<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/fs/sysfs/bin.c, branch v2.6.34.4</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>sysfs: Remove sysfs_get/put_active_two</title>
<updated>2010-03-08T01:04:51+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@xmission.com</email>
</author>
<published>2010-02-11T23:18:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e72ceb8ccac5f770b3e696e09bb673dca7024b20'/>
<id>e72ceb8ccac5f770b3e696e09bb673dca7024b20</id>
<content type='text'>
It turns out that holding an active reference on a directory is
pointless.  The purpose of the active references are to allows us to
block when removing sysfs entries that have custom methods so we don't
remove modules while running modular code and to keep those custom
methods from accessing data structures after the files have been
removed.  Further sysfs_remove_dir remove all elements in the
directory before removing the directory itself, so there is no chance
we will remove a directory with active children.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Cc: Tejun Heo &lt;tj@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
It turns out that holding an active reference on a directory is
pointless.  The purpose of the active references are to allows us to
block when removing sysfs entries that have custom methods so we don't
remove modules while running modular code and to keep those custom
methods from accessing data structures after the files have been
removed.  Further sysfs_remove_dir remove all elements in the
directory before removing the directory itself, so there is no chance
we will remove a directory with active children.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Cc: Tejun Heo &lt;tj@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Driver core: bin_attribute parameters can often be const*</title>
<updated>2009-12-23T19:23:43+00:00</updated>
<author>
<name>Phil Carmody</name>
<email>ext-phil.2.carmody@nokia.com</email>
</author>
<published>2009-12-18T13:34:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=66ecb92be9eb579df93add22d19843e7869f168e'/>
<id>66ecb92be9eb579df93add22d19843e7869f168e</id>
<content type='text'>
Many struct bin_attribute descriptors are purely read-only
structures, and there's no need to change them. Therefore
make the promise not to, which will let those descriptors
be put in a ro section.

Signed-off-by: Phil Carmody &lt;ext-phil.2.carmody@nokia.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Many struct bin_attribute descriptors are purely read-only
structures, and there's no need to change them. Therefore
make the promise not to, which will let those descriptors
be put in a ro section.

Signed-off-by: Phil Carmody &lt;ext-phil.2.carmody@nokia.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>const: mark struct vm_struct_operations</title>
<updated>2009-09-27T18:39:25+00:00</updated>
<author>
<name>Alexey Dobriyan</name>
<email>adobriyan@gmail.com</email>
</author>
<published>2009-09-27T18:29:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f0f37e2f77731b3473fa6bd5ee53255d9a9cdb40'/>
<id>f0f37e2f77731b3473fa6bd5ee53255d9a9cdb40</id>
<content type='text'>
* mark struct vm_area_struct::vm_ops as const
* mark vm_ops in AGP code

But leave TTM code alone, something is fishy there with global vm_ops
being used.

Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* mark struct vm_area_struct::vm_ops as const
* mark vm_ops in AGP code

But leave TTM code alone, something is fishy there with global vm_ops
being used.

Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Free the memory allocated by memdup_user() in fs/sysfs/bin.c</title>
<updated>2009-07-08T16:34:07+00:00</updated>
<author>
<name>Catalin Marinas</name>
<email>catalin.marinas@arm.com</email>
</author>
<published>2009-07-08T10:17:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d5ce5b40bc66880d1732461d4b47d7fc3331ed30'/>
<id>d5ce5b40bc66880d1732461d4b47d7fc3331ed30</id>
<content type='text'>
Commit 1c8542c7bb replaced kmalloc() with memdup_user() in the write()
function but also dropped the kfree(temp). The memdup_user() function
allocates memory which is never freed.

Signed-off-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Cc: Parag Warudkar &lt;parag.warudkar@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit 1c8542c7bb replaced kmalloc() with memdup_user() in the write()
function but also dropped the kfree(temp). The memdup_user() function
allocates memory which is never freed.

