018-11-20 18:05:12 +00:00
page_cgroup.c swap: cond_resched in swap_cgroup_prepare() 2017-09-15 18:30:12 +01:00
page_io.c fix __swap_writepage() compile failure on old gcc versions 2014-06-14 19:30:48 -05:00
page_isolation.c mm: fix invalid node in alloc_migrate_target() 2016-05-01 00:06:08 +02:00
pagewalk.c pagewalk: improve vma handling 2018-10-03 04:10:02 +01:00
percpu-km.c percpu: clear memory allocated with the km allocator 2010-10-02 10:28:42 +03:00
percpu-vm.c percpu: perform tlb flush after pcpu_map_pages() failure 2014-10-05 13:41:06 -07:00
percpu.c Revert "percpu: free percpu allocation info for uniprocessor system" 2014-11-14 15:20:06 +00:00
pgtable-generic.c mm: fix TLB flush race between migration, and change_protection_range 2013-12-18 19:04:51 -08:00
process_vm_access.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2017-09-15 18:30:17 +01:00
quicklist.c mm: delete various needless include <linux/module.h> 2011-10-31 09:20:11 -04:00
readahead.c mm/readahead.c: inline ra_submit 2014-04-07 16:35:58 -07:00
rmap.c ksm: add cond_resched() to the rmap_walks 2018-11-20 18:05:14 +00:00
shmem.c mm: shmem.c: Correctly annotate new inodes for lockdep 2018-12-16 22:09:24 +00:00
slab.c cpuset: PF_SPREAD_PAGE and PF_SPREAD_SLAB should be atomic flags 2017-10-12 15:28:22 +01:00
slab.h memcg, slab: merge memcg_{bind,release}_pages to memcg_{un}charge_slab 2014-06-04 16:54:01 -07:00
slab_common.c Merge branch 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux into for-3.16-rcX 2014-07-22 18:38:27 -04:00
slob.c slab: get_online_mems for kmem_cache_{create,destroy,shrink} 2014-06-04 16:53:59 -07:00
slub.c slub/memcg: cure the brainless abuse of sysfs attributes 2017-09-15 18:29:54 +01:00
sparse-vmemmap.c mm/sparse: use memblock apis for early memory allocations 2014-01-21 16:19:47 -08:00
sparse.c mm: use macros from compiler.h instead of __attribute__((...)) 2014-04-07 16:35:54 -07:00
swap.c rmap: drop support of non-linear mappings 2018-10-03 04:09:51 +01:00
swap_state.c mm: page_alloc: convert hot/cold parameter and immediate callers to bool 2014-06-04 16:54:09 -07:00
swapfile.c mm/swapfile.c: fix swap_count comment about nonexistent SWAP_HAS_CONT 2018-11-20 18:05:14 +00:00
truncate.c mm: Remove false WARN_ON from pagecache_isize_extended() 2014-11-13 11:49:03 +00:00
util.c fs/proc: Stop trying to report thread stacks 2018-11-20 18:05:58 +00:00
vmacache.c mm: get rid of vmacache_flush_all() entirely 2018-09-25 23:47:35 +01:00
vmalloc.c mm/vmalloc.c: export unmap_kernel_range() 2014-06-04 16:54:14 -07:00
vmpressure.c mm: vmpressure: fix sending wrong events on underflow 2017-06-05 21:17:16 +01:00
vmscan.c mm: fix the NULL mapping case in __isolate_lru_page() 2018-06-16 22:22:04 +01:00
vmstat.c KAISER: Kernel Address Isolation 2018-01-09 00:35:13 +00:00
workingset.c mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page() 2016-11-20 01:17:36 +00:00
zbud.c mm/zbud.c: make size unsigned like unique callsite 2014-06-04 16:54:13 -07:00
zsmalloc.c zsmalloc: fixup trivial zs size classes value in comments 2014-06-04 16:54:13 -07:00
zswap.c mm/zswap: NUMA aware allocation for zswap_dstmem 2014-06-04 16:54:14 -07:00