From patchwork Tue Dec 1 06:45:46 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ken Xue X-Patchwork-Id: 7733781 Return-Path: X-Original-To: patchwork-linux-scsi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 6EBD59F1C2 for ; Tue, 1 Dec 2015 08:25:56 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 642292068A for ; Tue, 1 Dec 2015 08:25:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EF3A320687 for ; Tue, 1 Dec 2015 08:25:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755120AbbLAIZx (ORCPT ); Tue, 1 Dec 2015 03:25:53 -0500 Received: from mail-by2on0077.outbound.protection.outlook.com ([207.46.100.77]:59472 "EHLO na01-by2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751088AbbLAIZw (ORCPT ); Tue, 1 Dec 2015 03:25:52 -0500 Received: from DM3PR12CA0018.namprd12.prod.outlook.com (10.164.12.156) by CY1PR12MB0853.namprd12.prod.outlook.com (10.164.70.11) with Microsoft SMTP Server (TLS) id 15.1.331.20; Tue, 1 Dec 2015 06:51:17 +0000 Received: from DM3NAM03FT029.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e49::207) by DM3PR12CA0018.outlook.office365.com (2a01:111:e400:599f::28) with Microsoft SMTP Server (TLS) id 15.1.331.20 via Frontend Transport; Tue, 1 Dec 2015 06:51:18 +0000 Authentication-Results: spf=none (sender IP is 165.204.84.221) smtp.mailfrom=amd.com; canonical.com; dkim=none (message not signed) header.d=none; canonical.com; dmarc=permerror action=none header.from=amd.com; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) Received: from atltwp01.amd.com (165.204.84.221) by DM3NAM03FT029.mail.protection.outlook.com (10.152.82.194) with Microsoft SMTP Server id 15.1.346.13 via Frontend Transport; Tue, 1 Dec 2015 06:51:17 +0000 X-WSS-ID: 0NYO31G-07-0ZC-02 X-M-MSG: Received: from satlvexedge02.amd.com (satlvexedge02.amd.com [10.177.96.29]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by atltwp01.amd.com (Axway MailGate 5.3.1) with ESMTPS id 22ACC12C01D9; Tue, 1 Dec 2015 01:51:16 -0500 (EST) Received: from SATLEXCHOV01.amd.com (10.181.40.71) by SATLVEXEDGE02.amd.com (10.177.96.29) with Microsoft SMTP Server (TLS) id 14.3.195.1; Tue, 1 Dec 2015 00:51:30 -0600 Received: from SCYBEXDAG04.amd.com (10.34.11.14) by SATLEXCHOV01.amd.com (10.181.40.71) with Microsoft SMTP Server (TLS) id 14.3.266.1; Tue, 1 Dec 2015 00:51:16 -0600 Received: from [10.237.74.14] (10.237.74.14) by SCYBEXDAG04.amd.com (10.34.11.14) with Microsoft SMTP Server id 14.3.266.1; Tue, 1 Dec 2015 14:51:11 +0800 Message-ID: <1448952346.3603.18.camel@kxue-X58A-UD3R> Subject: [PATCH 2/2] SCSI: Fix NULL pointer dereference in runtime PM From: