Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liwei Song <liwei.song@windriver.com>
To:     MiquelRaynal <miquel.raynal@bootlin.com>,
        RichardWeinberger <richard@nod.at>,
        VigneshRaghavendra <vigneshr@ti.com>,
        ChristophHellwig <hch@lst.de>
Cc:     linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org,
        liwei.song@windriver.com
Subject: [PATCH] mtd_blkdevs: add mtd_table_mutex lock back to blktrans_{open, release} to avoid race condition
Date:   Tue,  9 Aug 2022 15:57:53 +0800
Message-Id: <20220809075753.21950-1-liwei.song@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?1RqSMUoXLIhyQkRrINVuh0Y0mcCrPNAilHkqQvUfj8cABrTuOaWEPl0npDBl?=
 =?us-ascii?Q?PvRjtROO+8f4ylzclJEkpsrZtmuh2JFJLBYr1nkFi25ZiiUguOIiWV9AEXq2?=
 =?us-ascii?Q?18/PiXOZ9QbaSK90xukRi6XgRsaG3sf8LeStQxJ+UAib5+pSH9qbkNL0nogc?=
 =?us-ascii?Q?+ThXNjD/BoXkYXkSal/OwDip3NxjZaP3Waeo9tNmCNCbgAgnS6SjquW6Gz2w?=
 =?us-ascii?Q?c9QYhmdyK8SuKNUSaZvsrmDTBxF7B3JVuytl9EdxeSXOJT+5XruTvTxtdVNI?=
 =?us-ascii?Q?er1MQwl3OWI64Ox1prznt19WroAzLKGF/6NKlfdVpx1GXW4tD46WFFHTLv4k?=
 =?us-ascii?Q?3iHh5mWU6adYg3MNXY2NTpy5tCLYU340rczm74EcyD+9uI6MFTuFevMEmXLw?=
 =?us-ascii?Q?PWfsv79d8UqbMihTI+QLybw+xLisSP12P5VZ8G2Fi1UbWEhb4tFIywOhS8iY?=
 =?us-ascii?Q?JIjbh5Vqk+1AihcYHr5Uky7yoxCyLcsmvzEZzUqGzFOJyRllKzIPXr6Tk+RD?=
 =?us-ascii?Q?U4aiwo0X1mIjL2wB2ivUpLWojpgJkgEK4Pbpi7QsSnz10EwMpXLGQRgNoZMK?=
 =?us-ascii?Q?QGGwRyw9GyEUMLqNg7xQ33DwWla/wdbE3Qc5foBlMdtOIBfseoKTbhIXVFP3?=
 =?us-ascii?Q?t0CN5QTqlPndP4MkFNBRlkglevz/YIjYngicj5+jfjlLyuGDnu3qmp4fISlF?=
 =?us-ascii?Q?ZG6QwJzD4txFEqWjeX6iVoowGPvD+zxeDE6hVUzzTRMUCnZtV7+espvmrVo7?=
 =?us-ascii?Q?dKCEQJy+aQaM5XqhoHofn8qyJmo8gSa+QJ9cKBrkfm/pY1eWm6UCfYKuDc13?=
 =?us-ascii?Q?2TrjSz4uocY/nB32yGz5dxPEH0B1YZb35G6f7HRjKQGkfG6bXFrcOOjFljoE?=
 =?us-ascii?Q?IKOXYGs8tgCsW40gJXi143BTpIscPhQcRvB8CDF3NlS57pBcVq+8UtlswCOv?=
 =?us-ascii?Q?A2XrflQpcRz7qwsh34J/T4kIyrtG3Im026Ba6duMXeTHEugNwDydT+xvr0IB?=
 =?us-ascii?Q?7ONXciXpV6yCI4zdX/rNQaQzm59C1p5d+8Y16dwy/LVsPwcsYE9aDupUOvgd?=
 =?us-ascii?Q?1dXRbKMSU6grXHhgciOxMn+cVBxk2OmQbTpn6Zh2HMnbVBlgV0KyDTmjRr47?=
 =?us-ascii?Q?fU0gGeHV0QPqPmGE7hKfzn01YClaB7cYOEeDmi9Bl2BshoEIBKafEmEqxvhO?=
 =?us-ascii?Q?Vkm2alYZTWkQSkaV5AASVG8WZofV0VcEHibiJGhqdXSgeKw8HPo86ZcPc4zd?=
 =?us-ascii?Q?zkEUtI2dPu+dJxYe9a2eB1sh8FNLzHZvmh5duXxLWBTt5LXWHHBYzKM5+8vv?=
 =?us-ascii?Q?M4VxzKTcyvldkswNpnNy48Lt4RlhnpxlQq7UCBlW2mlvWJZY81eq7advkcmo?=
 =?us-ascii?Q?NUIbmrSWvzEppKU/x8HuwpNImQydSPqVbrUWUirJ6CAq5BdE5dqNG364FTIk?=
 =?us-ascii?Q?nLvUq4AbMMtiWuN1HFxNvCSZNfXTJGk7KtbHw3yiXLNQG4Ep2CeCaw+fBWx5?=
 =?us-ascii?Q?4XbWcW/9JlaYR+Uqp6lTq1diRLoe1zEkVTAX7l1oJbktkPKSzd6GnzInFnpF?=
 =?us-ascii?Q?3Lsr9xLr3Th/ToIU4/xYrQl9cYGZE/3BjoKjOG/5hFBjA8thBS+diPQH1sBN?=
 =?us-ascii?Q?SQ=3D=3D?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4d6b7d2c-f45e-4b30-0fee-08da79dce6be
X-MS-Exchange-CrossTenant-AuthSource: CH0PR11MB5348.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2022 07:58:10.0608
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: dP9WHtLTnoPv159ZLutuc+xEV9GidR8DOGwai5xt5feuk/VNE55zGwU3YonsACE2joM54bfk0scoq1nyJx+CHiuo9YiFPN2MBkcgbcA5n8Q=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB2044
X-Proofpoint-GUID: MyUqBHXSJRrQF9pRy3WK0D8G5ICyPNbj
X-Proofpoint-ORIG-GUID: MyUqBHXSJRrQF9pRy3WK0D8G5ICyPNbj
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-09_03,2022-08-09_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 clxscore=1011
 bulkscore=0 phishscore=0 priorityscore=1501 mlxlogscore=999 spamscore=0
 impostorscore=0 lowpriorityscore=0 suspectscore=0 mlxscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2208090036
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

