From patchwork Wed Feb 26 18:56:25 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yosry Ahmed X-Patchwork-Id: 13992989 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B3EAC021B8 for ; Wed, 26 Feb 2025 18:56:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 046A4280002; Wed, 26 Feb 2025 13:56:46 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id F0F50280001; Wed, 26 Feb 2025 13:56:45 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D6224280002; Wed, 26 Feb 2025 13:56:45 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id AFB27280001 for ; Wed, 26 Feb 2025 13:56:45 -0500 (EST) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 77ACB1A067D for ; Wed, 26 Feb 2025 18:56:45 +0000 (UTC) X-FDA: 83163002370.14.B48EE16 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) by imf16.hostedemail.com (Postfix) with ESMTP id 81FC7180006 for ; Wed, 26 Feb 2025 18:56:43 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=YaNvZkTn; spf=pass (imf16.hostedemail.com: domain of yosry.ahmed@linux.dev designates 91.218.175.180 as permitted sender) smtp.mailfrom=yosry.ahmed@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1740596204; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=N8k5YcDw/4VVVoJt0g7ZtdcJRICdTIVq9GtV33GN43Q=; b=61CE6h9vhLhyf4FGvxNU6SU14iI1SuCc0qZvP2r7OMAbHNavl9wehC/5pIpYMR+eSsCjzm TOrK9hMFZiRhUPQGw4iZCmp7v8VDoSgjj/8kzy8qKOaIKLwuIVBK3s6nLy488QfsVN3cgR Me8yImjaYz3dpVpJwn+wPV2fxRTcaro= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=YaNvZkTn; spf=pass (imf16.hostedemail.com: domain of yosry.ahmed@linux.dev designates 91.218.175.180 as permitted sender) smtp.mailfrom=yosry.ahmed@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1740596204; a=rsa-sha256; cv=none; b=3eZLT7mWs5xYtCFxT5ufXplzpa8I+j7KWR76VQA9G+RR08ua0DU3L6FHr+ewbkAUD4MugJ 7xnGOlzGbd+3XZ3/Ee/q9GCi1CY5ynKu+JmQDECbJrtjI2OrysZSxhIoncEfRRRfR2kDw8 N/zKCL5O21eMy/TLKQeKEw1WAcp18OI= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1740596200; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=N8k5YcDw/4VVVoJt0g7ZtdcJRICdTIVq9GtV33GN43Q=; b=YaNvZkTnOHDLxyQIGgKvqM0HAojGOASBbcB6efdVyccFg/kHmuLMQSGnAfjxgT7154Nqss Gyq8YeI88LRUDOrnIYbtZGZGksf58O/nV3chzVwf2utfExIgizxXtT0eOVYUb2tGAAx4v/ 14L6ljsqjbvbLMdzmnP0hqDnEJvp+zg= From: Yosry Ahmed To: Andrew Morton Cc: Johannes Weiner , Nhat Pham , Chengming Zhou , "David S. Miller" , Herbert Xu , linux-mm@kvack.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Yosry Ahmed , syzbot+1a517ccfcbc6a7ab0f82@syzkaller.appspotmail.com, stable@vger.kernel.org Subject: [PATCH v2] mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Date: Wed, 26 Feb 2025 18:56:25 +0000 Message-ID: <20250226185625.2672936-1-yosry.ahmed@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Queue-Id: 81FC7180006 X-Stat-Signature: wsfofspg95543qazsfctwed3cscx87m6 X-Rspamd-Server: rspam03 X-HE-Tag: 1740596203-184340 X-HE-Meta: U2FsdGVkX1+S7aDCl3e7cXEg3aKSakPq9C5iQoFM1mPZl8U4hhmKJVNAnltItZL94ygf3vxUSCNMPMn0jmFpUbjsMTCmWHOyHMaiSKqCGE9a/CPCywBwKU1JIKeFn1y7ica3rD41M27RBGE+IdXq/jMjr04JNYabKdUnnuOFR4JlwEU/SHnNec+a4zraeXiCAWrLuujnu1qBYhp21WsQ/veaNgnPVJuFD36wS4QZ1UguzTFyli98syhS5gwywXG27gktO1x+LVkEQzE/4qAf6Zss1TqJroyEZ7mfWePg+iQWI33TdMn4s+vvXJwiKAdtE9pmRBy7dH0BXOma01LJmkpKht3SAUgytBhB2hIt9e2LXq8VrXWl4GC2gqTCwCxPh4KOmAu06Bi5u6xTHRxSyrz2ya2i8LOXU3N32sIo7XDQ2nhMWWQYs7drmCserU6KgG0JbdMupHutyVzvVU3HqMjGUsdBRenPovE91Ich3ril4kK7i/I/tOBTb0NksObOjMWjJvhLuMNcIWHYoU1XnevilPU33IDO/R2q9tnyRjCKVpYohgB7osvF1FjVGJPx1XZWtFpxpyNaOSJDX2KZHWr/W+6NuNGMtZRl4rvHYRcF19ZAf0PguIV3m79T4pTA3bhhXfBtA1ewFj/MTR758x97MEvS98XcdbvYBwWvqtcVD26UUzz4eLT7J0r4x0zY3M3D5ZLWNHz88j4gpY2vGtGjbwd5QgBCdqgXoavoGeWBDAeq4B8fqO2/owyVgzgrO3Mfo84Ntr41nhNfKLp5E1MYqQlHmmiXMUqj5HiZsqtof7F66LD0nnASmVbnFAoo2v+PosfvztswmTqfozj8R39QwjuLUA7wS8kasrG18Nux2S/fmYV7CUEOaPUEpaljQKkwFDR6KQtrmB0IRSFWNmf23DnDBZXgxBm2BtJqj9wi6y4MZ9z1iRvQeO5VyTcBaQcA/gGNa4jyRqWXVFa