Signed-off-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Cc: Parag Warudkar &lt;parag.warudkar@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>sysfs: use memdup_user()</title>
<updated>2009-04-21T03:02:50+00:00</updated>
<author>
<name>Li Zefan</name>
<email>lizf@cn.fujitsu.com</email>
</author>
<published>2009-04-08T07:07:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1c8542c7bb239ef02fe21477acd9cdac04c1b640'/>
<id>1c8542c7bb239ef02fe21477acd9cdac04c1b640</id>
<content type='text'>
Remove open-coded memdup_user().

Signed-off-by: Li Zefan &lt;lizf@cn.fujitsu.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Remove open-coded memdup_user().

Signed-off-by: Li Zefan &lt;lizf@cn.fujitsu.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mm: page_mkwrite change prototype to match fault: fix sysfs</title>
<updated>2009-04-01T15:59:14+00:00</updated>
<author>
<name>Hugh Dickins</name>
<email>hugh@veritas.com</email>
</author>
<published>2009-03-31T22:23:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=851a039cc547b33b8139fe6d7c2bbfb158e2724e'/>
<id>851a039cc547b33b8139fe6d7c2bbfb158e2724e</id>
<content type='text'>
Fix warnings and return values in sysfs bin_page_mkwrite(), fixing
fs/sysfs/bin.c: In function `bin_page_mkwrite':
fs/sysfs/bin.c:250: warning: passing argument 2 of `bb-&gt;vm_ops-&gt;page_mkwrite' from incompatible pointer type
fs/sysfs/bin.c: At top level:
fs/sysfs/bin.c:280: warning: initialization from incompatible pointer type

Expects to have my [PATCH next] sysfs: fix some bin_vm_ops errors

Signed-off-by: Hugh Dickins &lt;hugh@veritas.com&gt;
Cc: Nick Piggin &lt;npiggin@suse.de&gt;
Cc: "Eric W. Biederman" &lt;ebiederm@aristanetworks.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix warnings and return values in sysfs bin_page_mkwrite(), fixing
fs/sysfs/bin.c: In function `bin_page_mkwrite':
fs/sysfs/bin.c:250: warning: passing argument 2 of `bb-&gt;vm_ops-&gt;page_mkwrite' from incompatible pointer type
fs/sysfs/bin.c: At top level:
fs/sysfs/bin.c:280: warning: initialization from incompatible pointer type

Expects to have my [PATCH next] sysfs: fix some bin_vm_ops errors

Signed-off-by: Hugh Dickins &lt;hugh@veritas.com&gt;
Cc: Nick Piggin &lt;npiggin@suse.de&gt;
Cc: "Eric W. Biederman" &lt;ebiederm@aristanetworks.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>sysfs: fix some bin_vm_ops errors</title>
<updated>2009-03-24T23:38:26+00:00</updated>
<author>
<name>Hugh Dickins</name>
<email>hugh@veritas.com</email>
</author>
<published>2009-03-23T01:41:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=095160aee954688a9bad225952c4bee546541e19'/>
<id>095160aee954688a9bad225952c4bee546541e19</id>
<content type='text'>
Commit 86c9508eb1c0ce5aa07b5cf1d36b60c54efc3d7a
"sysfs: don't block indefinitely for unmapped files" in linux-next
crashes the PowerMac G5 when X starts up.  It's caught out by the way
powerpc's pci_mmap of legacy_mem uses shmem_zero_setup(), substituting
a new vma-&gt;vm_file whose private_data no longer points to the bin_buffer
(substitution done because some versions of X crash if that mmap fails).

The fix to this is straightforward: the original vm_file is fput() in
that case, so this mmap won't block sysfs at all, so just don't switch
over to bin_vm_ops if vm_file has changed.

But more fixes made before realizing that was the problem:-

It should not be an error if bin_page_mkwrite() finds no underlying
page_mkwrite().

Check that a file already mmap'ed has the same underlying vm_ops
_before_ pointing vma-&gt;vm_ops at bin_vm_ops.

If the file being mmap'ed is a shmem/tmpfs file, don't fail the mmap
on CONFIG_NUMA=y, just because that has a set_policy and get_policy:
provide bin_set_policy, bin_get_policy and bin_migrate.

