From patchwork Sun Dec 29 17:24:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 182562 Delivered-To: patch@linaro.org Received: by 2002:a92:815a:0:0:0:0:0 with SMTP id e87csp5462843ild; Sun, 29 Dec 2019 09:49:57 -0800 (PST) X-Google-Smtp-Source: APXvYqwjp9PpfJtOxxGAUpMlx6XeiVuw3x8mtcBniGt+rEYyixuNjHdN6Sb6E2JuFFzDWjWt1j0R X-Received: by 2002:a9d:4d8d:: with SMTP id u13mr67398366otk.299.1577641797239; Sun, 29 Dec 2019 09:49:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1577641797; cv=none; d=google.com; s=arc-20160816; b=J64R1dMvYlChJeaUUn8+9nwghKkEehOU0e9zEz6qTYPAfp4EkPlvCJzyM91BDMpUFF zGU8saMiTz7kc927JFcHnJQRXLiSFDBtHSx+SEK7lqiUP/jjTSuKXnCI8eFoiMlcnrh8 63Rw245JAyI6aFioIiMup0mhygUnm8mA/nSHAFCk2pdtEy7CNiwZqIAxDt9Gycfnr4gq IJ52g7Ub1Om5n8n0RUjhbjLKA9q58PKUsSMfNVAz1jQQytlGyLyKBsue2gwPLKaSt4Gu u4tNXPWWZxo5o2c7vMdquhh22kUU9mH+XouRkKlLkMl4se72EYUxrjcE9Faws4wQZ7VH 9z1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=W/FD4QHyrj08EY+3jJpJO/OyNmHVm39PxpB0zUb1m1Q=; b=YwIkFa9Xref24vh/SIGG5HSRBCz9lNfGCkDOKE1B3TbNLi5b/lk7ojj8gWcPV4eztK G7CfbHuxe/gbsY+Xs2jPT9jvpaql8ebEy543YpcscO6Xe5wdDJoi5T0aX5PF7YiYP8yx 0pJxDtcZgZfa/A0DdRjI9rzw9lVPllih3Rz2JqlT16iqC/u0vZOQ8tKg+y2nXZpVqjgE 0u9liyXEEU36ELb44cFQsFrUT106GqOHRJUEMAuqP5Wz7ZmC4gJAQHgbcS8DBGWTQkK6 oSyJHgSFM9/eL3N4zMWKd//h3jkR8hEmROtpO1jTjKdQ3NtrujXA74b9AYEcxPMXnh5M HV5Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=J6mKdtNS; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x137si19515183oif.42.2019.12.29.09.49.57; Sun, 29 Dec 2019 09:49:57 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=J6mKdtNS; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731777AbfL2Rtz (ORCPT + 27 others); Sun, 29 Dec 2019 12:49:55 -0500 Received: from mail.kernel.org ([198.145.29.99]:33900 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731761AbfL2Rtx (ORCPT ); Sun, 29 Dec 2019 12:49:53 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D263320718; Sun, 29 Dec 2019 17:49:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1577641792; bh=cvAEJuiJThNbmw/zdeNsOBj3VDFRwX3r00EqoPreu/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J6mKdtNSfXItyyIsVjbVvjsWnYN8t43LzhSJz+0OTGt2K5HB8hANUU0N1B+v+KSEO gUdY1dfZQFuFS8rEXHPafU7+T64TTLYW/ebF0eO2Fgvn34ySL9EXvcmR9lUYev1PxL 5tKpPP0TWuKShosTsu/VvSZQTV5JLD4t5VOVRMN4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Jens Axboe , Sasha Levin Subject: [PATCH 5.4 213/434] libata: Ensure ata_port probe has completed before detach Date: Sun, 29 Dec 2019 18:24:26 +0100 Message-Id: <20191229172715.977210635@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191229172702.393141737@linuxfoundation.org> References: <20191229172702.393141737@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: John Garry [ Upstream commit 130f4caf145c3562108b245a576db30b916199d2 ] With CONFIG_DEBUG_TEST_DRIVER_REMOVE set, we may find the following WARN: [ 23.452574] ------------[ cut here ]------------ [ 23.457190] WARNING: CPU: 59 PID: 1 at drivers/ata/libata-core.c:6676 ata_host_detach+0x15c/0x168 [ 23.466047] Modules linked in: [ 23.469092] CPU: 59 