lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 16 Oct 2021 04:11:55 +0800 From: <miles.chen@...iatek.com> To: <bvanassche@....org> CC: <jejb@...ux.ibm.com>, <linux-arm-kernel@...ts.infradead.org>, <linux-kernel@...r.kernel.org>, <linux-mediatek@...ts.infradead.org>, <linux-scsi@...r.kernel.org>, <martin.petersen@...cle.com>, <martink@...teo.de>, <matthias.bgg@...il.com>, <miles.chen@...iatek.com>, <stanley.chu@...iatek.com>, <wsd_upstream@...iatek.com> Subject: Re: [PATCH] scsi: sd: fix crashes in sd_resume_runtime From: Miles Chen <miles.chen@...iatek.com> > Fixing this crash by adding a check inside sd_resume_runtime() seems wrong to me. sd_probe() namely calls dev_set_drvdata(dev, sdkp) before > sd_probe() has finished so even with the above patch applied sd_resume() can be called before sd_probe() has finished. > > With which kernel version has this crash been encountered? The > scsi_autopm_get_device() / scsi_autopm_put_device() pair added by commit > 6fe8c1dbefd6 ("scsi: balance out autopm get/put calls in scsi_sysfs_add_sdev()"; kernel v3.18) should be sufficient to prevent the reported crash. > > Thanks, Thanks for your comment. I hit this in v5.15-rc1 merge, I can still reproduce this with v5.15-rc5. I found two ways to avoid the crash: 1) revert commit ed4246d37f3b ("scsi: sd: REQUEST SENSE for BLIST_IGN_MEDIA_CHANGE devices in runtime_resume()") works for me. 2) adding the NULL point check in this patch. >From the backtrace, dev_set_drvdata() is called after sd_resume_runtime() is called. sd_probe() { scsi_autopm_get_device() pm_runtime_get_sync() __pm_runtime_resume() rpm_resume() ... sd_resume_runtime() // crash here dev_set_drvdata(dev, sdkp); // sdkp is set later } [ 4.861395][ T151] sd_resume_runtime+0x20/0x14c [ 4.862025][ T151] scsi_runtime_resume+0x84/0xe4 [ 4.862667][ T151] __rpm_callback+0x1f4/0x8cc [ 4.863275][ T151] rpm_resume+0x7e8/0xaa4 [ 4.863836][ T151] __pm_runtime_resume+0xa0/0x110 [ 4.864489][ T151] sd_probe+0x30/0x428 [ 4.865016][ T151] really_probe+0x14c/0x500
Powered by blists - more mailing lists