Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eiichi Tsukata <eiichi.tsukata@nutanix.com>
To:     paul@paul-moore.com, eparis@redhat.com,
        linux-kernel@vger.kernel.org, audit@vger.kernel.org
Cc:     Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Subject: [PATCH v2 4/5] audit: check if audit_queue is full after prepare_to_wait_exclusive()
Date:   Thu, 11 May 2023 05:21:15 +0000
Message-Id: <20230511052116.19452-5-eiichi.tsukata@nutanix.com>
In-Reply-To: <20230511052116.19452-1-eiichi.tsukata@nutanix.com>
References: <20230511052116.19452-1-eiichi.tsukata@nutanix.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?mIL9fJ8H/i8dHStcZ5OEcL8D4isQhIZjgv4cvDOVAE4be1/3ot4LSx4Z5wSr?=
 =?us-ascii?Q?K97q5IHoD6IwO67eVVpEwPvOst/aX/saKtK3vrFe7+NYI/mFrKKG62FLFIup?=
 =?us-ascii?Q?r8q0REaIFL24N/ttll4m1TSIv3Ew5uG1T7cDSHsYRnk/nIk/ZgtIO1wzn0YV?=
 =?us-ascii?Q?g9UZYgNQ+5MNW5NCo5NszRehrnrW2/3V5eD4MvIKn62wp3FlXb0fw9w1aDI0?=
 =?us-ascii?Q?A67pkGLGkbg1U1HFtvDAhKLX872rNLawmpVKuBzWF9VxW320cdpwuhImk92f?=
 =?us-ascii?Q?5eSji9J062y2vJP5geS/gOZO89NOKMSuYkr4hod4DrDfNM0pD1FU6xmQRA5/?=
 =?us-ascii?Q?9+heHo1hh92tKJAcIW9XcvsN2Df0IJgiIex13zYddy0ZMA/I/BQ4/iElIT4M?=
 =?us-ascii?Q?RKk3LNlQaGFDapRtgJeY8R1lvfYCEoH+oAKu+ln8dSMGpGkIzh94XZIWgSly?=
 =?us-ascii?Q?C2LAMmrceyoz7tp0TUwj+ifEXW0Dks2PCKQMxYcDjqoS26ezi1IjMGATTA/5?=
 =?us-ascii?Q?tlL8857iEBdTinCJ2mnPqwJKExVa0A/vTvRfKw+2FWFiBrx/S9jgEkhTDKX7?=
 =?us-ascii?Q?NVE9FBp5EokH1pDS6xbR09VmvwdHewKDNe3hsdXDWBLrb2T3Xv8mgA13mNpu?=
 =?us-ascii?Q?5ysH0vmmk65tvNtisudf5GfsaRbQamflwWh0Enrtn1RCWnhyNT7wXT2dhHL/?=
 =?us-ascii?Q?2jGT+KgLSLCsBMFFxVcf7rIvP4Vh9TJHYvh09kqV3YY/V5OeW5GbTeAJkBET?=
 =?us-ascii?Q?sHcpfSu/Gb6+C32CUv8hsdEYXPPSchW/fTAbdOXSZPqS2CAH2KVpKhgEXP7M?=
 =?us-ascii?Q?H2/q87wAO/755M3QkZROCf4oqNZbP3Qkox1R+qN38CqeHq13NljoEJ4X+ebp?=
 =?us-ascii?Q?bWI0fvTadBwswjNO0zHi4wzR95B1IwFsDndKVUl0aydo8nVzPQFqYzt5kF97?=
 =?us-ascii?Q?/eCdvU1TrRtBDPo58+41hdO+7b6wmFp3jVuCZ5/BEbUe4GSbabn/J9opirLm?=
 =?us-ascii?Q?xtTR33a8qMoA3MdBmS8tkWwM8Pv6FJVX0Ez3OQzzvIuRni0p0+V1Qt4Xf44p?=
 =?us-ascii?Q?17PBoWVzyrRGU+2k14dg3Eyaf3Doy5+9FacKr2Ju6IaIFMtFfDQ1MAeVIbgD?=
 =?us-ascii?Q?LHYDChL4GdLJPnZ0mUSw612b4W6xA1LHcqOqjnI2Xh3IpXr4EZAugFoI+nQO?=
 =?us-ascii?Q?eI8HQixDInyIcmLHf025zuG3OYE30eohIhbesWZcebyKPIv4u7iOJRVkue3a?=
 =?us-ascii?Q?9ZLPnMPbCF4iRhvwN+RDyQJE4qUlBEZ07QVZyODaGAvNOnuMI11ZbAUuyQUl?=
 =?us-ascii?Q?2RgDEr2zsGflK3C3H1eoWkEWsePBQhDCw/OIi8I2QS9Yq23UxhHlLMJgg/sR?=
 =?us-ascii?Q?SNiepsMhEmM4YY9wlPhsd2eQIFLJsWdhyRXVebdbca4CxsVRO1VR+x1KUtpk?=
 =?us-ascii?Q?XlTFvEeic1udcdP2IJrkuYKsnS71dKhgjEh0isFmu8bVGfPsuzbYvfoVlfOG?=
 =?us-ascii?Q?xmL4rKOO+qRa1WGs/jan07mUCcZqiGBhF3IQrPbshxMLov3Stmkkp1P45t6E?=
 =?us-ascii?Q?l6AQEwZehBQ/3ASZMoLa7wEN7yFnVqzEDgSUNEdp/JzI/xkW5ubFUTvkBtJq?=
 =?us-ascii?Q?WA=3D=3D?=
X-OriginatorOrg: nutanix.com
X-MS-Exchange-CrossTenant-Network-Message-Id: add1c49e-eefd-4d5e-ca57-08db51df9542
X-MS-Exchange-CrossTenant-AuthSource: CH0PR02MB8041.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 May 2023 05:21:33.3376
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: bOvuKFRb4AuJFMvp3mQc1C2fRpVVzYFcqLB6MGjLbsKzvvibIRzvZ7zp/XhY/UG+Wxgyp22pc7xfEu7BWWo8XSiz1BEOm9FKuvqn3wX4740=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR02MB10006
X-Proofpoint-GUID: -nyFYXnQwO9YPhJFLetDbNPUdXKw4I9z
X-Proofpoint-ORIG-GUID: -nyFYXnQwO9YPhJFLetDbNPUdXKw4I9z
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-05-10_04,2023-05-05_01,2023-02-09_01
X-Proofpoint-Spam-Reason: safe
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,
        SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Commit 7ffb8e317bae ("audit: we don't need to
__set_current_state(TASK_RUNNING)") accidentally moved queue full check
before add_wait_queue_exclusive() which introduced the following race:

