linux-kernel - [PATCH 1/1] driver core: Fix unbalance probe_count in really

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200603064509.32736-1-hpeter+linux_kernel@gmail.com>
Date:   Wed,  3 Jun 2020 14:45:09 +0800
From:   "Ji-Ze Hong (Peter Hong)" <hpeter@...il.com>
To:     gregkh@...uxfoundation.org, rafael@...nel.org
Cc:     geert+renesas@...der.be, peter_hong@...tek.com.tw,
        linux-kernel@...r.kernel.org,
        "Ji-Ze Hong (Peter Hong)" <hpeter+linux_kernel@...il.com>
Subject: [PATCH 1/1] driver core: Fix unbalance probe_count in really_probe()

In previous patch, using return -EBUSY in really_probe() instead WARN_ON()
only. The following is the partial code.

	...
	atomic_inc(&probe_count);
	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
		 drv->bus->name, __func__, drv->name, dev_name(dev));
	if (!list_empty(&dev->devres_head)) {
		dev_crit(dev, "Resources present before probing\n");
		return -EBUSY;
	}
	...

When the devres_head is not empty, this code will return -EBUSY to prevent
resource conflict, but it forgot to balance probe_count. We can move the
increasement code below the resource checking.

	...
	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
		 drv->bus->name, __func__, drv->name, dev_name(dev));
	if (!list_empty(&dev->devres_head)) {
		dev_crit(dev, "Resources present before probing\n");
		return -EBUSY;
	}
	atomic_inc(&probe_count);
	...

The original code will cause lots motherboard freeze in reboot/shutdown
with systemd message "Reached target Reboot" or "Reached target Shutdown"
with serial8250 platform driver. e.g. AOPEN DE6200. The conflict boot
dmesg below:

	Serial: 8250/16550 driver, 32 ports, IRQ sharing enabled
	00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 921600) is a 16550A
	00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 921600) is a 16550A
	00:05: ttyS2 at I/O 0x3e8 (irq = 5, base_baud = 921600) is a 16550A
	serial8250: ttyS3 at I/O 0x2e8 (irq = 3, base_baud = 921600) is a 16550A

Reboot/Shutdown will freeze in wait_for_device_probe(), message as
following:
	INFQ: task systemd-shutdown: 1 blocked for more than 120 seconds.
	Not tainted 5.7.0-rc7-tty-next+ #241
	"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
	Call Trace:
	  __schedule+0x3d2/0x700
	  ? printk+0x52/0x6e
	  schedule+0x4f/0xc0
	  wait_for_device_probe+0xbb/0xl40
	  ? wait_woken+0x80/0x80
	  device_shutdown+0xl5/0xle0
	  kernel_power_off+0x35/0x70
	  __do_sys_reboot+0xla0/0x220
	  ? do_sigtimedwait+0xld0/0x210
	  ? do.writev+0x6a/0xll0
	  ? do.writev+0x6a/0xll0
	  ? sigprocmask+0x6f/Oxa0
	  __64_sys_reboot+0xle/0x20
	  do_syscall_64+0x57/0xlb0

Fixes: 7c35e699c88b ("driver core: Print device when resources present in really_probe()")
Signed-off-by: Ji-Ze Hong (Peter Hong) <hpeter+linux_kernel@...il.com>
---
 drivers/base/dd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 9a1d940342ac..5173b0766a26 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -487,7 +487,6 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 	if (ret)
 		return ret;
 
-	atomic_inc(&probe_count);
 	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
 		 drv->bus->name, __func__, drv->name, dev_name(dev));
 	if (!list_empty(&dev->devres_head)) {
@@ -495,6 +494,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 		return -EBUSY;
 	}
 
+	atomic_inc(&probe_count);
+
 re_probe:
 	dev->driver = drv;
 
-- 
2.17.1