lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 781/917] scsi: ufs: core: Fix NULL pointer dereference
    Date
    From: Bean Huo <beanhuo@micron.com>

    [ Upstream commit 1da3b0141e74c18c2377d4c2655406a90a87742f ]

    Calling ufshcd_rpm_{get/put}_sync() prior to ufshcd_scsi_add_wlus() being
    called will trigger a NULL pointer dereference. This is because
    hba->sdev_ufs_device is initialized in ufshcd_scsi_add_wlus().

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000348
    Mem abort info:
    ESR = 0x96000004
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x04: level 0 translation fault
    Data abort info:
    ISV = 0, ISS = 0x00000004
    CM = 0, WnR = 0
    [0000000000000348] user address but active_mm is swapper
    Internal error: Oops: 96000004 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 0 PID: 91 Comm: kworker/u16:1 Not tainted 5.15.0-rc1-beanhuo-linaro-1423
    Hardware name: MicronRB (DT)
    Workqueue: events_unbound async_run_entry_fn
    pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : pm_runtime_drop_link+0x128/0x338
    lr : ufshpb_get_dev_info+0x8c/0x148
    sp : ffff800012573c10
    x29: ffff800012573c10 x28: 0000000000000000 x27: 0000000000000003
    x26: ffff000001d21298 x25: 000000005abcea60 x24: ffff800011d89000
    x23: 0000000000000001 x22: ffff000001d21880 x21: ffff000001ec9300
    x20: 0000000000000004 x19: 0000000000000198 x18: ffffffffffffffff
    x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000041400
    x14: 5eee00201100200a x13: 000000000000bb03 x12: 0000000000000000
    x11: 0000000000000100 x10: 0200000000000000 x9 : bb0000021a162c01
    x8 : 0302010021021003 x7 : 0000000000000000 x6 : ffff800012573af0
    x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000200
    x2 : 0000000000000348 x1 : 0000000000000348 x0 : ffff80001095308c
    Call trace:
    pm_runtime_drop_link+0x128/0x338
    ufshpb_get_dev_info+0x8c/0x148
    ufshcd_probe_hba+0xda0/0x11b8
    ufshcd_async_scan+0x34/0x330
    async_run_entry_fn+0x38/0x180
    process_one_work+0x1f4/0x498
    worker_thread+0x48/0x480
    kthread+0x140/0x158
    ret_from_fork+0x10/0x20
    Code: 88027c01 35ffffa2 17fff6c4 f9800051 (885f7c40)
    ---[ end trace 2ba541335f595c95 ]

    ufshpb_get_dev_info() is only called during asynchronous scanning and at
    that time pm_runtime_get_sync() has been called:

    ...
    /* Hold auto suspend until async scan completes */
    pm_runtime_get_sync(dev);
    atomic_set(&hba->scsi_block_reqs_cnt, 0);
    ...
    ufshcd_async_scan()
    ufshcd_probe_hba(hba, true);
    ufshcd_device_params_init(hba);
    ufshpb_get_dev_info();
    ...
    pm_runtime_put_sync(hba->dev);

    Remove ufshcd_rpm_{get/put}_sync() from ufshpb_get_dev_info() to fix this
    problem.

    Link: https://lore.kernel.org/r/20210929200640.828611-2-huobean@gmail.com
    Fixes: 351b3a849ac7 ("scsi: ufs: ufshpb: Use proper power management API")
    Signed-off-by: Bean Huo <beanhuo@micron.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/ufs/ufshpb.c | 3 ---
    1 file changed, 3 deletions(-)

    diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c
    index 46cdfb0dfca94..3b1a90b1d82ac 100644
    --- a/drivers/scsi/ufs/ufshpb.c
    +++ b/drivers/scsi/ufs/ufshpb.c
    @@ -2598,11 +2598,8 @@ void ufshpb_get_dev_info(struct ufs_hba *hba, u8 *desc_buf)
    if (version == HPB_SUPPORT_LEGACY_VERSION)
    hpb_dev_info->is_legacy = true;

    - ufshcd_rpm_get_sync(hba);
    ret = ufshcd_query_attr_retry(hba, UPIU_QUERY_OPCODE_READ_ATTR,
    QUERY_ATTR_IDN_MAX_HPB_SINGLE_CMD, 0, 0, &max_hpb_single_cmd);
    - ufshcd_rpm_put_sync(hba);
    -
    if (ret)
    dev_err(hba->dev, "%s: idn: read max size of single hpb cmd query request failed",
    __func__);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 01:10    [W:4.099 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site