linux/scripts
Kirill Smelkov 10dce8af34 fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
Commit 9c225f2655 ("vfs: atomic f_pos accesses as per POSIX") added
locking for file.f_pos access and in particular made concurrent read and
write not possible - now both those functions take f_pos lock for the
whole run, and so if e.g. a read is blocked waiting for data, write will
deadlock waiting for that read to complete.

This caused regression for stream-like files where previously read and
write could run simultaneously, but after that patch could not do so
anymore. See e.g. commit 581d21a2d0 ("xenbus: fix deadlock on writes
to /proc/xen/xenbus") which fixes such regression for particular case of
/proc/xen/xenbus.

The patch that added f_pos lock in 2014 did so to guarantee POSIX thread
safety for read/write/lseek and added the locking to file descriptors of
all regular files. In 2014 that thread-safety problem was not new as it
was already discussed earlier in 2006.

However even though 2006'th version of Linus's patch was adding f_pos
locking "only for files that are marked seekable with FMODE_LSEEK (thus
avoiding the stream-like objects like pipes and sockets)", the 2014
version - the one that actually made it into the tree as 9c225f2655 -
is doing so irregardless of whether a file is seekable or not.

See

    https://lore.kernel.org/lkml/53022DB1.4070805@gmail.com/
    https://lwn.net/Articles/180387
    https://lwn.net/Articles/180396

for historic context.

The reason that it did so is, probably, that there are many files that
are marked non-seekable, but e.g. their read implementation actually
depends on knowing current position to correctly handle the read. Some
examples:

	kernel/power/user.c		snapshot_read
	fs/debugfs/file.c		u32_array_read
	fs/fuse/control.c		fuse_conn_waiting_read + ...
	drivers/hwmon/asus_atk0110.c	atk_debugfs_ggrp_read
	arch/s390/hypfs/inode.c		hypfs_read_iter
	...

Despite that, many nonseekable_open users implement read and write with
pure stream semantics - they don't depend on passed ppos at all. And for
those cases where read could wait for something inside, it creates a
situation similar to xenbus - the write could be never made to go until
read is done, and read is waiting for some, potentially external, event,
for potentially unbounded time -> deadlock.

Besides xenbus, there are 14 such places in the kernel that I've found
with semantic patch (see below):

	drivers/xen/evtchn.c:667:8-24: ERROR: evtchn_fops: .read() can deadlock .write()
	drivers/isdn/capi/capi.c:963:8-24: ERROR: capi_fops: .read() can deadlock .write()
	drivers/input/evdev.c:527:1-17: ERROR: evdev_fops: .read() can deadlock .write()
	drivers/char/pcmcia/cm4000_cs.c:1685:7-23: ERROR: cm4000_fops: .read() can deadlock .write()
	net/rfkill/core.c:1146:8-24: ERROR: rfkill_fops: .read() can deadlock .write()
	drivers/s390/char/fs3270.c:488:1-17: ERROR: fs3270_fops: .read() can deadlock .write()
	drivers/usb/misc/ldusb.c:310:1-17: ERROR: ld_usb_fops: .read() can deadlock .write()
	drivers/hid/uhid.c:635:1-17: ERROR: uhid_fops: .read() can deadlock .write()
	net/batman-adv/icmp_socket.c:80:1-17: ERROR: batadv_fops: .read() can deadlock .write()
	drivers/media/rc/lirc_dev.c:198:1-17: ERROR: lirc_fops: .read() can deadlock .write()
	drivers/leds/uleds.c:77:1-17: ERROR: uleds_fops: .read() can deadlock .write()
	drivers/input/misc/uinput.c:400:1-17: ERROR: uinput_fops: .read() can deadlock .write()
	drivers/infiniband/core/user_mad.c:985:7-23: ERROR: umad_fops: .read() can deadlock .write()
	drivers/gnss/core.c:45:1-17: ERROR: gnss_fops: .read() can deadlock .write()

In addition to the cases above another regression caused by f_pos
locking is that now FUSE filesystems that implement open with
FOPEN_NONSEEKABLE flag, can no longer implement bidirectional
stream-like files - for the same reason as above e.g. read can deadlock
write locking on file.f_pos in the kernel.

