linux-kernel - Re: [PATCH] scsi: sd: fix crashes in sd_resume

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211015201155.12212-1-miles.chen@mediatek.com>
Date:   Sat, 16 Oct 2021 04:11:55 +0800
From:   <miles.chen@...iatek.com>
To:     <bvanassche@....org>
CC:     <jejb@...ux.ibm.com>, <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>, <linux-scsi@...r.kernel.org>,
        <martin.petersen@...cle.com>, <martink@...teo.de>,
        <matthias.bgg@...il.com>, <miles.chen@...iatek.com>,
        <stanley.chu@...iatek.com>, <wsd_upstream@...iatek.com>
Subject: Re: [PATCH] scsi: sd: fix crashes in sd_resume_runtime

From: Miles Chen <miles.chen@...iatek.com>

> Fixing this crash by adding a check inside sd_resume_runtime() seems wrong to me. sd_probe() namely calls dev_set_drvdata(dev, sdkp) before
> sd_probe() has finished so even with the above patch applied sd_resume() can be called before sd_probe() has finished.
> 
> With which kernel version has this crash been encountered? The
> scsi_autopm_get_device() / scsi_autopm_put_device() pair added by commit
> 6fe8c1dbefd6 ("scsi: balance out autopm get/put calls in scsi_sysfs_add_sdev()"; kernel v3.18) should be sufficient to prevent the reported crash.
> 
> Thanks,

Thanks for your comment.

I hit this in v5.15-rc1 merge, I can still reproduce this with v5.15-rc5.
I found two ways to avoid the crash:
1) revert commit ed4246d37f3b ("scsi: sd: REQUEST SENSE for
BLIST_IGN_MEDIA_CHANGE devices in runtime_resume()") works for me.
2) adding the NULL point check in this patch.

>From the backtrace, dev_set_drvdata() is called after sd_resume_runtime()
is called. 

sd_probe()
{
 scsi_autopm_get_device()
   pm_runtime_get_sync()
     __pm_runtime_resume()
       rpm_resume()
        ...
	 sd_resume_runtime() // crash here

  dev_set_drvdata(dev, sdkp); // sdkp is set later
}

[    4.861395][  T151]  sd_resume_runtime+0x20/0x14c
[    4.862025][  T151]  scsi_runtime_resume+0x84/0xe4
[    4.862667][  T151]  __rpm_callback+0x1f4/0x8cc
[    4.863275][  T151]  rpm_resume+0x7e8/0xaa4
[    4.863836][  T151]  __pm_runtime_resume+0xa0/0x110
[    4.864489][  T151]  sd_probe+0x30/0x428
[    4.865016][  T151]  really_probe+0x14c/0x500