Merge tag 'locks-v4.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton...
authorLinus Torvalds <torvalds@linux-foundation.org>
Mon, 4 Jun 2018 20:05:02 +0000 (13:05 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Mon, 4 Jun 2018 20:05:02 +0000 (13:05 -0700)
Pull fasync fix from Jeff Layton:
 "Just a single fix for a deadlock in the fasync handling code that
  Kirill observed while testing.

  The fix is to change the fa_lock to be rwlock_t, and use a read lock
  in kill_fasync_rcu"

* tag 'locks-v4.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux:
  fasync: Fix deadlock between task-context and interrupt-context kill_fasync()

fs/fcntl.c
include/linux/fs.h

index d737ff082472ef03cc2365270ac79b97aed68db6..c42169459298ba774a10fdcab553ee38543a530b 100644 (file)
@@ -871,9 +871,9 @@ int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
                if (fa->fa_file != filp)
                        continue;
 
-               spin_lock_irq(&fa->fa_lock);
+               write_lock_irq(&fa->fa_lock);
                fa->fa_file = NULL;
-               spin_unlock_irq(&fa->fa_lock);
+               write_unlock_irq(&fa->fa_lock);
 
                *fp = fa->fa_next;
                call_rcu(&fa->fa_rcu, fasync_free_rcu);
@@ -918,13 +918,13 @@ struct fasync_struct *fasync_insert_entry(int fd, struct file *filp, struct fasy
                if (fa->fa_file != filp)
                        continue;
 
-               spin_lock_irq(&fa->fa_lock);
+               write_lock_irq(&fa->fa_lock);
                fa->fa_fd = fd;
-               spin_unlock_irq(&fa->fa_lock);
+               write_unlock_irq(&fa->fa_lock);
                goto out;
        }
 
-       spin_lock_init(&new->fa_lock);
+       rwlock_init(&new->fa_lock);
        new->magic = FASYNC_MAGIC;
        new->fa_file = filp;
        new->fa_fd = fd;
@@ -987,14 +987,13 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 {
        while (fa) {
                struct fown_struct *fown;
-               unsigned long flags;
 
                if (fa->magic != FASYNC_MAGIC) {
                        printk(KERN_ERR "kill_fasync: bad magic number in "
                               "fasync_struct!\n");
                        return;
                }
-               spin_lock_irqsave(&fa->fa_lock, flags);
+               read_lock(&fa->fa_lock);
                if (fa->fa_file) {
                        fown = &fa->fa_file->f_owner;
                        /* Don't send SIGURG to processes which have not set a
@@ -1003,7 +1002,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
                        if (!(sig == SIGURG && fown->signum == 0))
                                send_sigio(fown, fa->fa_fd, band);
                }
-               spin_unlock_irqrestore(&fa->fa_lock, flags);
+               read_unlock(&fa->fa_lock);
                fa = rcu_dereference(fa->fa_next);
        }
 }
index 5d306028f0a201f78572b3d807742cfa7b296813..7f86730b67a9804233e72fa43c72f550e95be03a 100644 (file)
@@ -1250,7 +1250,7 @@ static inline int locks_lock_file_wait(struct file *filp, struct file_lock *fl)
 }
 
 struct fasync_struct {
-       spinlock_t              fa_lock;
+       rwlock_t                fa_lock;
        int                     magic;
        int                     fa_fd;
        struct fasync_struct    *fa_next; /* singly linked list */