Ken Xue To: , , , CC: , , , , , Date: Tue, 1 Dec 2015 14:45:46 +0800 X-Mailer: Evolution 3.10.4-0ubuntu2 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:165.204.84.221; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10009020)(6009001)(2980300002)(428002)(209900001)(189002)(23433003)(199003)(586003)(50226001)(47776003)(23676002)(5008740100001)(19580395003)(92566002)(33646002)(50466002)(1220700001)(5820100001)(230700001)(1096002)(77096005)(50986999)(19580405001)(101416001)(2201001)(15395725005)(103116003)(15975445007)(5001770100001)(86362001)(106466001)(33716001)(229853001)(87936001)(189998001)(105586002)(97736004)(99106002)(3940600001)(6606295002); DIR:OUT; SFP:1101; SCL:1; SRVR:CY1PR12MB0853; H:atltwp01.amd.com; FPR:; SPF:None; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0853; 2:EQ2aI5VOdzPJ8Cladef/lXJh6uftfOhPOT9V0UpzngzF/OMl1XxfVeF4nDnrTPSDNiyrwOKiDHoUEjlvj7LgYzortVT18JVY6a/S+C5eFJhRuvPlAKfkX7AW8fiSxuuWb3Zl6VI852CUN/5tJOCYFg==; 3:jBqfLM1D8ppTM2ci0F9BisXJdP7cuD9tebDWKvSlEXRjOgDhIR+tUrqoNdX25eBDiHat6ybwWkJ+j4LYxWmnLcqjPM6m/M+cCN6PLBRDBXgZ6wzar0fMHU+QFvOOrDnBK8XEjUNCXcQqa5S3MXGU1OPiCg7z0MClz5UeHRTTGOErOIkkkfdAvGG9dCYPEcG/lzt6rzqzBo1ygsnnkoE85dKQMF262RsSaTBBwZYYpx8=; 25:HaAnYnD2D9eZT8ICS03cCNCv9NOfhnrbUqikul/2EL+r9/POeO829chYnHlrRdQ80yH/r5Og7oKyzVP55H+xgulQFGLd1neopltYXzxfslCD/xu3SzyxvKQ/JVdXhk+qAVjQlw95gMvCRFvowBMv05rjOnr5k3N+3Fb9/svbTHXFcbKaVMxPu8wsSAwpLHxgQxBzBaedr9czFfMyWD9YvcnOO0ebJgoTMquCkxIvCm3pSrg1jERuQlEN8Gb4JX09cIyR9T5NgWnMiKbb+zpefA== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY1PR12MB0853; X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0853; 20:SKrVgmHD/X9xkBYtQmw4SWNzYK2WGatOb3vBLPhXoJJfqUYKLIMdKeWPTeQv6AEV2cRGhA8hwzUrFVQI+C4vg7EV6sHBOpGhCP32Dvhm2gNeo9B6y39KiTUS1M0Ew5IJsJXWhGAoCPFRQ955WqQtb5PTheAqX1fD0DSqzkfvXLyudNliqPrA08di9pG/6rtfP0taxCkStqVtconnBAYQngGw4T9nkFypkbJeG78oJuv62KnFj9MBMZWumPDgE3aKaKSvvpeQBpax5NTCVmx35ubGwiufraCEqsXe93PJQXbDorJwm0Gg/xrdZk7Pk6zu9mUT3FgO32kkgfsHY92sp4QqLSiM8QvcOywF6+Zvj99Cr8ShicVtevV+1TnfoaSEumgmYIYwdO9NT6A5FwofDE/dNUk6bozN6YyTAf4um/sr280hbgIhEKHGrXB2XqApXL9qXy0JuLlA9q8P0ahHwbR3uDRUAqLGyOhIkxVSunfPH4F/3ljFYwh+2/VKWjKF X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(35762410373642)(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(2401047)(520078)(8121501046)(5005006)(10201501046)(3002001); SRVR:CY1PR12MB0853; BCL:0; PCL:0; RULEID:; SRVR:CY1PR12MB0853; X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0853; 