linux-kernel - Re: [PATCH v4 1/1] scsi: Fix racing between dev init and dev reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3164cd23-28b5-e971-c7a9-1b565b344ed5@acm.org>
Date:   Fri, 15 Apr 2022 21:49:51 -0700
From:   Bart Van Assche <bvanassche@....org>
To:     Alice Chao <alice.chao@...iatek.com>, jejb@...ux.ibm.com,
        martin.petersen@...cle.com, matthias.bgg@...il.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org
Cc:     stanley.chu@...iatek.com, peter.wang@...iatek.com,
        chun-hung.wu@...iatek.com, powen.kao@...iatek.com,
        cc.chou@...iatek.com, chaotian.jing@...iatek.com,
        jiajie.hao@...iatek.com, qilin.tan@...iatek.com,
        lin.gui@...iatek.com, yanxu.wei@...iatek.com,
        wsd_upstream@...iatek.com
Subject: Re: [PATCH v4 1/1] scsi: Fix racing between dev init and dev reset

On 4/14/22 23:12, Alice Chao wrote:
> diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
> index 0a70aa763a96..abf9a71ed77c 100644
> --- a/drivers/scsi/scsi_lib.c
> +++ b/drivers/scsi/scsi_lib.c
> @@ -2461,6 +2461,7 @@ static void scsi_evt_emit(struct scsi_device *sdev, struct scsi_event *evt)
>   		break;
>   	case SDEV_EVT_POWER_ON_RESET_OCCURRED:
>   		envp[idx++] = "SDEV_UA=POWER_ON_RESET_OCCURRED";
> +		wait_event(sdev->host->host_wait, sdev->sdev_gendev.kobj.parent != NULL);
>   		break;
>   	default:
>   		/* do nothing */
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index f4e6c68ac99e..431f229ac435 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -1904,6 +1904,7 @@ static void do_scsi_scan_host(struct Scsi_Host *shost)
>   	} else {
>   		scsi_scan_host_selected(shost, SCAN_WILD_CARD, SCAN_WILD_CARD,
>   				SCAN_WILD_CARD, 0);
> +		wake_up(&shost->host_wait);
>   	}
>   }

The above patch can only work if scanning a host is followed by a POWER 
ON unit attention. I don't think that is guaranteed. Additionally, what 
will happen with the wait loop if the device generates a POWER on unit 
attention after the device has been removed from its parent? 
kobject_del() clears the parent pointer. device_del() calls 
kobject_del(). scsi_remove_device() calls device_del() before the 
request queue is destroyed.

Thanks,

Bart.