From 9ffee4cbc51907755809d98613d9e7133612803a Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Wed, 14 May 2008 16:05:58 -0700 Subject: [PATCH] tty_check_change(): avoid taking tasklist_lock while holding tty->ctrl_lock May 11 09:42:27 [kernel] [ 1104.496819] rarian-sk-get-c[5630]: segfault at 0 ip 7f478556caf0 sp 7fff8e3fe338 error 4 in libc-2.6.1.so[7f47854f9000+136000] May 11 10:59:48 [kernel] [ 2494.165792] May 11 10:59:48 [kernel] [ 2494.165794] ======================================================= May 11 10:59:48 [kernel] [ 2494.165801] [ INFO: possible circular locking dependency detected ] May 11 10:59:48 [kernel] [ 2494.165805] 2.6.26-rc1-00007-g91b3a7a #217 May 11 10:59:48 [kernel] [ 2494.165807] ------------------------------------------------------- May 11 10:59:48 [kernel] [ 2494.165809] less/7053 is trying to acquire lock: May 11 10:59:48 [kernel] [ 2494.165812] (tasklist_lock){..??}, at: [] is_current_pgrp_orphaned+0x15/0x50 May 11 10:59:48 [kernel] [ 2494.165821] May 11 10:59:48 [kernel] [ 2494.165822] but task is already holding lock: May 11 10:59:48 [kernel] [ 2494.165824] (&tty->ctrl_lock){....}, at: [] tty_check_change+0x61/0x110 May 11 10:59:48 [kernel] [ 2494.165831] May 11 10:59:48 [kernel] [ 2494.165832] which lock already depends on the new lock. May 11 10:59:48 [kernel] [ 2494.165833] May 11 10:59:48 [kernel] [ 2494.165835] May 11 10:59:48 [kernel] [ 2494.165836] the existing dependency chain (in reverse order) is: May 11 10:59:48 [kernel] [ 2494.165838] May 11 10:59:48 [kernel] [ 2494.165839] -> #2 (&tty->ctrl_lock){....}: May 11 10:59:48 [kernel] [ 2494.165843] [] __lock_acquire+0xf86/0x1080 May 11 10:59:48 [kernel] [ 2494.165851] [] lock_acquire+0x92/0xc0 May 11 10:59:48 [kernel] [ 2494.165858] [] _spin_lock_irqsave+0x40/0x60 May 11 10:59:48 [kernel] [ 2494.165866] [] __proc_set_tty+0x35/0xe0 May 11 10:59:48 [kernel] [ 2494.165873] [] tty_ioctl+0xbf4/0xfe0 May 11 10:59:48 [kernel] [ 2494.165880] [] vfs_ioctl+0x31/0x90 May 11 10:59:48 [kernel] [ 2494.165888] [] do_vfs_ioctl+0x73/0x2d0 May 11 10:59:48 [kernel] [ 2494.165895] [] sys_ioctl+0x4a/0x80 May 11 10:59:48 [kernel] [ 2494.165902] [] system_call_after_swapgs+0x7b/0x80 May 11 10:59:48 [kernel] [ 2494.165910] [] 0xffffffffffffffff May 11 10:59:48 [kernel] [ 2494.165924] May 11 10:59:48 [kernel] [ 2494.165925] -> #1 (&sighand->siglock){++..}: May 11 10:59:48 [kernel] [ 2494.165929] [] __lock_acquire+0xf86/0x1080 May 11 10:59:48 [kernel] [ 2494.165936] [] lock_acquire+0x92/0xc0 May 11 10:59:48 [kernel] [ 2494.165943] [] _spin_lock+0x2f/0x40 May 11 10:59:48 [kernel] [ 2494.165951] [] copy_process+0x973/0x1210 May 11 10:59:48 [kernel] [ 2494.165959] [] do_fork+0x82/0x2f0 May 11 10:59:48 [kernel] [ 2494.165967] [] kernel_thread+0x81/0xde May 11 10:59:48 [kernel] [ 2494.165974] [] child_rip+0xa/0x12 May 11 10:59:48 [kernel] [ 2494.165981] [] 0xffffffffffffffff May 11 10:59:48 [kernel] [ 2494.166038] May 11 10:59:48 [kernel] [ 2494.166039] -> #0 (tasklist_lock){..??