From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>,
Stefan Wahren <stefan.wahren@i2se.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
nsaenz@kernel.org, gascoar@gmail.com, ojaswin98@gmail.com,
bcm-kernel-feedback-list@broadcom.com,
linux-rpi-kernel@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-staging@lists.linux.dev
Subject: [PATCH AUTOSEL 5.16 04/34] staging: vc04_services: Fix RCU dereference check
Date: Tue, 15 Feb 2022 10:26:27 -0500 [thread overview]
Message-ID: <20220215152657.580200-4-sashal@kernel.org> (raw)
In-Reply-To: <20220215152657.580200-1-sashal@kernel.org>
From: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
[ Upstream commit 0cea730cac824edf78ffd3302938ed5fe2b9d50d ]
In service_callback path RCU dereferenced pointer struct vchiq_service
need to be accessed inside rcu read-critical section.
Also userdata/user_service part of vchiq_service is accessed around
different synchronization mechanism, getting an extra reference to a
pointer keeps sematics simpler and avoids prolonged graceperiod.
Accessing vchiq_service with rcu_read_[lock/unlock] fixes below issue.
[ 32.201659] =============================
[ 32.201664] WARNING: suspicious RCU usage
[ 32.201670] 5.15.11-rt24-v8+ #3 Not tainted
[ 32.201680] -----------------------------
[ 32.201685] drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h:529 suspicious rcu_dereference_check() usage!
[ 32.201695]
[ 32.201695] other info that might help us debug this:
[ 32.201695]
[ 32.201700]
[ 32.201700] rcu_scheduler_active = 2, debug_locks = 1
[ 32.201708] no locks held by vchiq-slot/0/98.
[ 32.201715]
[ 32.201715] stack backtrace:
[ 32.201723] CPU: 1 PID: 98 Comm: vchiq-slot/0 Not tainted 5.15.11-rt24-v8+ #3
[ 32.201733] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)
[ 32.201739] Call trace:
[ 32.201742] dump_backtrace+0x0/0x1b8
[ 32.201772] show_stack+0x20/0x30
[ 32.201784] dump_stack_lvl+0x8c/0xb8
[ 32.201799] dump_stack+0x18/0x34
[ 32.201808] lockdep_rcu_suspicious+0xe4/0xf8
[ 32.201817] service_callback+0x124/0x400
[ 32.201830] slot_handler_func+0xf60/0x1e20
[ 32.201839] kthread+0x19c/0x1a8
[ 32.201849] ret_from_fork+0x10/0x20
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Padmanabha Srinivasaiah <treasure4paddy@gmail.com>
Link: https://lore.kernel.org/r/20211231195406.5479-1-treasure4paddy@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../interface/vchiq_arm/vchiq_arm.c | 20 +++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index c650a32bcedff..b9505bb51f45c 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1058,15 +1058,27 @@ service_callback(enum vchiq_reason reason, struct vchiq_header *header,
DEBUG_TRACE(SERVICE_CALLBACK_LINE);
+ rcu_read_lock();
service = handle_to_service(handle);
- if (WARN_ON(!service))
+ if (WARN_ON(!service)) {
+ rcu_read_unlock();
return VCHIQ_SUCCESS;
+ }
user_service = (struct user_service *)service->base.userdata;
instance = user_service->instance;
- if (!instance || instance->closing)
+ if (!instance || instance->closing) {
+ rcu_read_unlock();
return VCHIQ_SUCCESS;
+ }
+
+ /*
+ * As hopping around different synchronization mechanism,
+ * taking an extra reference results in simpler implementation.
