linux-kernel - [PATCH] PM / wakeup: Fix sysfs registration error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190814004053.23775-1-swboyd@chromium.org>
Date:   Tue, 13 Aug 2019 17:40:53 -0700
From:   Stephen Boyd <swboyd@...omium.org>
To:     "Rafael J. Wysocki" <rjw@...ysocki.net>
Cc:     linux-kernel@...r.kernel.org, linux-pm@...r.kernel.org,
        Qian Cai <cai@....pw>, Tri Vo <trong@...roid.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: [PATCH] PM / wakeup: Fix sysfs registration error path

We shouldn't call wakeup_source_destroy() from the error path in
wakeup_source_register() because that calls __pm_relax() which takes a
lock that isn't initialized until wakeup_source_add() is called. Add a
new function, wakeup_source_free(), that just does the bare minimum to
free a wakeup source that was created but hasn't been added yet and use
it from the two places it's needed. This fixes the following problem
seen on various x86 server boxes:

 INFO: trying to register non-static key.
 the code is fine but needs lockdep annotation.
 turning off the locking correctness validator.
 CPU: 12 PID: 1 Comm: swapper/0 Not tainted 5.3.0-rc4-
 Hardware name: HP ProLiant XL420 Gen9/ProLiant XL420 Gen9, BIOS U19 12/27/2015
 Call Trace:
  dump_stack+0x62/0x9a
  register_lock_class+0x95a/0x960
  ? __platform_driver_probe+0xcd/0x230
  ? __platform_create_bundle+0xc0/0xe0
  ? i8042_init+0x4ec/0x578
  ? do_one_initcall+0xfe/0x45a
  ? kernel_init_freeable+0x614/0x6a7
  ? kernel_init+0x11/0x138
  ? ret_from_fork+0x35/0x40
  ? is_dynamic_key+0xf0/0xf0
  ? rwlock_bug.part.0+0x60/0x60
  ? __debug_check_no_obj_freed+0x8e/0x250
  __lock_acquire.isra.13+0x5f/0x830
  ? __debug_check_no_obj_freed+0x152/0x250
  lock_acquire+0x107/0x220
  ? __pm_relax.part.2+0x21/0xa0
  _raw_spin_lock_irqsave+0x35/0x50
  ? __pm_relax.part.2+0x21/0xa0
  __pm_relax.part.2+0x21/0xa0
  wakeup_source_destroy.part.3+0x18/0x190
  wakeup_source_register+0x43/0x50

Fixes: 986845e747af ("PM / wakeup: Show wakeup sources stats in sysfs")
Reported-by: Qian Cai <cai@....pw>
Cc: Qian Cai <cai@....pw>
Cc: Tri Vo <trong@...roid.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Signed-off-by: Stephen Boyd <swboyd@...omium.org>
---
 drivers/base/power/wakeup.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 3a7f5803aa81..f7925820b5ca 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -137,6 +137,13 @@ static void wakeup_source_record(struct wakeup_source *ws)
 	spin_unlock_irqrestore(&deleted_ws.lock, flags);
 }

+static void wakeup_source_free(struct wakeup_source *ws)
+{
+	ida_free(&wakeup_ida, ws->id);
+	kfree_const(ws->name);
+	kfree(ws);
+}
+
 /**
  * wakeup_source_destroy - Destroy a struct wakeup_source object.
  * @ws: Wakeup source to destroy.
@@ -150,9 +157,7 @@ void wakeup_source_destroy(struct wakeup_source *ws)

 	__pm_relax(ws);
 	wakeup_source_record(ws);
-	ida_free(&wakeup_ida, ws->id);
-	kfree_const(ws->name);
-	kfree(ws);
+	wakeup_source_free(ws);
 }
 EXPORT_SYMBOL_GPL(wakeup_source_destroy);

@@ -217,7 +222,7 @@ struct wakeup_source *wakeup_source_register(struct device *dev,
 	if (ws) {
 		ret = wakeup_source_sysfs_add(dev, ws);
 		if (ret) {
-			wakeup_source_destroy(ws);
+			wakeup_source_free(ws);
 			return NULL;
 		}
 		wakeup_source_add(ws);
-- 
Sent by a computer through tubes