4:r5kgHxUPAe36hGcHrLOgLSOiuIaa7TG2CBJIWWwdvUxbRFC9j0lhaV20wrEGaP97cYvMTGyf2G5SS8Dtdgf72F7Z9FRdusrEnJ/qszjsRlGg3B/2xPq3gulCOQp8K1NtA2cJ7VtpizDv5CJrFeK/PsUK5RNRETS8i1ikPJBF4U15LtAlPU1KcxV9AigEmmQgIFyw3vJdOXrTomHhulcNXZJTS3h1AM8np6gjL+sIByNYCl6HNOpma2F89gI1xhPigkx/BzVUuh8B/RTFmaBoaGq9ysWI/1rxDBotOsQmzWCFW/cIpg9FCdlJg/6xD6H2sdyqwB86N7LfqcOS+jTNRrxbY2ePdN1bpvouBLhFFyPSiXiMW6GT6WCMeL7t628HaZngEjaInm/mjdV7Dyp8WFHK/YezmsajuQD1ObEwixAOd2Dj860DCNNEiYHtGnvKZKQG+Q0pBCh+gMwON8AGDg== X-Forefront-PRVS: 07778E4001 X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTFQUjEyTUIwODUzOzIzOmpYQ2JpMlFTRzB0K1hjMUpPamF5TFlmSGhl?= =?utf-8?B?SndXOUFDVjZTQVJwU1Z5U29EUkM1clV5dTVYUkswc2x1aHdrUERIUDdGVTlH?= =?utf-8?B?anlMczBLbmR1eEFaSnNhYTB1MUpjb3VnOTNLV3FRUVN2cnRHRnJGRnM2SHhw?= =?utf-8?B?d2IvMm5LTXJzUUJtVGovbTBRSDZ2ZVRydWhtQWVNQkllSlVmRmo5a1R5ZVNV?= =?utf-8?B?eU0yS25IUUE0T2RtVTlieXNTMXYxWnBUdEJwNEJreDdnYzBVQk9wY2ZmYjBs?= =?utf-8?B?ekpRbjNZdzk2Q3REVHJMcGdsMzROYTJaVXMxL0Q2emp5eTQveTFMaHJta3Mr?= =?utf-8?B?OGpqR2lWNGdsbGNNRUIvWUV3SzBBS1FPZEswNEpKZmJISjdjWG51U0lOeEg0?= =?utf-8?B?NzhNM0E0T21laWowY0xENmF0UEpOZk0zaHBLMEs4YTQyZjFraU1KVUVJOVFC?= =?utf-8?B?VzZpOCszcjBQSnlZWDJYMHpxOUpGYkdoZEZvSkpOSU5qbTJ3bncxRFdRaW1Y?= =?utf-8?B?ZElkV2krQkNuOFdSaFNlUnpibE5malNXUVZEOEZJUTI2aWpuYVYzc01VcTZj?= =?utf-8?B?MlA0amVJQW4rWXA2T2pwdHpFUXBGVUhteUVPdFlVRlhmK0N2eWEvNEVnWEVm?= =?utf-8?B?YXp2UlJ2NWpaS3dFYVlpN2M1MndybjFpUE8rOWtzV3BNa1ErSnJQMjZ5eko4?= =?utf-8?B?MXpXd25hNHY5ZWtQd29wV2FSVG1lMm5WeUpLS1hlYUlTY0VrMVJYU3ArOEMr?= =?utf-8?B?aWFES3hHZ2p1enJ4MEN2ZktEMG5HOUIvbTB0Q1Y1QUZNSDBxQ0lkc2hjNWsy?= =?utf-8?B?QnEvL0c2b0Y3cEZrVHpic1o4aWVQWEFLZGx3YVV4dlNaNFlPY1ptd1RndVBD?= =?utf-8?B?eDk4QzdiV0tzK1IvKzZFZjhMbGNvclpNVXR4ejRYVWVPUytUUitzSWZ1N043?= =?utf-8?B?d1lCakdXNVgzbEkyb05QaVdCZFQveE1TWDA1cExTYTQwd0V3OC9MR3lzS3l4?= =?utf-8?B?UDJsd2VINXRFcHZRL3d0YVRBOTBZNHZEb0pxUU5ubnkzdmd0NzFZd0FKQTJE?= =?utf-8?B?dmVSSmtWdnEyMGphQW95TlJQeWk1amsrWEVoSVNKeEM5MWJYQ0Y2WkJHTnRh?= =?utf-8?B?dkFTaWgwcDJhT1cxUmJNR0RQSk1kcHZST1BaQXFKV3pIMC94WENvcUtCeFRi?= =?utf-8?B?M1p6WE95V2xYVEVHNCtkRzVlMVhlY21aa1lIcEhjb3VHZjRZd3JETG0vNGkz?= =?utf-8?B?a3dVcUxNK2w0MzdVdHZCbjNmbFl3RzFqcVRvVEExYnQ0a0tlMitWVFZJTXRN?= =?utf-8?B?S3VrQk9RblJnT1graHpWc0Q4dXNYYTlwM01QWEQ1YmFKRjI1VjZjbm5uTWty?= =?utf-8?B?ZU85b21iODRkQkRsYWloNVVaYllkK2ZhUjdIMXh3c2lzNUo4OTgyZTZLbldW?= =?utf-8?Q?d9tNLYD4SzNr7O19+vHmIsHYSMC?= X-Microsoft-Exchange-Diagnostics: 1; CY1PR12MB0853; 5:+ddhaBjB95vk2ZM+wiKxL32Xd1YxG4GZ3LvEfBYG7Nt+ukSy2Ck+mGt3JuiPACNPpSYnJJ/UJX3gsF99k7YU4imBMg19vYGqTRiOoqb4oqaYCccCrHVF/RohhrH1WnIlnQSAQcyUgEYERAj+dsyylQ==; 24:EVjQsBjsPhI4FH/WOh+jcL7ggdUisQ+nFCDNVyHJR1xpEd31eUhJZpfayk6mc7htyOsw6rVXP66bmjIy/lpYWZgaGtJxizdOVvufh6EMzuU=; 20:uOxw1d8FK6HRASClYCaCneUNO4hQZ1b5RPUBTrzpOeMnGQijWIQlmZmvDOzfQmGp3fi6RadeQCFUyD3ZCqxz74a5liWYYPMd6zmzOMQKcVQkq1+JDFjg6FiHF4Cx8T4PYJBt8TO/jVQu61ZACT/Cu56et4WiIzO3eQ3OmMHWdIY65IVyMSOUsY6PoOuqATvjKRrGsZp++JZK6M3F02iBzF8lGUvPTsBrcpWz0qVWpR8aSOYl369rMecZt4bG7gj8 SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Dec 2015 06:51:17.1491 (UTC) X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.221]; Helo=[atltwp01.amd.