    CPU1                           CPU2
  ========                       ========
  (in audit_log_start())         (in kauditd_thread())

  @audit_queue is full
                                 wake_up(&audit_backlog_wait)
                                 wait_event_freezable()
  add_wait_queue_exclusive()
  ...
  schedule_timeout()

Once this happens, both audit_log_start() and kauditd_thread() can cause
deadlock for up to backlog_wait_time waiting for each other. To prevent
the race, this patch adds @audit_queue full check after
prepare_to_wait_exclusive() and call schedule_timeout() only if the
queue is full.

Fixes: 7ffb8e317bae ("audit: we don't need to __set_current_state(TASK_RUNNING)")
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
---
 kernel/audit.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index bcbb0ba33c84..6b0cc0459984 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -644,8 +644,16 @@ static long wait_for_kauditd(long stime)
 
 	prepare_to_wait_exclusive(&audit_backlog_wait, &wait,
 				  TASK_UNINTERRUPTIBLE);
-	rtime = schedule_timeout(stime);
-	atomic_add(stime - rtime, &audit_backlog_wait_time_actual);
+
+	/* need to check if the queue is full again because kauditd might have
+	 * flushed the queue and went to sleep after prepare_to_wait_exclusive()
+	 */
+	if (audit_queue_full(&audit_queue)) {
+		rtime = schedule_timeout(stime);
+		atomic_add(stime - rtime, &audit_backlog_wait_time_actual);
+	} else {
+		rtime = 0;
+	}
 	finish_wait(&audit_backlog_wait, &wait);
 
 	return rtime;
-- 
2.40.0