Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Daniel Jordan <daniel.m.jordan@oracle.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>,
        Steffen Klassert <steffen.klassert@secunet.com>
Cc:     Nicolai Stange <nstange@suse.de>, Martin Doucha <mdoucha@suse.cz>,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        Daniel Jordan <daniel.m.jordan@oracle.com>
Subject: [PATCH] padata: Always leave BHs disabled when running ->parallel()
Date:   Wed, 16 Nov 2022 20:28:02 -0500
Message-Id: <20221117012802.62504-1-daniel.m.jordan@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?nAK5wwSvPJZ/ebFccB/dlFvPizF1UvQjskNv8p5q5wEB+ZET1kP60EozuvxV?=
 =?us-ascii?Q?tkEvwNP0aMjBDHcdtGb0khhhkryVGpi4mUQMdDSpaJFt+qdFUVstcFjgHSZQ?=
 =?us-ascii?Q?IkDy1lS/7Hp6JEHX8GrJjA99sEdm8l6JsQDn2t7CfzQx+bV6mUAWTHXxRIAk?=
 =?us-ascii?Q?Qs7qquQa4k4mpuyWoNt395SqR/WsCNRnwR/3HAQFYwkG0p3xsLhsW2qL7G0T?=
 =?us-ascii?Q?w6LnJ/wmhvlOf2IPYsfxD2LU3MFjHUhlmcKdP6R1jZ+r2hRXAElV8cIhUfG4?=
 =?us-ascii?Q?vGS22M+DenSTH6q78jrCCvXk2QeQg4yhL44mfhYvYkyBV0Ai2b6bmx6pkwb8?=
 =?us-ascii?Q?I85JTK7QgN/ANx0yedueGjv+q7mfe8r4tpNRjKp6AC4F97i2GIbAOaX9kO3t?=
 =?us-ascii?Q?ytYpIdpgePa9Ff8+Vl5maqh+EezgvSl+HOkKVS2JBHjzfz/ko84PARPZ1U5s?=
 =?us-ascii?Q?q6ndiXu2/IIB92dtmufgDrVZDefi1N4Fr6C59WE7fs1LdYRBeDLkTwG+I2eX?=
 =?us-ascii?Q?NMIRWmWYCzY39VRAhstAK0KIpXQduocFBSU3vsMFNNmHa/XpKhEaUii5p3tJ?=
 =?us-ascii?Q?sNj8CttQE8y/7USXtnd4CYy67QSurSvjdf/dvaO/HxE9UaoO3lD6jDY09MTG?=
 =?us-ascii?Q?LIhuaaj+0rAFj2QhPE2sfVAIscikCPHYh+kbFKiBVtKBf3EWzVkeBMKSfewy?=
 =?us-ascii?Q?WUhFCOBfbbRJuBBhoxlMfcperPPUCpUthi4O+jKBoGiXWnKwBUJ/quOJXaqY?=
 =?us-ascii?Q?pI8aM3fRM9xROrV6yUHEVuxMGTdFsUpHKioYUlbsyiAhcURVRnSQSeQT9+/8?=
 =?us-ascii?Q?EtWKCh2nb8vfJ57TT/z44S/Q5w99kRj34QqR85T0bGHoPcf5dho2kkRjCpiD?=
 =?us-ascii?Q?Lcrsbf7OoiCmXuHxq3C/yml36SuQwkIBKTtsvB6z1/B3oVqMba3xz5mfbtWP?=
 =?us-ascii?Q?RboVKn7vzOBMfH1uCUPN9dtVQSOjO45oVLwjiuruv22SnAuys0x0qK635bOI?=
 =?us-ascii?Q?RkPHvhu9y2iW4TBMD9McihNgBVHz1AO3JeFuw+CFsiUN4Fu0glYC796D0z4h?=
 =?us-ascii?Q?cGewAQ0lbwR/XyDhqIjJeau7SdqTFGk+CTTZeugfNRUkn+fnvmU3j2LrDtkU?=
 =?us-ascii?Q?wNkLShqyZmhZnYC96J8Oq2NHyEqZ3ymVZ32lMgdft0So27JthiDHOuW8bE6W?=
 =?us-ascii?Q?yemfiQ83etuGou+WOikoRhytKq5JqUqFV+dVNqBYEI3VH2S5QZmCg4w6dHDj?=
 =?us-ascii?Q?Jw0b4+bkH2nghFR0H5wAC0IDMvPS8h9Z2yuylG3aTJMGb8sob8zygITiJOoZ?=
 =?us-ascii?Q?2wZYPHv4hjhSRltqodjOfakdEMFgPE69W8V0SrLXJlZEClUAUps+wd6z/qSR?=
 =?us-ascii?Q?u8ENXsE1iB0cUzCYFoRh+j4CFAu+pgCfw66iYU2I50lbTc+XkTZKK2gNs6D5?=
 =?us-ascii?Q?xTl97Yg9p1rVAqApiLEAaB9pgqJNxc7P6illBozhzxRwknLuBvZSABMkRJwG?=
 =?us-ascii?Q?e9JKx37aXvKDNNwoV5AeL0Z3DaRlY1xgPBlARn1Sa8/v6cscgMAVDWUkH8hn?=
 =?us-ascii?Q?jxFkTtxKkmffWzn147v7xmqBfMirODPCKUy3FmBW/ZUOq6A9ykZO77KGGOHv?=
 =?us-ascii?Q?JA=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?EnykmEwqnpN5Se7Rl+B6sax+tbsWBC1F1oJe4amjVL1RuODWONeKd5ic+u+i?=
 =?us-ascii?Q?Q3PMlAcg5ZQGpjd7TrgLKLc6bJeHcIWdCJ1GdApL8dknZBeNAeHqNygHp4He?=
 =?us-ascii?Q?WNt9wW2DzF0teH89uSzZOguBN9MkLkslBWRwcPPRUJeLDY5V749HCVSOI5Uf?=
 =?us-ascii?Q?uL8dpv3eKLvUsvDw+x9kFmDYoMRloamWch0E1qasDlS6NJJVT8wumSol1PIS?=
 =?us-ascii?Q?+gheSg6w1fTeMi8+YKOzXWkevAVvZMSwY4KtXeC+avUqDVTZzQaDqh3Yd01T?=
 =?us-ascii?Q?8rhUrpTyIV+5H9IH1eL18H/xNGeS6RsK7tybsxiSYej2yK8qQJT0jEtHatfw?=
 =?us-ascii?Q?nyuHJYARYgKz6CU1KiAL+hWORSKYY+UvUNilB4XvZYHzR4LFhlse+ex4/QYI?=
 =?us-ascii?Q?AZQLAmc3M3Jo7u2dY2iKCfKPD8Vh/MiNsrZdQMAfq7xRLz8//pe2GvzAT7KJ?=
 =?us-ascii?Q?YT9/44W0kO4eICJxF7cpqJpjucwu7Ts0902Lrp0pirEmmsiPNLsF2qzfLAoE?=
 =?us-ascii?Q?L/Q9+EimLNXNUtwH7HwAjKBrFzc77nENBdK4dqpVQxLmVSE6mrzdrPI+WzXv?=
 =?us-ascii?Q?+3roaIeyVr8bBvfo+V/szQoPAawiuTOnev7/IPxIqngemWl8JZHnt6tEmV+Y?=
 =?us-ascii?Q?b/TyXJr2iOvNlM35h6a/K6PEuYzLPs6Y8bEw+zv/hsxuteRjzUjQ8nopdB4M?=
 =?us-ascii?Q?pWhmBrXEurE6oxNKCInFplS0klUf8pxKcw/GBBiNRJ9+4+95kiDAovSpjovI?=
 =?us-ascii?Q?mBf3pqdN9TBLNU11snQa5aUls/4L+6wq9MmppR8UPvHE0UTu/DHBCPXwIQqc?=
 =?us-ascii?Q?jKzcFZUxFWBJ6NASYmDRdeR+8GPhbO9WhhGTf4C28f1zY34k24JKdry22VW+?=
 =?us-ascii?Q?QDj0q8vgGhxPs7J0c5GJWb3v9XevOUAKFi1Of6ch51QRX2sKjl9wJN6fthp5?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0cfd26bc-0150-45a1-4683-08dac83af8f9
X-MS-Exchange-CrossTenant-AuthSource: SA1PR10MB5711.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2022 01:28:03.8184
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 0NEzSL7zUMVl9eMW5TOurovW5ZWYKDRNocGonDdYEoO3yuP2ZOsl9Ueq9Vd2DJQ/XwXt/BQ6NhVEh4dutQKrvNZ6GbAtJTQZ7xj5s7mrXss=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR10MB5961
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-16_03,2022-11-16_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 bulkscore=0 mlxscore=0
 phishscore=0 suspectscore=0 spamscore=0 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2211170008
X-Proofpoint-GUID: Gj1vdzlpzAul4GiQV9G3nEIR1mkH0I_5
X-Proofpoint-ORIG-GUID: Gj1vdzlpzAul4GiQV9G3nEIR1mkH0I_5
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