Vr7wromB qp/i0K0d6GYsirZmuzvhaHoNG48PjCfOyWJccKr/aROl2NE1+FoX5r+rlas00AWtUtHX2vhSEgIdR1hC+2uCQPLoURJtGA5RS+bJwJA9qHvT8ubiaLX2cQVTdHPBznUREV4HRf0jc6RDxKFBy089kAAWf48qD0ARaA4L7h6QiqOMqUfG/ybK+RhhWRpAf0HOsm1bCQgr7tpY3MjO/rMidTeZwwbE+aT4YWt/kvM11qAFjvkf1SKrmPnQ/qk94k4th34bXw1BeARGFvEkUkDT6gFxP7t4WspuUGi6ttXXO37gLi+5q7BOeindmVyKp6IUbq6IJDRdQBKsvw5go8EFgyvmFWzxmkXTUpO8kMoKInv+QTQgZBWfLathiAGvEkAs6k5wl/CIbQ1g8RSDJ1uE8TZgn6q1CVrk2e4nPAWbaozpsPTKyegbFRr0342Gqh1GOtViw5t71oUy/C3onqeyCXxnSxuPinr02xaJv3gfXMivABhQ= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() then holds scomp_lock (through crypto_exit_scomp_ops_async()). On the other hand, crypto_alloc_acomp_node() holds the scomp_lock (through crypto_scomp_init_tfm()), and then allocates memory. If the allocation results in reclaim, we may attempt to hold the per-CPU acomp_ctx mutex. The above dependencies can cause an ABBA deadlock. For example in the following scenario: (1) Task A running on CPU #1: crypto_alloc_acomp_node() Holds scomp_lock Enters reclaim Reads per_cpu_ptr(pool->acomp_ctx, 1) (2) Task A is descheduled (3) CPU #1 goes offline zswap_cpu_comp_dead(CPU #1) Holds per_cpu_ptr(pool->acomp_ctx, 1)) Calls crypto_free_acomp() Waits for scomp_lock (4) Task A running on CPU #2: Waits for per_cpu_ptr(pool->acomp_ctx, 1) // Read on CPU #1 DEADLOCK Since there is no requirement to call crypto_free_acomp() with the per-CPU acomp_ctx mutex held in zswap_cpu_comp_dead(), move it after the mutex is unlocked. Also move the acomp_request_free() and kfree() calls for consistency and to avoid any potential sublte locking dependencies in the future. With this, only setting acomp_ctx fields to NULL occurs with the mutex held. This is similar to how zswap_cpu_comp_prepare() only initializes acomp_ctx fields with the mutex held, after performing all allocations before holding the mutex. Opportunistically, move the NULL check on acomp_ctx so that it takes place before the mutex dereference. Fixes: 12dcb0ef5406 ("mm: zswap: properly synchronize freeing resources during CPU hotunplug") Reported-by: syzbot+1a517ccfcbc6a7ab0f82@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67bcea51.050a0220.bbfd1.0096.GAE@google.com/ Cc: Co-developed-by: Herbert Xu Signed-off-by: Herbert Xu Signed-off-by: Yosry Ahmed Acked-by: Herbert Xu Reviewed-by: Chengming Zhou --- v1 -> v2: - Explained the problem more clearly in the commit message. - Moved all freeing calls outside the lock critical section. v1: https://lore.kernel.org/all/Z72FJnbA39zWh4zS@gondor.apana.org.au/ --- mm/zswap.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/mm/zswap.c b/mm/zswap.c index ac9d299e7d0c1..adf745c66aa1d 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -881,18 +881,32 @@ static int zswap_cpu_comp_dead(unsigned int cpu, struct hlist_node *node) { struct zswap_pool *pool = hlist_entry(node, struct zswap_pool, node); struct crypto_acomp_ctx *acomp_ctx = per_cpu_ptr(pool->acomp_ctx, cpu); + struct acomp_req *req; + struct crypto_acomp *acomp; + u8 *buffer; + + if (IS_ERR_OR_NULL(acomp_ctx)) + return 0; mutex_lock(&acomp_ctx->mutex); - if (!IS_ERR_OR_NULL(acomp_ctx)) { - if (!IS_ERR_OR_NULL(acomp_ctx->req)) - acomp_request_free(acomp_ctx->req); - acomp_ctx->req = NULL; - if (!IS_ERR_OR_NULL(acomp_ctx->acomp)) - crypto_free_acomp(acomp_ctx->acomp); - kfree(acomp_ctx->buffer); - } + req = acomp_ctx->req; + acomp = acomp_ctx->acomp; + buffer = acomp_ctx->buffer; + acomp_ctx->req = NULL; + acomp_ctx->acomp = NULL; + acomp_ctx->buffer = NULL; mutex_unlock(&acomp_ctx->mutex); + /* + * Do the actual freeing after releasing the mutex to avoid subtle + * locking dependencies causing deadlocks. + */ + if (!IS_ERR_OR_NULL(req)) + acomp_request_free(req); + if (!IS_ERR_OR_NULL(acomp)) + crypto_free_acomp(acomp); + kfree(buffer); + return 0; }