Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ptp: prevent possible ABBA deadlock in ptp_clock_freerun()

syzbot reported the following ABBA deadlock:

CPU0 CPU1
---- ----
n_vclocks_store()
lock(&ptp->n_vclocks_mux) [1]
(physical clock)
pc_clock_adjtime()
lock(&clk->rwsem) [2]
(physical clock)
...
ptp_clock_freerun()
ptp_vclock_in_use()
lock(&ptp->n_vclocks_mux) [3]
(physical clock)
ptp_clock_unregister()
posix_clock_unregister()
lock(&clk->rwsem) [4]
(virtual clock)

Since ptp virtual clock is registered only under ptp physical clock, both
ptp_clock and posix_clock must be physical clocks for ptp_vclock_in_use()
to lock &ptp->n_vclocks_mux and check ptp->n_vclocks.

However, when unregistering vclocks in n_vclocks_store(), the locking
ptp->n_vclocks_mux is a physical clock lock, but clk->rwsem of
ptp_clock_unregister() called through device_for_each_child_reverse()
is a virtual clock lock.

Therefore, clk->rwsem used in CPU0 and clk->rwsem used in CPU1 are
different locks, but in lockdep, a false positive occurs because the
possibility of deadlock is determined through lock-class.

To solve this, lock subclass annotation must be added to the posix_clock
rwsem of the vclock.

Reported-by: syzbot+7cfb66a237c4a5fb22ad@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7cfb66a237c4a5fb22ad
Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250728062649.469882-1-aha310510@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Jeongjun Park and committed by
Jakub Kicinski
2efe4123 c04fdca8

+12
+5
drivers/ptp/ptp_private.h
··· 24 24 #define PTP_DEFAULT_MAX_VCLOCKS 20 25 25 #define PTP_MAX_CHANNELS 2048 26 26 27 + enum { 28 + PTP_LOCK_PHYSICAL = 0, 29 + PTP_LOCK_VIRTUAL, 30 + }; 31 + 27 32 struct timestamp_event_queue { 28 33 struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS]; 29 34 int head;
+7
drivers/ptp/ptp_vclock.c
··· 154 154 return PTP_VCLOCK_REFRESH_INTERVAL; 155 155 } 156 156 157 + static void ptp_vclock_set_subclass(struct ptp_clock *ptp) 158 + { 159 + lockdep_set_subclass(&ptp->clock.rwsem, PTP_LOCK_VIRTUAL); 160 + } 161 + 157 162 static const struct ptp_clock_info ptp_vclock_info = { 158 163 .owner = THIS_MODULE, 159 164 .name = "ptp virtual clock", ··· 217 212 kfree(vclock); 218 213 return NULL; 219 214 } 215 + 216 + ptp_vclock_set_subclass(vclock->clock); 220 217 221 218 timecounter_init(&vclock->tc, &vclock->cc, 0); 222 219 ptp_schedule_worker(vclock->clock, PTP_VCLOCK_REFRESH_INTERVAL);