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR12MB0853 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The routines in scsi_pm.c assume that if a runtime-PM callback is invoked for a SCSI device, it can only mean that the device's driver has asked the block layer to handle the runtime power management (by calling blk_pm_runtime_init(), which among other things sets q->dev). However, this assumption turns out to be wrong for things like the ses driver. Normally ses devices are not allowed to do runtime PM, but userspace can override this setting. If this happens, the kernel gets a NULL pointer dereference when blk_post_runtime_resume() tries to use the uninitialized q->dev pointer. This patch fixes the problem by checking q->dev in block layer before handle runtime PM. Since ses doesn't define any PM callbacks and call blk_pm_runtime_init(), the crash won't occur. This fixes Bugzilla #101371. https://bugzilla.kernel.org/show_bug.cgi?id=101371 More discussion can be found from below link. http://marc.info/?l=linux-scsi&m=144163730531875&w=2 Signed-off-by: Ken Xue Acked-by: Alan Stern Cc: Xiangliang Yu Cc: James E.J. Bottomley Cc: Jens Axboe Cc: Michael Terry Cc: stable@vger.kernel.org --- block/blk-core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/block/blk-core.c b/block/blk-core.c index 60912e9..a07ab18 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -3280,6 +3280,9 @@ int blk_pre_runtime_suspend(struct request_queue *q) { int ret = 0; + if (!q->dev) + return ret; + spin_lock_irq(q->queue_lock); if (q->nr_pending) { ret = -EBUSY; @@ -3307,6 +3310,9 @@ EXPORT_SYMBOL(blk_pre_runtime_suspend); */ void blk_post_runtime_suspend(struct request_queue *q, int err) { + if (!q->dev) + return; + spin_lock_irq(q->queue_lock); if (!err) { q->rpm_status = RPM_SUSPENDED; @@ -3331,6 +3337,9 @@ EXPORT_SYMBOL(blk_post_runtime_suspend); */ void blk_pre_runtime_resume(struct request_queue *q) { + if (!q->dev) + return; + spin_lock_irq(q->queue_lock); q->rpm_status = RPM_RESUMING; spin_unlock_irq(q->queue_lock); @@ -3353,6 +3362,9 @@ EXPORT_SYMBOL(blk_pre_runtime_resume); */ void blk_post_runtime_resume(struct request_queue *q, int err) { + if (!q->dev) + return; + spin_lock_irq(q->queue_lock); if (!err) { q->rpm_status = RPM_ACTIVE;