FUSE's FOPEN_NONSEEKABLE was added in 2008 in a7c1b990f7 ("fuse:
implement nonseekable open") to support OSSPD. OSSPD implements /dev/dsp
in userspace with FOPEN_NONSEEKABLE flag, with corresponding read and
write routines not depending on current position at all, and with both
read and write being potentially blocking operations:

See

    https://github.com/libfuse/osspd
    https://lwn.net/Articles/308445

    https://github.com/libfuse/osspd/blob/14a9cff0/osspd.c#L1406
    https://github.com/libfuse/osspd/blob/14a9cff0/osspd.c#L1438-L1477
    https://github.com/libfuse/osspd/blob/14a9cff0/osspd.c#L1479-L1510

Corresponding libfuse example/test also describes FOPEN_NONSEEKABLE as
"somewhat pipe-like files ..." with read handler not using offset.
However that test implements only read without write and cannot exercise
the deadlock scenario:

    https://github.com/libfuse/libfuse/blob/fuse-3.4.2-3-ga1bff7d/example/poll.c#L124-L131
    https://github.com/libfuse/libfuse/blob/fuse-3.4.2-3-ga1bff7d/example/poll.c#L146-L163
    https://github.com/libfuse/libfuse/blob/fuse-3.4.2-3-ga1bff7d/example/poll.c#L209-L216

I've actually hit the read vs write deadlock for real while implementing
my FUSE filesystem where there is /head/watch file, for which open
creates separate bidirectional socket-like stream in between filesystem
and its user with both read and write being later performed
simultaneously. And there it is semantically not easy to split the
stream into two separate read-only and write-only channels:

    https://lab.nexedi.com/kirr/wendelin.core/blob/f13aa600/wcfs/wcfs.go#L88-169

Let's fix this regression. The plan is:

1. We can't change nonseekable_open to include &~FMODE_ATOMIC_POS -
   doing so would break many in-kernel nonseekable_open users which
   actually use ppos in read/write handlers.

2. Add stream_open() to kernel to open stream-like non-seekable file
   descriptors. Read and write on such file descriptors would never use
   nor change ppos. And with that property on stream-like files read and
   write will be running without taking f_pos lock - i.e. read and write
   could be running simultaneously.

3. With semantic patch search and convert to stream_open all in-kernel
   nonseekable_open users for which read and write actually do not
   depend on ppos and where there is no other methods in file_operations
   which assume @offset access.

4. Add FOPEN_STREAM to fs/fuse/ and open in-kernel file-descriptors via
   steam_open if that bit is present in filesystem open reply.

   It was tempting to change fs/fuse/ open handler to use stream_open
   instead of nonseekable_open on just FOPEN_NONSEEKABLE flags, but
   grepping through Debian codesearch shows users of FOPEN_NONSEEKABLE,
   and in particular GVFS which actually uses offset in its read and
   write handlers

	https://codesearch.debian.net/search?q=-%3Enonseekable+%3D
	https://gitlab.gnome.org/GNOME/gvfs/blob/1.40.0-6-gcbc54396/client/gvfsfusedaemon.c#L1080
	https://gitlab.gnome.org/GNOME/gvfs/blob/1.40.0-6-gcbc54396/client/gvfsfusedaemon.c#L1247-1346
	https://gitlab.gnome.org/GNOME/gvfs/blob/1.40.0-6-gcbc54396/client/gvfsfusedaemon.c#L1399-1481

   so if we would do such a change it will break a real user.

5. Add stream_open and FOPEN_STREAM handling to stable kernels starting
   from v3.14+ (the kernel where 9c225f2655 first appeared).

   This will allow to patch OSSPD and other FUSE filesystems that
   provide stream-like files to return FOPEN_STREAM | FOPEN_NONSEEKABLE
   in their open handler and this way avoid the deadlock on all kernel
   versions. This should work because fs/fuse/ ignores unknown open
   flags returned from a filesystem and so passing FOPEN_STREAM to a
   kernel that is not aware of this flag cannot hurt. In turn the kernel
   that is not aware of FOPEN_STREAM will be < v3.14 where just
   FOPEN_NONSEEKABLE is sufficient to implement streams without read vs
   write deadlock.

