linux-kernel - [PATCH 5.10 13/63] scsi: block: Fix a race in the runtime power management code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210104155709.457411783@linuxfoundation.org>
Date:   Mon,  4 Jan 2021 16:57:06 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Ming Lei <ming.lei@...hat.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        Christoph Hellwig <hch@....de>, Hannes Reinecke <hare@...e.de>,
        Jens Axboe <axboe@...nel.dk>,
        Alan Stern <stern@...land.harvard.edu>,
        Stanley Chu <stanley.chu@...iatek.com>,
        Can Guo <cang@...eaurora.org>,
        Bart Van Assche <bvanassche@....org>,
        "Martin K. Petersen" <martin.petersen@...cle.com>
Subject: [PATCH 5.10 13/63] scsi: block: Fix a race in the runtime power management code

From: Bart Van Assche <bvanassche@....org>

commit fa4d0f1992a96f6d7c988ef423e3127e613f6ac9 upstream.

With the current implementation the following race can happen:

 * blk_pre_runtime_suspend() calls blk_freeze_queue_start() and
   blk_mq_unfreeze_queue().

 * blk_queue_enter() calls blk_queue_pm_only() and that function returns
   true.

 * blk_queue_enter() calls blk_pm_request_resume() and that function does
   not call pm_request_resume() because the queue runtime status is
   RPM_ACTIVE.

 * blk_pre_runtime_suspend() changes the queue status into RPM_SUSPENDING.

Fix this race by changing the queue runtime status into RPM_SUSPENDING
before switching q_usage_counter to atomic mode.

Link: https://lore.kernel.org/r/20201209052951.16136-2-bvanassche@acm.org
Fixes: 986d413b7c15 ("blk-mq: Enable support for runtime power management")
Cc: Ming Lei <ming.lei@...hat.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
Cc: stable <stable@...r.kernel.org>
Reviewed-by: Christoph Hellwig <hch@....de>
Reviewed-by: Hannes Reinecke <hare@...e.de>
Reviewed-by: Jens Axboe <axboe@...nel.dk>
Acked-by: Alan Stern <stern@...land.harvard.edu>
Acked-by: Stanley Chu <stanley.chu@...iatek.com>
Co-developed-by: Can Guo <cang@...eaurora.org>
Signed-off-by: Can Guo <cang@...eaurora.org>
Signed-off-by: Bart Van Assche <bvanassche@....org>
Signed-off-by: Martin K. Petersen <martin.petersen@...cle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 block/blk-pm.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/block/blk-pm.c
+++ b/block/blk-pm.c
@@ -67,6 +67,10 @@ int blk_pre_runtime_suspend(struct reque

 	WARN_ON_ONCE(q->rpm_status != RPM_ACTIVE);

+	spin_lock_irq(&q->queue_lock);
+	q->rpm_status = RPM_SUSPENDING;
+	spin_unlock_irq(&q->queue_lock);
+
 	/*
 	 * Increase the pm_only counter before checking whether any
 	 * non-PM blk_queue_enter() calls are in progress to avoid that any
@@ -89,15 +93,14 @@ int blk_pre_runtime_suspend(struct reque
 	/* Switch q_usage_counter back to per-cpu mode. */
 	blk_mq_unfreeze_queue(q);

-	spin_lock_irq(&q->queue_lock);
-	if (ret < 0)
+	if (ret < 0) {
+		spin_lock_irq(&q->queue_lock);
+		q->rpm_status = RPM_ACTIVE;
 		pm_runtime_mark_last_busy(q->dev);
-	else
-		q->rpm_status = RPM_SUSPENDING;
-	spin_unlock_irq(&q->queue_lock);
+		spin_unlock_irq(&q->queue_lock);

-	if (ret)
 		blk_clear_pm_only(q);
+	}

 	return ret;
 }