linux-kernel - ping // [PATCH] mtd:cfi_cmdset_0002: fix atomic sleep bug when CONFIG_MTD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Dec 2020 18:48:33 +0800
From:   Xiaoming Ni <nixiaoming@...wei.com>
To:     <miquel.raynal@...tlin.com>, <richard@....at>, <vigneshr@...com>,
        <tudor.ambarus@...rochip.com>, <tpoynor@...sta.com>,
        <tglx@...utronix.de>, <vwool@...mvista.com>
CC:     <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
        <stable@...r.kernel.org>, <gregkh@...uxfoundation.org>,
        <wangle6@...wei.com>
Subject: ping // [PATCH] mtd:cfi_cmdset_0002: fix atomic sleep bug when
 CONFIG_MTD_XIP=y

ping

On 2020/11/27 21:07, Xiaoming Ni wrote:
> When CONFIG_MTD_XIP=y, local_irq_disable() is called in xip_disable().
> To avoid sleep in interrupt context, we need to call local_irq_enable()
> before schedule().
> 
> The problem call stack is as follows:
> bug1:
> 	do_write_oneword_retry()
> 		xip_disable()
> 			local_irq_disable()
> 		do_write_oneword_once()
> 			schedule()
> bug2:
> 	do_write_buffer()
> 		xip_disable()
> 			local_irq_disable()
> 		do_write_buffer_wait()
> 			schedule()
> bug3:
> 	do_erase_chip()
> 		xip_disable()
> 			local_irq_disable()
> 		schedule()
> bug4:
> 	do_erase_oneblock()
> 		xip_disable()
> 			local_irq_disable()
> 		schedule()
> 
> Fixes: 02b15e343aee ("[MTD] XIP for AMD CFI flash.")
> Cc: stable@...r.kernel.org # v2.6.13
> Signed-off-by: Xiaoming Ni <nixiaoming@...wei.com>
> ---
>   drivers/mtd/chips/cfi_cmdset_0002.c | 16 ++++++++++++++++
>   1 file changed, 16 insertions(+)
> 
> diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
> index a1f3e1031c3d..12c3776f093a 100644
> --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> @@ -1682,7 +1682,11 @@ static int __xipram do_write_oneword_once(struct map_info *map,
>   			set_current_state(TASK_UNINTERRUPTIBLE);
>   			add_wait_queue(&chip->wq, &wait);
>   			mutex_unlock(&chip->mutex);
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_enable();
>   			schedule();
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_disable();
>   			remove_wait_queue(&chip->wq, &wait);
>   			timeo = jiffies + (HZ / 2); /* FIXME */
>   			mutex_lock(&chip->mutex);
> @@ -1962,7 +1966,11 @@ static int __xipram do_write_buffer_wait(struct map_info *map,
>   			set_current_state(TASK_UNINTERRUPTIBLE);
>   			add_wait_queue(&chip->wq, &wait);
>   			mutex_unlock(&chip->mutex);
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_enable();
>   			schedule();
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_disable();
>   			remove_wait_queue(&chip->wq, &wait);
>   			timeo = jiffies + (HZ / 2); /* FIXME */
>   			mutex_lock(&chip->mutex);
> @@ -2461,7 +2469,11 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
>   			set_current_state(TASK_UNINTERRUPTIBLE);
>   			add_wait_queue(&chip->wq, &wait);
>   			mutex_unlock(&chip->mutex);
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_enable();
>   			schedule();
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_disable();
>   			remove_wait_queue(&chip->wq, &wait);
>   			mutex_lock(&chip->mutex);
>   			continue;
> @@ -2560,7 +2572,11 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
>   			set_current_state(TASK_UNINTERRUPTIBLE);
>   			add_wait_queue(&chip->wq, &wait);
>   			mutex_unlock(&chip->mutex);
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_enable();
>   			schedule();
> +			if (IS_ENABLED(CONFIG_MTD_XIP))
> +				local_irq_disable();
>   			remove_wait_queue(&chip->wq, &wait);
>   			mutex_lock(&chip->mutex);
>   			continue;
>