+ */
+ vchiq_service_get(service);
+ rcu_read_unlock();
vchiq_log_trace(vchiq_arm_log_level,
"%s - service %lx(%d,%p), reason %d, header %lx, instance %lx, bulk_userdata %lx",
@@ -1097,6 +1109,7 @@ service_callback(enum vchiq_reason reason, struct vchiq_header *header,
bulk_userdata);
if (status != VCHIQ_SUCCESS) {
DEBUG_TRACE(SERVICE_CALLBACK_LINE);
+ vchiq_service_put(service);
return status;
}
}
@@ -1105,10 +1118,12 @@ service_callback(enum vchiq_reason reason, struct vchiq_header *header,
if (wait_for_completion_interruptible(&user_service->remove_event)) {
vchiq_log_info(vchiq_arm_log_level, "%s interrupted", __func__);
DEBUG_TRACE(SERVICE_CALLBACK_LINE);
+ vchiq_service_put(service);
return VCHIQ_RETRY;
} else if (instance->closing) {
vchiq_log_info(vchiq_arm_log_level, "%s closing", __func__);
DEBUG_TRACE(SERVICE_CALLBACK_LINE);
+ vchiq_service_put(service);
return VCHIQ_ERROR;
}
DEBUG_TRACE(SERVICE_CALLBACK_LINE);
@@ -1137,6 +1152,7 @@ service_callback(enum vchiq_reason reason, struct vchiq_header *header,
header = NULL;
}
DEBUG_TRACE(SERVICE_CALLBACK_LINE);
+ vchiq_service_put(service);
if (skip_completion)
return VCHIQ_SUCCESS;
--
2.34.1
next prev parent reply other threads:[~2022-02-15 15:27 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-15 15:26 [PATCH AUTOSEL 5.16 01/34] ARM: OMAP2+: hwmod: Add of_node_put() before break Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 02/34] ARM: OMAP2+: adjust the location of put_device() call in omapdss_init_of Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 03/34] phy: usb: Leave some clocks running during suspend Sasha Levin
2022-02-15 15:26 ` Sasha Levin [this message]
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 05/34] phy: phy-mtk-tphy: Fix duplicated argument in phy-mtk-tphy Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 06/34] usb: usb251xb: add boost-up property support Sasha Levin
2022-02-15 16:21 ` Greg Kroah-Hartman
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 07/34] irqchip/sifive-plic: Add missing thead,c900-plic match string Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 08/34] x86/bug: Merge annotate_reachable() into _BUG_FLAGS() asm Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 09/34] netfilter: conntrack: don't refresh sctp entries in closed state Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 10/34] ksmbd: fix same UniqueId for dot and dotdot entries Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 11/34] ksmbd: don't align last entry offset in smb2 query directory Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 12/34] arm64: dts: meson-gx: add ATF BL32 reserved-memory region Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 13/34] arm64: dts: meson-g12: " Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 14/34] arm64: dts: meson-g12: drop BL32 region from SEI510/SEI610 Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 15/34] pidfd: fix test failure due to stack overflow on some arches Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 16/34] selftests: fixup build warnings in pidfd / clone3 tests Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 17/34] mm: io_uring: allow oom-killer from io_uring_setup Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 18/34] ACPI: PM: Revert "Only mark EC GPE for wakeup on Intel systems" Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 19/34] kconfig: let 'shell' return enough output for deep path names Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 20/34] scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 21/34] scsi: lpfc: Reduce log messages seen after firmware download Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 22/34] ata: libata-core: Disable TRIM on M88V29 Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 23/34] soc: aspeed: lpc-ctrl: Block error printing on probe defer cases Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 24/34] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 25/34] drm/rockchip: dw_hdmi: Do not leave clock enabled in error case Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 26/34] tracing: Fix tp_printk option related with tp_printk_stop_on_boot Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 27/34] NFSD: Fix offset type in I/O trace points Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 28/34] display/amd: decrease message verbosity about watermarks table failure Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 29/34] drm/amdgpu: add utcl2_harvest to gc 10.3.1 Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 30/34] drm/amd/display: Cap pflip irqs per max otg number Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 31/34] drm/amd/display: fix yellow carp wm clamping Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 32/34] net: usb: qmi_wwan: Add support for Dell DW5829e Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 33/34] net: macb: Align the dma and coherent dma masks Sasha Levin
2022-02-15 15:26 ` [PATCH AUTOSEL 5.16 34/34] kconfig: fix failing to generate auto.conf Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220215152657.580200-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=gascoar@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rpi-kernel@lists.infradead.org \
--cc=linux-staging@lists.linux.dev \
--cc=nsaenz@kernel.org \
--cc=ojaswin98@gmail.com \
--cc=stable@vger.kernel.org \
--cc=stefan.wahren@i2se.com \
--cc=treasure4paddy@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).