2013-07-29 02:58:27

by Alexey Khoroshilov

Subject: [PATCH] libceph: fix deadlock in ceph_build_auth()

ceph_build_auth() locks ac->mutex and then calls ceph_auth_build_hello()
that locks the same mutex, i.e. bring itself to deadlock.

The patch moves actual code from ceph_auth_build_hello() to
ceph_build_hello_auth_request() that should be called with ac->mutex held
and makes ceph_build_auth() calling it.
ceph_auth_build_hello() is left with untouched semantics as a wrapper
around ceph_build_hello_auth_request().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <[email protected]>
---
net/ceph/auth.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/net/ceph/auth.c b/net/ceph/auth.c
index 6b923bc..59594a6 100644
--- a/net/ceph/auth.c
+++ b/net/ceph/auth.c
@@ -98,14 +98,14 @@ int ceph_entity_name_encode(const char *name, void **p, void *end)
* Initiate protocol negotiation with monitor. Include entity name
* and list supported protocols.
*/
-int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
+static int ceph_build_hello_auth_request(struct ceph_auth_client *ac,
+ void *buf, size_t len)
{
struct ceph_mon_request_header *monhdr = buf;
void *p = monhdr + 1, *end = buf + len, *lenp;
int i, num;
int ret;

- mutex_lock(&ac->mutex);
dout("auth_build_hello\n");
monhdr->have_version = 0;
monhdr->session_mon = cpu_to_le16(-1);
@@ -133,7 +133,6 @@ int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
ceph_encode_32(&lenp, p - lenp - sizeof(u32));
ret = p - buf;
out:
- mutex_unlock(&ac->mutex);
return ret;

bad:
@@ -141,6 +140,16 @@ bad:
goto out;
}

+int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
+{
+ int ret;
+
+ mutex_lock(&ac->mutex);
+ ret = ceph_build_hello_auth_request(ac, buf, len);
+ mutex_unlock(&ac->mutex);
+ return ret;
+}
+
static int ceph_build_auth_request(struct ceph_auth_client *ac,
void *msg_buf, size_t msg_len)
{
@@ -260,7 +269,7 @@ int ceph_build_auth(struct ceph_auth_client *ac,

mutex_lock(&ac->mutex);
if (!ac->protocol)
- ret = ceph_auth_build_hello(ac, msg_buf, msg_len);
+ ret = ceph_build_hello_auth_request(ac, msg_buf, msg_len);
else if (ac->ops->should_authenticate(ac))
ret = ceph_build_auth_request(ac, msg_buf, msg_len);
mutex_unlock(&ac->mutex);
--
1.8.1.2

2013-07-30 23:27:17

by David Miller

Subject: Re: [PATCH] libceph: fix deadlock in ceph_build_auth()

From: Alexey Khoroshilov <[email protected]>
Date: Mon, 29 Jul 2013 06:58:08 +0400

> ceph_build_auth() locks ac->mutex and then calls ceph_auth_build_hello()
> that locks the same mutex, i.e. bring itself to deadlock.
>
> The patch moves actual code from ceph_auth_build_hello() to
> ceph_build_hello_auth_request() that should be called with ac->mutex held
> and makes ceph_build_auth() calling it.
> ceph_auth_build_hello() is left with untouched semantics as a wrapper
> around ceph_build_hello_auth_request().
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <[email protected]>

I'm assume the ceph developers will pick this up, thanks.