On Fri, 2009-02-20 at 12:22 -0800, Andrew Morton wrote: > On Fri, 20 Feb 2009 14:00:21 +0300 > Alexander Beregalov <a.beregalov@xxxxxxxxx> wrote: > > > Hi > > > > I have applied the following patch from Mimi Zohar > > http://marc.info/?l=linux-next&m=123509665514552 > > > > That is why it is dirty. > > The kernel can not boot without it when IMA is enabled. With CONFIG_DEBUG_SG and IMA defined, it couldn't boot. > > BUG: sleeping function called from invalid context at mm/slub.c:1613 > > in_atomic(): 1, irqs_disabled(): 0, pid: 1514, name: mkdir > > 3 locks held by mkdir/1514: > > #0: (&type->i_mutex_dir_key#2/1){+.+.+.}, at: [<ffffffff802d3460>] > > lookup_create+0x30/0xd0 > > #1: (&(&ip->i_lock)->mr_lock/1){+.+.+.}, at: [<ffffffff803ca77f>] > > xfs_ilock+0xdf/0x120 > > #2: (&pag->pag_ici_lock){++++.+}, at: [<ffffffff803caed6>] > > xfs_iget+0x156/0x650 > > Pid: 1514, comm: mkdir Not tainted 2.6.29-rc5-next-20090220-dirty #1 > > Call Trace: > > [<ffffffff8026ad33>] ? __debug_show_held_locks+0x13/0x30 > > [<ffffffff80234fe5>] __might_sleep+0x105/0x140 > > [<ffffffff802c6191>] kmem_cache_alloc+0xd1/0x100 > > [<ffffffff8045fb29>] ima_iint_insert+0x49/0xf0 > > [<ffffffff8045fbed>] ima_inode_alloc+0x1d/0x30 > > [<ffffffff802dfa5f>] inode_init_always+0xaf/0x250 > > [<ffffffff803caf86>] xfs_iget+0x206/0x650 > > [<ffffffff803eb8e8>] xfs_trans_iget+0x208/0x250 > > [<ffffffff803ce571>] xfs_ialloc+0xc1/0x700 > > [<ffffffff803ec6f9>] xfs_dir_ialloc+0xa9/0x340 > > [<ffffffff8025e009>] ? down_write_nested+0x79/0x90 > > [<ffffffff803ef0c1>] xfs_create+0x3e1/0x690 > > [<ffffffff803fb813>] xfs_vn_mknod+0x63/0xf0 > > [<ffffffff803fb8ae>] xfs_vn_mkdir+0xe/0x10 > > [<ffffffff802d487c>] vfs_mkdir+0x8c/0xd0 > > [<ffffffff802d6a56>] sys_mkdirat+0x106/0x120 > > [<ffffffff8020bc0c>] ? sysret_check+0x27/0x62 > > [<ffffffff8026c79d>] ? trace_hardirqs_on_caller+0x17d/0x1e0 > > [<ffffffff802d6a83>] sys_mkdir+0x13/0x20 > > [<ffffffff8020bbdb>] system_call_fastpath+0x16/0x1b > > BUG: sleeping function called from invalid context at mm/slub.c:1613 > > Please do not be tempted to switch ima_iint_insert() to use GFP_ATOMIC > to "fix" this. > > Arguably, ima_iint_insert() should requite that the caller pass in the > gfp_t rather than assuming that GFP_KERNEL can be used. But that is > not a suitable fix for this bug. > > We may need to make that change to ima_iint_insert() anyway, as there's > a good chance that callers will require GFP_NOFS. > > > But to fix this bug, xfs needs to stop calling inode_init_always() > under read_lock(). Because inode_alloc_security() also can sleep (see > new_inode_smack()). > > Also, ima_iint_insert() does a radix_tree_lookup() without holding > ima_iint_lock, which appears to be a bug. Thank you. For now, here's a patch to add locking around the radix_tree_lookup(). I'll look into passing gfp_t. Mimi integrity: ima iint radix_tree_lookup locking fix Based on Andrew Morton's comments: - add missing locks around radix_tree_lookup in ima_iint_insert() Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxx> Index: security-testing-2.6/security/integrity/ima/ima_iint.c =================================================================== --- security-testing-2.6.orig/security/integrity/ima/ima_iint.c +++ security-testing-2.6/security/integrity/ima/ima_iint.c @@ -73,8 +73,10 @@ out: if (rc < 0) { kmem_cache_free(iint_cache, iint); if (rc == -EEXIST) { + spin_lock(&ima_iint_lock); iint = radix_tree_lookup(&ima_iint_store, (unsigned long)inode); + spin_unlock(&ima_iint_lock); } else iint = NULL; } -- To unsubscribe from this list: send the line "unsubscribe linux-next" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