This patch adds stream_open, converts /proc/xen/xenbus to it and adds
semantic patch to automatically locate in-kernel places that are either
required to be converted due to read vs write deadlock, or that are just
safe to be converted because read and write do not use ppos and there
are no other funky methods in file_operations.

Regarding semantic patch I've verified each generated change manually -
that it is correct to convert - and each other nonseekable_open instance
left - that it is either not correct to convert there, or that it is not
converted due to current stream_open.cocci limitations.

The script also does not convert files that should be valid to convert,
but that currently have .llseek = noop_llseek or generic_file_llseek for
unknown reason despite file being opened with nonseekable_open (e.g.
drivers/input/mousedev.c)

Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Yongzhi Pan <panyongzhi@gmail.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Tejun Heo <tj@kernel.org>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Julia Lawall <Julia.Lawall@lip6.fr>
Cc: Nikolaus Rath <Nikolaus@rath.org>
Cc: Han-Wen Nienhuys <hanwen@google.com>
Signed-off-by: Kirill Smelkov <kirr@nexedi.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-04-06 07:01:55 -10:00
..
atomic locking/atomics: Check atomic headers with sha1sum 2019-02-13 08:07:31 +01:00
basic kbuild: simplify dependency generation for CONFIG_TRIM_UNUSED_KSYMS 2018-12-01 23:13:14 +09:00
coccinelle fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock 2019-04-06 07:01:55 -10:00
dtc of: add dtc annotations functionality to dtx_diff 2019-02-28 11:40:48 -06:00
gcc-plugins increased structleak coverage 2019-03-09 09:06:15 -08:00
gdb Kbuild updates for v5.1 2019-03-10 17:48:21 -07:00
genksyms genksyms: remove symbol prefix support 2018-05-17 22:43:35 +09:00
kconfig kconfig/[mn]conf: handle backspace (^H) key 2019-03-29 22:48:01 +09:00
ksymoops Fix dead URLs to ftp.kernel.org 2017-03-28 16:16:52 +02:00
mod kbuild: modversions: Fix relative CRC byte order interpretation 2019-03-28 23:46:56 +09:00
package kbuild: deb-pkg: avoid implicit effects 2019-03-17 12:56:23 +09:00
selinux genheaders: %-<width>s had been there since v6; %-*s - since v7 2018-12-10 03:40:11 -05:00
tracing scripts: Add Python 3 support to tracing/draw_functrace.py 2018-07-29 11:08:38 +09:00
.gitignore scripts: remove unnecessary ihex2fw and check-lc_ctypes from .gitignore 2018-12-22 00:37:52 +09:00
adjust_autoksyms.sh kbuild: source include/config/auto.conf instead of ${KCONFIG_CONFIG} 2019-03-14 02:39:11 +09:00
asn1_compiler.c ASN.1: Remove unnecessary shadowed local variable 2018-10-29 00:19:41 +09:00
bin2c.c kbuild: move bin2c back to scripts/ from scripts/basic/ 2018-07-18 01:18:05 +09:00
bloat-o-meter bloat-o-meter: ignore __addressable_ symbols 2018-12-28 12:11:44 -08:00
bootgraph.pl scripts: Switch to more portable Perl shebang 2017-05-14 11:20:44 +09:00
bpf_helpers_doc.py bpf: change eBPF helper doc parsing script to allow for smaller indent 2018-05-17 17:34:43 +02:00
cc-can-link.sh bpfilter: check compiler capability in Kconfig 2018-06-28 13:36:39 +09:00
check_extable.sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
checkincludes.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
checkkconfigsymbols.py checkkconfigsymbols.py: support Kconfig's 'imply' statement 2017-02-03 11:49:06 +01:00
checkpatch.pl checkpatch: add %pt as a valid vsprintf extension 2019-03-29 10:01:37 -07:00
checkstack.pl scripts/checkstack.pl: dynamic stack growth for aarch64 2018-12-28 12:11:44 -08:00
checksyscalls.sh checksyscalls: fix up mq_timedreceive and stat exceptions 2019-02-19 21:27:53 +01:00
checkversion.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
clang-version.sh kbuild: update comment block of scripts/clang-version.sh 2019-03-04 22:34:54 +09:00