Signed-off-by: Hugh Dickins &lt;hugh@veritas.com&gt;
Acked-by: Eric Biederman &lt;ebiederm@aristanetworks.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;


</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit 86c9508eb1c0ce5aa07b5cf1d36b60c54efc3d7a
"sysfs: don't block indefinitely for unmapped files" in linux-next
crashes the PowerMac G5 when X starts up.  It's caught out by the way
powerpc's pci_mmap of legacy_mem uses shmem_zero_setup(), substituting
a new vma-&gt;vm_file whose private_data no longer points to the bin_buffer
(substitution done because some versions of X crash if that mmap fails).

The fix to this is straightforward: the original vm_file is fput() in
that case, so this mmap won't block sysfs at all, so just don't switch
over to bin_vm_ops if vm_file has changed.

But more fixes made before realizing that was the problem:-

It should not be an error if bin_page_mkwrite() finds no underlying
page_mkwrite().

Check that a file already mmap'ed has the same underlying vm_ops
_before_ pointing vma-&gt;vm_ops at bin_vm_ops.

If the file being mmap'ed is a shmem/tmpfs file, don't fail the mmap
on CONFIG_NUMA=y, just because that has a set_policy and get_policy:
provide bin_set_policy, bin_get_policy and bin_migrate.

Signed-off-by: Hugh Dickins &lt;hugh@veritas.com&gt;
Acked-by: Eric Biederman &lt;ebiederm@aristanetworks.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;


</pre>
</div>
</content>
</entry>
<entry>
<title>sysfs: don't block indefinitely for unmapped files.</title>
<updated>2009-03-24T23:38:26+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@aristanetworks.com</email>
</author>
<published>2009-03-04T19:57:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e0edd3c65aa5b53e20280565a7ce11675eb7ed6b'/>
<id>e0edd3c65aa5b53e20280565a7ce11675eb7ed6b</id>
<content type='text'>
Modify sysfs bin files so that we can remove the bin file while they are
still mapped.  When the kobject is removed we unmap the bin file and
arrange for future accesses to the mapping to receive SIGBUS.

Implementing this prevents a nasty DOS when pci devices are hot plugged
and unplugged.  Where if any of their resources were mmaped the kernel
could not free up their pci resources or release their pci data
structures.

[akpm@linux-foundation.org: remove unused var]
Signed-off-by: Eric W. Biederman &lt;ebiederm@aristanetworks.com&gt;
Cc: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Acked-by: Tejun Heo &lt;tj@kernel.org&gt;
Cc: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Modify sysfs bin files so that we can remove the bin file while they are
still mapped.  When the kobject is removed we unmap the bin file and
arrange for future accesses to the mapping to receive SIGBUS.

Implementing this prevents a nasty DOS when pci devices are hot plugged
and unplugged.  Where if any of their resources were mmaped the kernel
could not free up their pci resources or release their pci data
structures.

[akpm@linux-foundation.org: remove unused var]
Signed-off-by: Eric W. Biederman &lt;ebiederm@aristanetworks.com&gt;
Cc: Jesse Barnes &lt;jbarnes@virtuousgeek.org&gt;
Acked-by: Tejun Heo &lt;tj@kernel.org&gt;
Cc: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>sysfs: fix problems with binary files</title>
<updated>2009-01-21T04:52:09+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@suse.de</email>
</author>
<published>2009-01-20T23:51:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=4503efd0891c40e30928afb4b23dc3f99c62a6b2'/>
<id>4503efd0891c40e30928afb4b23dc3f99c62a6b2</id>
<content type='text'>
Some sysfs binary files don't like having 0 passed to them as a size.
Fix this up at the root by just returning to the vfs if userspace asks
us for a zero sized buffer.

Thanks to Pavel Roskin for pointing this out.

Reported-by: Pavel Roskin &lt;proski@gnu.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Some sysfs binary files don't like having 0 passed to them as a size.
Fix this up at the root by just returning to the vfs if userspace asks
us for a zero sized buffer.

Thanks to Pavel Roskin for pointing this out.