without lock mtd_table_mutex in blktrans_{open, release}, there will
be a race condition when access devices /dev/mtd1 and /dev/mtdblock1
at the same time with a high frequency open and close test:

kernel BUG at drivers/mtd/mtdcore.c:1221!
lr : blktrans_release+0xb0/0x120
Call trace:
__put_mtd_device+0x4c/0x84
blktrans_release+0xb0/0x120
blkdev_put+0xd4/0x210
blkdev_close+0x34/0x50
__fput+0x8c/0x240
____fput+0x1c/0x30
task_work_run+0x98/00t_64_sync_handler+0xa4/0x130
el0t_64_sync+0x1a0/0x1a4

since the original purpose of commit 799ae31c58ae ("mtd_blkdevs:
don't hold del_mtd_blktrans_dev in blktrans_{open, release}") is
to fix a DEADLOCK issue, here convert mutex_lock to mutex_trylock
and return immediately if failed acquire mtd_table_mutex, then
both race condition and DEADLOCK can be avoided.

Fixes: 799ae31c58ae ("mtd_blkdevs: don't hold del_mtd_blktrans_dev in blktrans_{open, release}")
Signed-off-by: Liwei Song <liwei.song@windriver.com>
---
 drivers/mtd/mtd_blkdevs.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index b8ae1ec14e17..147e4a11dfe4 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -188,6 +188,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
 
 	kref_get(&dev->ref);
 
+	if (!mutex_trylock(&mtd_table_mutex))
+		return ret;
 	mutex_lock(&dev->lock);
 
 	if (dev->open)
@@ -212,6 +214,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
 unlock:
 	dev->open++;
 	mutex_unlock(&dev->lock);
+	mutex_unlock(&mtd_table_mutex);
 	return ret;
 
 error_release:
@@ -220,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
 error_put:
 	module_put(dev->tr->owner);
 	mutex_unlock(&dev->lock);
+	mutex_unlock(&mtd_table_mutex);
 	blktrans_dev_put(dev);
 	return ret;
 }
@@ -228,6 +232,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
 {
 	struct mtd_blktrans_dev *dev = disk->private_data;
 
+	if (!mutex_trylock(&mtd_table_mutex))
+		return;
 	mutex_lock(&dev->lock);
 
 	if (--dev->open)
@@ -242,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
 	}
 unlock:
 	mutex_unlock(&dev->lock);
+	mutex_unlock(&mtd_table_mutex);
 	blktrans_dev_put(dev);
 }
 
-- 
2.32.0