linux-kernel - Re: 5.14-rc failure to resume

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wggE0PF4fAi8cFEpi=ryyV=WyYupddcHHbE3nggQJgYig@mail.gmail.com>
Date:   Sat, 24 Jul 2021 13:48:14 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Jens Axboe <axboe@...nel.dk>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Andy Shevchenko <andy.shevchenko@...il.com>,
        Daniel Scally <djrscally@...il.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>
Subject: Re: 5.14-rc failure to resume

On Sat, Jul 24, 2021 at 12:44 PM Jens Axboe <axboe@...nel.dk> wrote:
>
> This does appear to be the culprit. With it reverted on top of current
> master (and with the block and io_uring changes pulled in too), the
> kernel survives many resumes without issue.

That commit seems fundamentally buggy.

It makes "acpi_dev_get_next_match_dev()" always do

        acpi_dev_put(adev);

to put the previous device, but "adev" is perfectly valid as NULL, and
acpi_dev_get_next_match_dev() even tests for it:

        struct device *start = adev ? &adev->dev : NULL;

so it can - and will - do

        acpi_dev_put(NULL);

which does

        put_device(&adev->dev);

and passes in an invalid pointer to put_device().

And yes, that adev very much can be NULL, with drivers/acpi/utils.c
even passing it in explicitly:

  struct acpi_device *
  acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv)
  {
        return acpi_dev_get_next_match_dev(NULL, hid, uid, hrv);
  }
  EXPORT_SYMBOL(acpi_dev_get_first_match_dev);

Am I missing something? How does that code work at all for anybody?

I probably _am_ missing something.

              Linus