From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ye Bin <yebin10@huawei.com>,
"Rafael J . Wysocki" <rafael.j.wysocki@intel.com>,
Sasha Levin <sashal@kernel.org>,
rafael@kernel.org, pavel@ucw.cz, len.brown@intel.com,
linux-pm@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 30/39] PM: hibernate: Get block device exclusively in swsusp_check()
Date: Mon, 8 Nov 2021 20:06:40 -0500 [thread overview]
Message-ID: <20211109010649.1191041-30-sashal@kernel.org> (raw)
In-Reply-To: <20211109010649.1191041-1-sashal@kernel.org>
From: Ye Bin <yebin10@huawei.com>
[ Upstream commit 39fbef4b0f77f9c89c8f014749ca533643a37c9f ]
The following kernel crash can be triggered:
[ 89.266592] ------------[ cut here ]------------
[ 89.267427] kernel BUG at fs/buffer.c:3020!
[ 89.268264] invalid opcode: 0000 [#1] SMP KASAN PTI
[ 89.269116] CPU: 7 PID: 1750 Comm: kmmpd-loop0 Not tainted 5.10.0-862.14.0.6.x86_64-08610-gc932cda3cef4-dirty #20
[ 89.273169] RIP: 0010:submit_bh_wbc.isra.0+0x538/0x6d0
[ 89.277157] RSP: 0018:ffff888105ddfd08 EFLAGS: 00010246
[ 89.278093] RAX: 0000000000000005 RBX: ffff888124231498 RCX: ffffffffb2772612
[ 89.279332] RDX: 1ffff11024846293 RSI: 0000000000000008 RDI: ffff888124231498
[ 89.280591] RBP: ffff8881248cc000 R08: 0000000000000001 R09: ffffed1024846294
[ 89.281851] R10: ffff88812423149f R11: ffffed1024846293 R12: 0000000000003800
[ 89.283095] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8881161f7000
[ 89.284342] FS: 0000000000000000(0000) GS:ffff88839b5c0000(0000) knlGS:0000000000000000
[ 89.285711] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 89.286701] CR2: 00007f166ebc01a0 CR3: 0000000435c0e000 CR4: 00000000000006e0
[ 89.287919] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 89.289138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 89.290368] Call Trace:
[ 89.290842] write_mmp_block+0x2ca/0x510
[ 89.292218] kmmpd+0x433/0x9a0
[ 89.294902] kthread+0x2dd/0x3e0
[ 89.296268] ret_from_fork+0x22/0x30
[ 89.296906] Modules linked in:
by running the following commands:
1. mkfs.ext4 -O mmp /dev/sda -b 1024
2. mount /dev/sda /home/test
3. echo "/dev/sda" > /sys/power/resume
That happens because swsusp_check() calls set_blocksize() on the
target partition which confuses the file system:
Thread1 Thread2
mount /dev/sda /home/test
get s_mmp_bh --> has mapped flag
start kmmpd thread
echo "/dev/sda" > /sys/power/resume
resume_store
software_resume
swsusp_check
set_blocksize
truncate_inode_pages_range
truncate_cleanup_page
block_invalidatepage
discard_buffer --> clean mapped flag
write_mmp_block
submit_bh
submit_bh_wbc
BUG_ON(!buffer_mapped(bh))
To address this issue, modify swsusp_check() to open the target block
device with exclusive access.
Signed-off-by: Ye Bin <yebin10@huawei.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/power/swap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index d7cdc426ee380..2bd3670a093de 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -1526,9 +1526,10 @@ int swsusp_read(unsigned int *flags_p)
int swsusp_check(void)
{
int error;
+ void *holder;
hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device,
- FMODE_READ, NULL);
+ FMODE_READ | FMODE_EXCL, &holder);
if (!IS_ERR(hib_resume_bdev)) {
set_blocksize(hib_resume_bdev, PAGE_SIZE);
clear_page(swsusp_header);
@@ -1550,7 +1551,7 @@ int swsusp_check(void)
put:
if (error)
- blkdev_put(hib_resume_bdev, FMODE_READ);
+ blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL);
else
pr_debug("PM: Image signature found, resuming\n");
} else {
--
2.33.0
next prev parent reply other threads:[~2021-11-09 1:22 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-09 1:06 [PATCH AUTOSEL 4.14 01/39] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 02/39] Bluetooth: fix use-after-free error in lock_sock_nested() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 03/39] platform/x86: wmi: do not fail if disabling fails Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 04/39] MIPS: lantiq: dma: add small delay after reset Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 05/39] MIPS: lantiq: dma: reset correct number of channel Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 06/39] locking/lockdep: Avoid RCU-induced noinstr fail Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 07/39] smackfs: Fix use-after-free in netlbl_catmap_walk() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 08/39] NET: IPV4: fix error "do not initialise globals to 0" Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 09/39] x86: Increase exception stack sizes Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 10/39] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Sasha Levin
2021-11-09 18:06 ` Brian Norris
2021-11-14 14:03 ` Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 11/39] mwifiex: Properly initialize private structure on interface type changes Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 12/39] media: mt9p031: Fix corrupted frame after restarting stream Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 13/39] media: netup_unidvb: handle interrupt properly according to the firmware Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 14/39] media: uvcvideo: Set capability in s_param Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 15/39] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 16/39] media: s5p-mfc: Add checking to s5p_mfc_probe() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 17/39] media: mceusb: return without resubmitting URB in case of -EPROTO error Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 18/39] ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 19/39] ACPICA: Avoid evaluating methods too early during system resume Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 20/39] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 21/39] tracefs: Have tracefs directories not set OTH permission bits by default Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 22/39] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 23/39] ACPI: battery: Accept charges over the design capacity as full Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 24/39] leaking_addresses: Always print a trailing newline Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 25/39] memstick: r592: Fix a UAF bug when removing the driver Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 26/39] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 27/39] lib/xz: Validate the value before assigning it to an enum variable Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 28/39] tracing/cfi: Fix cmp_entries_* functions signature mismatch Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 29/39] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Sasha Levin
2021-11-09 1:06 ` Sasha Levin [this message]
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 31/39] iwlwifi: mvm: disable RX-diversity in powersave Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 32/39] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 33/39] ARM: clang: Do not rely on lr register for stacktrace Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 34/39] gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 35/39] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 36/39] spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 37/39] parisc: fix warning in flush_tlb_all Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 38/39] task_stack: Fix end_of_stack() for architectures with upwards-growing stack Sasha Levin
2021-11-09 1:06 ` [PATCH AUTOSEL 4.14 39/39] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211109010649.1191041-30-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=len.brown@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=pavel@ucw.cz \
--cc=rafael.j.wysocki@intel.com \
--cc=rafael@kernel.org \
--cc=stable@vger.kernel.org \
--cc=yebin10@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).