cleanfile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cleanpatch License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
coccicheck coccicheck: return proper error code on fail 2018-08-14 08:58:56 +09:00
config License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
conmakehash.c
const_structs.checkpatch const_structs.checkpatch: add frequently used from Julia Lawall's list 2016-10-11 15:06:30 -07:00
decode_stacktrace.sh scripts/decode_stacktrace.sh: handle RIP address with segment 2019-03-05 21:07:13 -08:00
decodecode scripts/decodecode: set ARCH when running natively on arm/arm64 2018-12-28 12:11:44 -08:00
depmod.sh kbuild: modules_install: warn when missing System.map file 2018-09-09 09:14:07 +09:00
diffconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
documentation-file-ref-check scripts/documentation-file-ref-check: ignore sched-pelt false positive 2018-07-02 11:25:00 -06:00
export_report.pl scripts: Switch to more portable Perl shebang 2017-05-14 11:20:44 +09:00
extract_xc3028.pl MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
extract-cert.c
extract-ikconfig
extract-module-sig.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
extract-sys-certs.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
extract-vmlinux extract-vmlinux: Check for uncompressed image as fallback 2018-10-17 08:18:01 +02:00
faddr2line scripts/faddr2line: fix location of start_kernel in comment 2018-11-18 10:15:09 -08:00
file-size.sh kbuild: Use ls(1) instead of stat(1) to obtain file size 2018-03-26 02:01:24 +09:00
find-unused-docs.sh scripts: Add a script to find unused documentation 2017-10-23 08:01:37 -06:00
gcc-goto.sh jump_label: move 'asm goto' support test to Kconfig 2019-01-06 09:46:51 +09:00
gcc-ld License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
gcc-plugin.sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
gcc-version.sh kbuild: clean up scripts/gcc-version.sh 2019-03-04 22:35:04 +09:00
gcc-x86_32-has-stack-protector.sh stack-protector: test compiler capability in Kconfig and drop AUTO mode 2018-06-08 18:56:00 +09:00
gcc-x86_64-has-stack-protector.sh stack-protector: Fix test with 32-bit userland and CONFIG_64BIT=y 2018-06-25 23:21:13 +09:00
gen_compile_commands.py scripts: add a tool to produce a compile_commands.json file 2018-12-19 23:41:36 +09:00
gen_ksymdeps.sh kbuild: simplify dependency generation for CONFIG_TRIM_UNUSED_KSYMS 2018-12-01 23:13:14 +09:00
get_dvb_firmware scripts: Switch to more portable Perl shebang 2017-05-14 11:20:44 +09:00
get_maintainer.pl get_maintainer: allow option --mpath <directory> to read all files in <directory> 2018-08-22 10:52:48 -07:00
gfp-translate
headerdep.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
headers_check.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
headers_install.sh kbuild: Improve portability of some sed invocations 2018-03-26 02:01:18 +09:00
headers.sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
insert-sys-cert.c
kallsyms.c Kbuild updates for v5.1 2019-03-10 17:48:21 -07:00
Kbuild.include kbuild: remove cc-version macro 2019-03-04 22:34:59 +09:00
Kconfig.include kbuild: clean up scripts/gcc-version.sh 2019-03-04 22:35:04 +09:00
kernel-doc kernel-doc: suppress 'not described' warnings for embedded struct fields 2019-01-16 15:04:01 -07:00
ld-version.sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
leaking_addresses.pl leaking_addresses: Completely remove --version flag 2019-03-07 08:53:18 +11:00
Lindent License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
link-vmlinux.sh kbuild: source include/config/auto.conf instead of ${KCONFIG_CONFIG} 2019-03-14 02:39:11 +09:00
Makefile scripts/gdb: do not descend into scripts/gdb from scripts 2019-02-27 21:40:09 +09:00
Makefile.asm-generic kbuild: force all architectures except um to include mandatory-y 2019-03-17 12:56:32 +09:00
Makefile.build kbuild: strip whitespace in cmd_record_mcount findstring 2019-03-28 23:46:55 +09:00