}: May 11 10:59:48 [kernel] [ 2494.166043] [] __lock_acquire+0xd9b/0x1080 May 11 10:59:48 [kernel] [ 2494.166050] [] lock_acquire+0x92/0xc0 May 11 10:59:48 [kernel] [ 2494.166057] [] _read_lock+0x32/0x50 May 11 10:59:48 [kernel] [ 2494.166063] [] is_current_pgrp_orphaned+0x15/0x50 May 11 10:59:48 [kernel] [ 2494.166071] [] tty_check_change+0xb0/0x110 May 11 10:59:48 [kernel] [ 2494.166078] [] set_termios+0x1f/0x4c0 May 11 10:59:48 [kernel] [ 2494.166085] [] tty_mode_ioctl+0x279/0x3e0 May 11 10:59:48 [kernel] [ 2494.166092] [] n_tty_ioctl+0x3d/0x260 May 11 10:59:48 [kernel] [ 2494.166100] [] tty_ioctl+0x154/0xfe0 May 11 10:59:48 [kernel] [ 2494.166107] [] vfs_ioctl+0x31/0x90 May 11 10:59:48 [kernel] [ 2494.166114] [] do_vfs_ioctl+0x73/0x2d0 May 11 10:59:48 [kernel] [ 2494.166121] [] sys_ioctl+0x4a/0x80 May 11 10:59:48 [kernel] [ 2494.166128] [] system_call_after_swapgs+0x7b/0x80 May 11 10:59:48 [kernel] [ 2494.166135] [] 0xffffffffffffffff May 11 10:59:48 [kernel] [ 2494.166142] May 11 10:59:48 [kernel] [ 2494.166143] other info that might help us debug this: May 11 10:59:48 [kernel] [ 2494.166144] May 11 10:59:48 [kernel] [ 2494.166146] 1 lock held by less/7053: May 11 10:59:48 [kernel] [ 2494.166148] #0: (&tty->ctrl_lock){....}, at: [] tty_check_change+0x61/0x110 May 11 10:59:48 [kernel] [ 2494.166155] May 11 10:59:48 [kernel] [ 2494.166156] stack backtrace: May 11 10:59:48 [kernel] [ 2494.166159] Pid: 7053, comm: less Not tainted 2.6.26-rc1-00007-g91b3a7a #217 May 11 10:59:48 [kernel] [ 2494.166161] May 11 10:59:48 [kernel] [ 2494.166162] Call Trace: May 11 10:59:48 [kernel] [ 2494.166168] [] print_circular_bug_tail+0x83/0x90 May 11 10:59:48 [kernel] [ 2494.166172] [] ? print_circular_bug_entry+0x49/0x60 May 11 10:59:48 [kernel] [ 2494.166178] [] __lock_acquire+0xd9b/0x1080 May 11 10:59:48 [kernel] [ 2494.166184] [] ? is_current_pgrp_orphaned+0x15/0x50 May 11 10:59:48 [kernel] [ 2494.166189] [] lock_acquire+0x92/0xc0 May 11 10:59:48 [kernel] [ 2494.166206] [] tty_check_change+0xb0/0x110 May 11 10:59:48 [kernel] [ 2494.166211] [] set_termios+0x1f/0x4c0 May 11 10:59:48 [kernel] [ 2494.166216] [] ? tty_ldisc_try+0x23/0x60 May 11 10:59:48 [kernel] [ 2494.166220] [] ? tty_ldisc_try+0x44/0x60 May 11 10:59:48 [kernel] [ 2494.166224] [] ? _spin_unlock_irqrestore+0x65/0x80 May 11 10:59:48 [kernel] [ 2494.166230] [] tty_mode_ioctl+0x279/0x3e0 May 11 10:59:48 [kernel] [ 2494.166234] [] ? tty_ldisc_try+0x44/0x60 May 11 10:59:48 [kernel] [ 2494.166239] [] n_tty_ioctl+0x3d/0x260 May 11 10:59:48 [kernel] [ 2494.166244] [] tty_ioctl+0x154/0xfe0 May 11 10:59:48 [kernel] [ 2494.166249] [] ? __lock_acquire+0x39a/0x1080 May 11 10:59:48 [kernel] [ 2494.166256] [] ? __lock_acquire+0x39a/0x1080 May 11 10:59:48 [kernel] [ 2494.166263] [] ? __lock_acquire+0x39a/0x1080 May 11 10:59:48 [kernel] [ 2494.166269] [] vfs_ioctl+0x31/0x90 May 11 10:59:48 [kernel] [ 2494.166274] [] do_vfs_ioctl+0x73/0x2d0 May 11 10:59:48 [kernel] [ 2494.166280] [] sys_ioctl+0x4a/0x80 May 11 10:59:48 [kernel] [ 2494.166286] [] system_call_after_swapgs+0x7b/0x80 May 11 10:59:48 [kernel] [ 2494.166292] Acked-by: Alan Cox Reported-by: Marcin Slusarz Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/char/tty_io.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c index 49c1a2267a5..e94bee03231 100644 --- a/drivers/char/tty_io.c +++ b/drivers/char/tty_io.c @@ -1215,10 +1215,11 @@ int tty_check_change(struct tty_struct *tty) if (!tty->pgrp) { printk(KERN_WARNING "tty_check_change: tty->pgrp == NULL!\n"); - goto out; + goto out_unlock; } if (task_pgrp(current) == tty->pgrp) - goto out; + goto out_unlock; + spin_unlock_irqrestore(&tty->ctrl_lock, flags); if (is_ignored(SIGTTOU)) goto out; if (is_current_pgrp_orphaned()) { @@ -1229,6 +1230,8 @@ int tty_check_change(struct tty_struct *tty) set_thread_flag(TIF_SIGPENDING); ret = -ERESTARTSYS; out: + return ret; +out_unlock: spin_unlock_irqrestore(&tty->ctrl_lock, flags); return ret; } -- 2.41.1