linux-kernel - Re: [PATCH] mmc: block: Prevent new req entering queue while freeing up the queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 3 Nov 2020 16:25:00 +0100
From:   Ulf Hansson <ulf.hansson@...aro.org>
To:     Veerabhadrarao Badiganti <vbadigan@...eaurora.org>
Cc:     Adrian Hunter <adrian.hunter@...el.com>,
        "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-arm-msm <linux-arm-msm@...r.kernel.org>,
        Jens Axboe <axboe@...nel.dk>,
        Baolin Wang <baolin.wang@...aro.org>,
        Chaotian Jing <chaotian.jing@...iatek.com>,
        Peng Hao <richard.peng@...o.com>
Subject: Re: [PATCH] mmc: block: Prevent new req entering queue while freeing
 up the queue

On Wed, 28 Oct 2020 at 12:20, Veerabhadrarao Badiganti
<vbadigan@...eaurora.org> wrote:
>
> The commit bbdc74dc19e0 ("mmc: block: Prevent new req entering queue
> after its cleanup") has introduced this change but it got moved after
> del_gendisk() with commit 57678e5a3d51 ("mmc: block: Delete gendisk
> before cleaning up the request queue").

This isn't the first time we have spotted errors in this path. Seems
like a difficult path to get correct. :-)

>
> It is blocking reboot with below Call stack().
>
> INFO: task reboot:3086 blocked for more than 122 seconds.
>      __schedule
>      schedule
>      schedule_timeout
>      io_schedule_timeout
>      do_wait_for_common
>      wait_for_completion_io
>      submit_bio_wait
>      blkdev_issue_flush
>      ext4_sync_fs
>      __sync_filesystem
>      sync_filesystem
>      fsync_bdev
>      invalidate_partition
>      del_gendisk
>      mmc_blk_remove_req
>      mmc_blk_remove
>      mmc_bus_remove
>      device_release_driver_internal
>      device_release_driver
>      bus_remove_device
>      device_del
>      mmc_remove_card
>      mmc_remove
>      mmc_stop_host
>      mmc_remove_host
>      sdhci_remove_host
>      sdhci_msm_remove

Why do you call sdhci_msm_remove() from the shutdown callback? What
specific operations do you need to run in the shutdown path for sdhci
msm?

The important part should be to do a graceful shutdown of the card
(and the block device) - is there anything else?

Or you are just using the shutdown callback as a simple way to trigger
this problem? Could unbinding the driver trigger the same issue?

>      sdhci_msm_shutdown
>      platform_drv_shutdown
>      device_shutdown
>      kernel_restart_prepare
>      kernel_restart
>
> So bringing this change back.
>
> Signed-off-by: Veerabhadrarao Badiganti <vbadigan@...eaurora.org>
> ---
>
> I'm observing this issue 100% of the time with shutdown callback added to sdhci-msm driver.
> I'm trying on 5.4 kernel with ChromeOS.
>
> Please let me know if this can be fixed in a better way.

I don't know yet, but I will have a closer look. Let's also see if
Adrian has some thoughts.

Kind regards
Uffe

> ---
>
>  drivers/mmc/core/block.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
> index 8d3df0be0355..76dbb2b8a13b 100644
> --- a/drivers/mmc/core/block.c
> +++ b/drivers/mmc/core/block.c
> @@ -2627,6 +2627,7 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)
>                  * from being accepted.
>                  */
>                 card = md->queue.card;
> +               blk_set_queue_dying(md->queue.queue);
>                 if (md->disk->flags & GENHD_FL_UP) {
>                         device_remove_file(disk_to_dev(md->disk), &md->force_ro);
>                         if ((md->area_type & MMC_BLK_DATA_AREA_BOOT) &&
> --
> Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc., is a member of Code Aurora Forum, a Linux Foundation Collaborative Project
>