Makefile.clean kbuild: remove deprecated host-progs variable 2018-08-09 21:51:17 +09:00
Makefile.dtbinst DeviceTree for 4.15: 2017-11-14 18:25:40 -08:00
Makefile.extrawarn Kbuild updates for v4.20 (2nd) 2018-11-03 10:47:33 -07:00
Makefile.gcc-plugins gcc-plugins: structleak: Generalize to all variable types 2019-03-04 09:29:41 -08:00
Makefile.headersinst kbuild: generate asm-generic wrappers if mandatory headers are missing 2019-01-06 09:46:51 +09:00
Makefile.host kbuild: skip 'addtree' and 'flags' magic for external module build 2019-01-28 09:11:17 +09:00
Makefile.kasan kasan: remove use after scope bugs detection. 2019-03-05 21:07:13 -08:00
Makefile.kcov kcov: test compiler capability in Kconfig and correct dependency 2018-06-11 09:14:08 +09:00
Makefile.lib kbuild: move archive command to scripts/Makefile.lib 2019-03-14 02:39:10 +09:00
Makefile.modbuiltin Kbuild: Makefile.modbuiltin: include auto.conf and tristate.conf mandatory 2018-08-03 00:47:00 +09:00
Makefile.modinst Revert "modsign: Abort modules_install when signing fails" 2019-03-17 12:56:31 +09:00
Makefile.modpost modpost: always show verbose warning for section mismatch 2019-03-14 02:39:09 +09:00
Makefile.modsign kbuild: remove duplicated comments about PHONY 2018-07-06 22:04:03 +09:00
Makefile.ubsan lib/ubsan: remove null-pointer checks 2018-08-10 20:19:58 -07:00
makelst License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
markup_oops.pl scripts: Switch to more portable Perl shebang 2017-05-14 11:20:44 +09:00
mkcompile_h kbuild: remove unnecessary in-subshell execution 2019-01-28 09:11:17 +09:00
mkmakefile kbuild: simplify command line creation in scripts/mkmakefile 2018-10-04 22:56:02 +09:00
mksysmap
mkuboot.sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
module-common.lds module: set .init_array alignment to 8 2017-03-13 09:40:28 -07:00
namespace.pl kbuild: rename built-in.o to built-in.a 2018-03-26 02:01:19 +09:00
objdiff scripts: objdiff: Ignore debug info when comparing 2017-03-11 11:13:38 +09:00
parse-maintainers.pl parse-maintainers: add ability to specify filenames 2017-11-17 16:10:01 -08:00
patch-kernel License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pnmtologo.c
profile2linkerlist.pl License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
prune-kernel License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
recordmcount.c scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names 2018-12-08 20:54:08 -05:00
recordmcount.h scripts: Fixed printf format mismatch 2018-05-29 22:04:12 +09:00
recordmcount.pl scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names 2018-12-08 20:54:08 -05:00
setlocalversion scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks 2018-11-21 23:57:33 +09:00
show_delta
sign-file.c sign-file: fix build error in sign-file.c with libressl 2017-02-10 12:43:47 +11:00
sortextable.c powerpc: Build-time sort the exception table 2016-11-14 11:11:51 +11:00
sortextable.h
spdxcheck-test.sh scripts: add spdxcheck.py self test 2018-12-28 12:11:44 -08:00
spdxcheck.py scripts/spdxcheck.py: fix C++ comment style detection 2019-02-22 08:47:05 -07:00
spelling.txt scripts/spelling.txt: add more spellings to spelling.txt 2019-03-07 18:31:59 -08:00
sphinx-pre-install docs-rst: don't require adjustbox anymore 2017-09-08 10:02:55 -06:00
split-man.pl MAINTAINERS & files: Canonize the e-mails I use at files 2018-05-04 06:21:06 -04:00
stackdelta License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
stackusage License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
subarch.include selftests: add headers_install to lib.mk 2018-09-05 08:12:09 -06:00
tags.sh scripts/tags.sh: add more declarations 2018-12-28 12:11:44 -08:00
unifdef.c unifdef: use memcpy instead of strncpy 2018-11-30 14:45:01 -08:00
ver_linux ver_linux: Assign constant RE to variable name for clarity 2019-01-22 13:34:35 +01:00
xen-hypercalls.sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xz_wrap.sh