Received: by 2002:a05:6358:4e97:b0:b3:742d:4702 with SMTP id ce23csp2876628rwb; Mon, 15 Aug 2022 13:07:25 -0700 (PDT) X-Google-Smtp-Source: AA6agR7D43w5bIg3fHes9x89rqnpfftedpOweshhxutj8F43Q+mWPROuQ8t9CIzGbw9Mh+zHoMJS X-Received: by 2002:a17:902:f688:b0:16f:28:ea27 with SMTP id l8-20020a170902f68800b0016f0028ea27mr17955262plg.151.1660594044767; Mon, 15 Aug 2022 13:07:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1660594044; cv=none; d=google.com; s=arc-20160816; b=kL3JzgWMsLL3xi01yk/xEbCAlLpZDGfTBXy4NctgiKAnka2vFCxtQ6lXyYUs5FJ2f0 tZ6SDFtjCUs5iCSnPvIJSxIgVoIh9/WCGz4N6ksDYHSGj0zezuWSDmGFO3ou+GJjVh8w zOqf0HXOlJjdv7L+T1vx+1re8WGVC9jwMhPLPQY/3Es3DBgS7lC7fwwPRjhgQZBWOTw0 id1phl0oGexgoA8mVreRzZbrfSoONtblGj4KSuOAagJVLDSgoji2gOV3TLi5U6/a3dcn 7ePKzl+73GQqeF8lmCLU5Sxkm5FlzQlvs4jYm1wTb7p5cc7m+uPa0hDC/OxuMhZ8GGzP EOPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=EMHpR6mZJgMDvC5O98Q0UGIM9jumJKMytjuXacD6E+I=; b=vXxrzAP8TZ76Af7MSWmLI7QUPXtH8B5gC0/uHYCncHMBeXUl4xTVEYehpARB1lBvyu zaTJWCZeKxi/Q+J6sYzOMIiJjPEmr6OcW4+9OyBMAIZATGhrGZxBzTzJ52Ull7aki/zK 8h2paY76T5yQE1OxnchE6ny4NVr3G67DMjaNoBLb/8VMD2KemGKmDOSV1QFAOJIPCYID ZinwlgWf/57z0G17Z308dMM/DU3ceibrklCCCcqv0pcXlI3TOc8bJUD9Y3sv3OTbLzsZ DP07RrGnWbjUsywoYyZNws9WiK3PNtp+NlYTj1wcoc5dK7r5KReAgwVJM2yvyoQd6iSQ FuGw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=SRS5UzI1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ba2-20020a170902720200b0016c3d49b0e7si10901510plb.577.2022.08.15.13.07.13; Mon, 15 Aug 2022 13:07:24 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=SRS5UzI1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242788AbiHOSbk (ORCPT + 99 others); Mon, 15 Aug 2022 14:31:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242801AbiHOSa3 (ORCPT ); Mon, 15 Aug 2022 14:30:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7375F3207A; Mon, 15 Aug 2022 11:20:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3C2C46069E; Mon, 15 Aug 2022 18:20:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F8A3C433C1; Mon, 15 Aug 2022 18:20:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660587639; bh=duFYzGOIIixBva0Q9jgqi225EbafyGawSTxEWc9V+Ds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SRS5UzI1Fs5uMkq+9W+XEL5/8dmzRiGue6yT/SWPFXA2Vr023GWmZuFXnLm21+OCv oJMuEI2Lt0wcd6Zk9DZda137hYEk5pbMSqThTNk+aFI1tCACdd6uLdLk/YHyEbn5mS qLLbYybyh8h1r27pRDkTnzIWx9WuSXQFyMEC2roc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Tetsuo Handa , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 5.15 147/779] PM: hibernate: defer device probing when resuming from hibernation Date: Mon, 15 Aug 2022 19:56:31 +0200 Message-Id: <20220815180343.607408603@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180337.130757997@linuxfoundation.org> References: <20220815180337.130757997@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tetsuo Handa [ Upstream commit 8386c414e27caba8501119948e9551e52b527f59 ] syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0. When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed. There are three cases that can prevent probe_count from dropping to 0. (a) A device being probed stopped responding (i.e. broken/malicious hardware). (b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason. (c) New device probe requests keeps coming in before existing device probe requests complete. The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called from hub_event() work function is waiting for the processes which are blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()). Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface. Link: https://syzkaller.appspot.com/bug?extid=358c9ab4c93da7b7238c [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Tested-by: syzbot Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- kernel/power/user.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/power/user.c b/kernel/power/user.c index 740723bb3885..13cca2e2c2bc 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -26,6 +26,7 @@ #include "power.h" +static bool need_wait; static struct snapshot_data { struct snapshot_handle handle; @@ -78,7 +79,7 @@ static int snapshot_open(struct inode *inode, struct file *filp) * Resuming. We may need to wait for the image device to * appear. */ - wait_for_device_probe(); + need_wait = true; data->swap = -1; data->mode = O_WRONLY; @@ -168,6 +169,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, ssize_t res; loff_t pg_offp = *offp & ~PAGE_MASK; + if (need_wait) { + wait_for_device_probe(); + need_wait = false; + } + lock_system_sleep(); data = filp->private_data; @@ -244,6 +250,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, loff_t size; sector_t offset; + if (need_wait) { + wait_for_device_probe(); + need_wait = false; + } + if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC) return -ENOTTY; if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) -- 2.35.1