A deadlock can happen when an overloaded system runs ->parallel() in the
context of the current task:

    padata_do_parallel
      ->parallel()
        pcrypt_aead_enc/dec
          padata_do_serial
            spin_lock(&reorder->lock) // BHs still enabled
              <interrupt>
                ...
                  __do_softirq
                    ...
                      padata_do_serial
                        spin_lock(&reorder->lock)

It's a bug for BHs to be on in _do_serial as Steffen points out, so
ensure they're off in the "current task" case like they are in
padata_parallel_worker to avoid this situation.

Reported-by: syzbot+bc05445bc14148d51915@syzkaller.appspotmail.com
Fixes: 4611ce224688 ("padata: allocate work structures for parallel jobs from a pool")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
---

About the potential deadlock in padata_find_next(), I think this fix
covers us there since that function is only called from
padata_do_serial(), where BHs should now always be off, or
invoke_padata_reorder(), where BHs are off as well.  The _bh spinlock
variants in padata_reorder() seem redundant.

 kernel/padata.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/kernel/padata.c b/kernel/padata.c
index e5819bb8bd1d..97f51e0c1776 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -207,14 +207,16 @@ int padata_do_parallel(struct padata_shell *ps,
 	pw = padata_work_alloc();
 	spin_unlock(&padata_works_lock);
 
+	if (!pw) {
+		/* Maximum works limit exceeded, run in the current task. */
+		padata->parallel(padata);
+	}
+
 	rcu_read_unlock_bh();
 
 	if (pw) {
 		padata_work_init(pw, padata_parallel_worker, padata, 0);
 		queue_work(pinst->parallel_wq, &pw->pw_work);
-	} else {
-		/* Maximum works limit exceeded, run in the current task. */
-		padata->parallel(padata);
 	}
 
 	return 0;
-- 
2.38.1