Reported-by: Pavel Roskin &lt;proski@gnu.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>sysfs: fix deadlock</title>
<updated>2008-10-16T16:24:50+00:00</updated>
<author>
<name>Nick Piggin</name>
<email>npiggin@suse.de</email>
</author>
<published>2008-09-12T09:24:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b31ca3f5dfc89c3f1f654b30f0760d0e2fb15e45'/>
<id>b31ca3f5dfc89c3f1f654b30f0760d0e2fb15e45</id>
<content type='text'>
On Thu, Sep 11, 2008 at 10:27:10AM +0200, Ingo Molnar wrote:

&gt; and it's working fine on most boxes. One testbox found this new locking
&gt; scenario:
&gt;
&gt; PM: Adding info for No Bus:vcsa7
&gt; EDAC DEBUG: MC0: i82860_check()
&gt;
&gt; =======================================================
&gt; [ INFO: possible circular locking dependency detected ]
&gt; 2.6.27-rc6-tip #1
&gt; -------------------------------------------------------
&gt; X/4873 is trying to acquire lock:
&gt;  (&amp;bb-&gt;mutex){--..}, at: [&lt;c020ba20&gt;] mmap+0x40/0xa0
&gt;
&gt; but task is already holding lock:
&gt;  (&amp;mm-&gt;mmap_sem){----}, at: [&lt;c0125a1e&gt;] sys_mmap2+0x8e/0xc0
&gt;
&gt; which lock already depends on the new lock.
&gt;
&gt;
&gt; the existing dependency chain (in reverse order) is:
&gt;
&gt; -&gt; #1 (&amp;mm-&gt;mmap_sem){----}:
&gt;        [&lt;c017dc96&gt;] validate_chain+0xa96/0xf50
&gt;        [&lt;c017ef2b&gt;] __lock_acquire+0x2cb/0x5b0
&gt;        [&lt;c017f299&gt;] lock_acquire+0x89/0xc0
&gt;        [&lt;c01aa8fb&gt;] might_fault+0x6b/0x90
&gt;        [&lt;c040b618&gt;] copy_to_user+0x38/0x60
&gt;        [&lt;c020bcfb&gt;] read+0xfb/0x170
&gt;        [&lt;c01c09a5&gt;] vfs_read+0x95/0x110
&gt;        [&lt;c01c1443&gt;] sys_pread64+0x63/0x80
&gt;        [&lt;c012146f&gt;] sysenter_do_call+0x12/0x43
&gt;        [&lt;ffffffff&gt;] 0xffffffff
&gt;
&gt; -&gt; #0 (&amp;bb-&gt;mutex){--..}:
&gt;        [&lt;c017d8b7&gt;] validate_chain+0x6b7/0xf50
&gt;        [&lt;c017ef2b&gt;] __lock_acquire+0x2cb/0x5b0
&gt;        [&lt;c017f299&gt;] lock_acquire+0x89/0xc0
&gt;        [&lt;c0d6f2ab&gt;] __mutex_lock_common+0xab/0x3c0
&gt;        [&lt;c0d6f698&gt;] mutex_lock_nested+0x38/0x50
&gt;        [&lt;c020ba20&gt;] mmap+0x40/0xa0
&gt;        [&lt;c01b111e&gt;] mmap_region+0x14e/0x450
&gt;        [&lt;c01b170f&gt;] do_mmap_pgoff+0x2ef/0x310
&gt;        [&lt;c0125a3d&gt;] sys_mmap2+0xad/0xc0
&gt;        [&lt;c012146f&gt;] sysenter_do_call+0x12/0x43
&gt;        [&lt;ffffffff&gt;] 0xffffffff
&gt;
&gt; other info that might help us debug this:
&gt;
&gt; 1 lock held by X/4873:
&gt;  #0:  (&amp;mm-&gt;mmap_sem){----}, at: [&lt;c0125a1e&gt;] sys_mmap2+0x8e/0xc0
&gt;
&gt; stack backtrace:
&gt; Pid: 4873, comm: X Not tainted 2.6.27-rc6-tip #1
&gt;  [&lt;c017cd09&gt;] print_circular_bug_tail+0x79/0xc0
&gt;  [&lt;c017d8b7&gt;] validate_chain+0x6b7/0xf50
&gt;  [&lt;c017a5b5&gt;] ? trace_hardirqs_off_caller+0x15/0xb0
&gt;  [&lt;c017ef2b&gt;] __lock_acquire+0x2cb/0x5b0
&gt;  [&lt;c017f299&gt;] lock_acquire+0x89/0xc0
&gt;  [&lt;c020ba20&gt;] ? mmap+0x40/0xa0
&gt;  [&lt;c0d6f2ab&gt;] __mutex_lock_common+0xab/0x3c0
&gt;  [&lt;c020ba20&gt;] ? mmap+0x40/0xa0
&gt;  [&lt;c0d6f698&gt;] mutex_lock_nested+0x38/0x50
&gt;  [&lt;c020ba20&gt;] ? mmap+0x40/0xa0
&gt;  [&lt;c020ba20&gt;] mmap+0x40/0xa0
&gt;  [&lt;c01b111e&gt;] mmap_region+0x14e/0x450
&gt;  [&lt;c01afb88&gt;] ? arch_get_unmapped_area_topdown+0xf8/0x160
&gt;  [&lt;c01b170f&gt;] do_mmap_pgoff+0x2ef/0x310
&gt;  [&lt;c0125a3d&gt;] sys_mmap2+0xad/0xc0
&gt;  [&lt;c012146f&gt;] sysenter_do_call+0x12/0x43
&gt;  [&lt;c0120000&gt;] ? __switch_to+0x130/0x220
&gt;  =======================
&gt; evbug.c: Event. Dev: input3, Type: 20, Code: 0, Value: 500
&gt; warning: `sudo' uses deprecated v2 capabilities in a way that may be insecure.
&gt;
&gt; i've attached the config.
&gt;
&gt; at first sight it looks like a genuine bug in fs/sysfs/bin.c?