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc1-00010-g5b83fd27752b-dirty #296 [ 23.477776] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019 [ 23.486286] pstate: a0c00009 (NzCv daif +PAN +UAO) [ 23.491065] pc : ata_host_detach+0x15c/0x168 [ 23.495322] lr : ata_host_detach+0x88/0x168 [ 23.499491] sp : ffff800011cabb50 [ 23.502792] x29: ffff800011cabb50 x28: 0000000000000007 [ 23.508091] x27: ffff80001137f068 x26: ffff8000112c0c28 [ 23.513390] x25: 0000000000003848 x24: ffff0023ea185300 [ 23.518689] x23: 0000000000000001 x22: 00000000000014c0 [ 23.523987] x21: 0000000000013740 x20: ffff0023bdc20000 [ 23.529286] x19: 0000000000000000 x18: 0000000000000004 [ 23.534584] x17: 0000000000000001 x16: 00000000000000f0 [ 23.539883] x15: ffff0023eac13790 x14: ffff0023eb76c408 [ 23.545181] x13: 0000000000000000 x12: ffff0023eac13790 [ 23.550480] x11: ffff0023eb76c228 x10: 0000000000000000 [ 23.555779] x9 : ffff0023eac13798 x8 : 0000000040000000 [ 23.561077] x7 : 0000000000000002 x6 : 0000000000000001 [ 23.566376] x5 : 0000000000000002 x4 : 0000000000000000 [ 23.571674] x3 : ffff0023bf08a0bc x2 : 0000000000000000 [ 23.576972] x1 : 3099674201f72700 x0 : 0000000000400284 [ 23.582272] Call trace: [ 23.584706] ata_host_detach+0x15c/0x168 [ 23.588616] ata_pci_remove_one+0x10/0x18 [ 23.592615] ahci_remove_one+0x20/0x40 [ 23.596356] pci_device_remove+0x3c/0xe0 [ 23.600267] really_probe+0xdc/0x3e0 [ 23.603830] driver_probe_device+0x58/0x100 [ 23.608000] device_driver_attach+0x6c/0x90 [ 23.612169] __driver_attach+0x84/0xc8 [ 23.615908] bus_for_each_dev+0x74/0xc8 [ 23.619730] driver_attach+0x20/0x28 [ 23.623292] bus_add_driver+0x148/0x1f0 [ 23.627115] driver_register+0x60/0x110 [ 23.630938] __pci_register_driver+0x40/0x48 [ 23.635199] ahci_pci_driver_init+0x20/0x28 [ 23.639372] do_one_initcall+0x5c/0x1b0 [ 23.643199] kernel_init_freeable+0x1a4/0x24c [ 23.647546] kernel_init+0x10/0x108 [ 23.651023] ret_from_fork+0x10/0x18 [ 23.654590] ---[ end trace 634a14b675b71c13 ]--- With KASAN also enabled, we may also get many use-after-free reports. The issue is that when CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, we may attempt to detach the ata_port before it has been probed. This is because the ata_ports are async probed, meaning that there is no guarantee that the ata_port has probed prior to detach. When the ata_port does probe in this scenario, we get all sorts of issues as the detach may have already happened. Fix by ensuring synchronisation with async_synchronize_full(). We could alternatively use the cookie returned from the ata_port probe async_schedule() call, but that means managing the cookie, so more complicated. Signed-off-by: John Garry Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.20.1 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 28c492be0a57..74c9b3032d46 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -6708,6 +6708,9 @@ void ata_host_detach(struct ata_host *host) { int i; + /* Ensure ata_port probe has completed */ + async_synchronize_full(); + for (i = 0; i < host->n_ports; i++) ata_port_detach(host->ports[i]);