linux-kernel - [PATCH] fix panic at pwq_activate_delayed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 1 Aug 2018 10:14:38 +0000
From:   "He, Bo" <bo.he@...el.com>
To:     "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     "balbi@...nel.org" <balbi@...nel.org>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "jackp@...eaurora.org" <jackp@...eaurora.org>,
        "plr.vincent@...il.com" <plr.vincent@...il.com>,
        "Zhang, Yanmin" <yanmin.zhang@...el.com>,
        "Zhang, Jun" <jun.zhang@...el.com>,
        "Bai, Jie A" <jie.a.bai@...el.com>
Subject: [PATCH] fix panic at pwq_activate_delayed_work.

the kernel panic is one regression with the patch:
usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers

the kernel panic is followed the list corrupt warning:
WARNING: CPU: 0 PID: 1430 at ../../../../../../kernel/4.14/lib/list_debug.c:28 __list_add_valid+0x53/0x80
Workqueue: adb ffs_aio_cancel_worker
task: ffff880076ebe080 task.stack: ffffc90001864000
RIP: 0010:__list_add_valid+0x53/0x80
Call Trace:
insert_work+0x51/0xc0
__queue_work+0x10e/0x430
queue_work_on+0x71/0x80
ffs_epfile_async_io_complete+0x4b/0x50
usb_gadget_giveback_request+0x29/0x90
dwc3_gadget_giveback+0x3a/0x50 [dwc3]
dwc3_gadget_ep_dequeue+0x92/0x300 [dwc3]
usb_ep_dequeue+0x23/0x90
ffs_aio_cancel_worker+0x16/0x20
process_one_work+0x186/0x3e0
worker_thread+0x3d/0x3b0
kthread+0x132/0x150
ret_from_fork+0x3a/0x50

the root cause is there is race between ffs_epfile_async_io_complete()
and ffs_aio_cancel() queue the ffs->io_completion_wq.

ffs_epfile_async_io_complete() is safe to hold the eps_lock
with the below backtrace:
ffs_epfile_async_io_complete+0x25/0x70
usb_gadget_giveback_request+0x29/0x90
dwc3_gadget_giveback+0x3a/0x50 [dwc3]
__dwc3_gadget_ep_disable+0x5c/0x270 [dwc3]
dwc3_gadget_ep_disable+0x42/0xf0 [dwc3]
usb_ep_disable+0x24/0xa0
ffs_func_eps_disable.isra.15+0x5f/0xb0

the patch add eps_lock to protect the io_completion_wq in ffs_aio_cancel.

Signed-off-by: he, bo <bo.he@...el.com>
Signed-off-by: Bai, Jie A <jie.a.bai@...el.com>

---
 drivers/usb/gadget/function/f_fs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 3ada83d..45ade26 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1091,6 +1091,8 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
 
 	ENTER();
 
+	spin_lock_irq(&ffs->eps_lock);
+
 	if (likely(io_data && io_data->ep && io_data->req)) {
 		INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
 		queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
@@ -1099,6 +1101,8 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
 		value = -EINVAL;
 	}
 
+	spin_unlock_irq(&ffs->eps_lock);
+
 	return value;
 }
 
-- 
2.7.4