Yes, it is a real bug by the looks. bin.c takes bb-&gt;mutex under mmap_sem
when it is mmapped, and then does its copy_*_user under bb-&gt;mutex too.

Here is a basic fix for the sysfs lor.


From: Nick Piggin &lt;npiggin@suse.de&gt;
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
On Thu, Sep 11, 2008 at 10:27:10AM +0200, Ingo Molnar wrote:

&gt; and it's working fine on most boxes. One testbox found this new locking
&gt; scenario:
&gt;
&gt; PM: Adding info for No Bus:vcsa7
&gt; EDAC DEBUG: MC0: i82860_check()
&gt;
&gt; =======================================================
&gt; [ INFO: possible circular locking dependency detected ]
&gt; 2.6.27-rc6-tip #1
&gt; -------------------------------------------------------
&gt; X/4873 is trying to acquire lock:
&gt;  (&amp;bb-&gt;mutex){--..}, at: [&lt;c020ba20&gt;] mmap+0x40/0xa0
&gt;
&gt; but task is already holding lock:
&gt;  (&amp;mm-&gt;mmap_sem){----}, at: [&lt;c0125a1e&gt;] sys_mmap2+0x8e/0xc0
&gt;
&gt; which lock already depends on the new lock.
&gt;
&gt;
&gt; the existing dependency chain (in reverse order) is:
&gt;
&gt; -&gt; #1 (&amp;mm-&gt;mmap_sem){----}:
&gt;        [&lt;c017dc96&gt;] validate_chain+0xa96/0xf50
&gt;        [&lt;c017ef2b&gt;] __lock_acquire+0x2cb/0x5b0
&gt;        [&lt;c017f299&gt;] lock_acquire+0x89/0xc0
&gt;        [&lt;c01aa8fb&gt;] might_fault+0x6b/0x90
&gt;        [&lt;c040b618&gt;] copy_to_user+0x38/0x60
&gt;        [&lt;c020bcfb&gt;] read+0xfb/0x170
&gt;        [&lt;c01c09a5&gt;] vfs_read+0x95/0x110
&gt;        [&lt;c01c1443&gt;] sys_pread64+0x63/0x80
&gt;        [&lt;c012146f&gt;] sysenter_do_call+0x12/0x43
&gt;        [&lt;ffffffff&gt;] 0xffffffff
&gt;
&gt; -&gt; #0 (&amp;bb-&gt;mutex){--..}:
&gt;        [&lt;c017d8b7&gt;] validate_chain+0x6b7/0xf50
&gt;        [&lt;c017ef2b&gt;] __lock_acquire+0x2cb/0x5b0
&gt;        [&lt;c017f299&gt;] lock_acquire+0x89/0xc0
&gt;        [&lt;c0d6f2ab&gt;] __mutex_lock_common+0xab/0x3c0
&gt;        [&lt;c0d6f698&gt;] mutex_lock_nested+0x38/0x50
&gt;        [&lt;c020ba20&gt;] mmap+0x40/0xa0
&gt;        [&lt;c01b111e&gt;] mmap_region+0x14e/0x450
&gt;        [&lt;c01b170f&gt;] do_mmap_pgoff+0x2ef/0x310
&gt;        [&lt;c0125a3d&gt;] sys_mmap2+0xad/0xc0
&gt;        [&lt;c012146f&gt;] sysenter_do_call+0x12/0x43
&gt;        [&lt;ffffffff&gt;] 0xffffffff
&gt;
&gt; other info that might help us debug this:
&gt;
&gt; 1 lock held by X/4873:
&gt;  #0:  (&amp;mm-&gt;mmap_sem){----}, at: [&lt;c0125a1e&gt;] sys_mmap2+0x8e/0xc0
&gt;
&gt; stack backtrace:
&gt; Pid: 4873, comm: X Not tainted 2.6.27-rc6-tip #1
&gt;  [&lt;c017cd09&gt;] print_circular_bug_tail+0x79/0xc0
&gt;  [&lt;c017d8b7&gt;] validate_chain+0x6b7/0xf50
&gt;  [&lt;c017a5b5&gt;] ? trace_hardirqs_off_caller+0x15/0xb0
&gt;  [&lt;c017ef2b&gt;] __lock_acquire+0x2cb/0x5b0
&gt;  [&lt;c017f299&gt;] lock_acquire+0x89/0xc0
&gt;  [&lt;c020ba20&gt;] ? mmap+0x40/0xa0
&gt;  [&lt;c0d6f2ab&gt;] __mutex_lock_common+0xab/0x3c0
&gt;  [&lt;c020ba20&gt;] ? mmap+0x40/0xa0
&gt;  [&lt;c0d6f698&gt;] mutex_lock_nested+0x38/0x50
&gt;  [&lt;c020ba20&gt;] ? mmap+0x40/0xa0
&gt;  [&lt;c020ba20&gt;] mmap+0x40/0xa0
&gt;  [&lt;c01b111e&gt;] mmap_region+0x14e/0x450
&gt;  [&lt;c01afb88&gt;] ? arch_get_unmapped_area_topdown+0xf8/0x160
&gt;  [&lt;c01b170f&gt;] do_mmap_pgoff+0x2ef/0x310
&gt;  [&lt;c0125a3d&gt;] sys_mmap2+0xad/0xc0
&gt;  [&lt;c012146f&gt;] sysenter_do_call+0x12/0x43
&gt;  [&lt;c0120000&gt;] ? __switch_to+0x130/0x220
&gt;  =======================
&gt; evbug.c: Event. Dev: input3, Type: 20, Code: 0, Value: 500
&gt; warning: `sudo' uses deprecated v2 capabilities in a way that may be insecure.
&gt;
&gt; i've attached the config.
&gt;
&gt; at first sight it looks like a genuine bug in fs/sysfs/bin.c?

Yes, it is a real bug by the looks. bin.c takes bb-&gt;mutex under mmap_sem
when it is mmapped, and then does its copy_*_user under bb-&gt;mutex too.

Here is a basic fix for the sysfs lor.


From: Nick Piggin &lt;npiggin@suse.de&gt;
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
</feed>
