Commit d005f8c6 authored Jun 01, 2020 by Zhihao Cheng Committed by Richard Weinberger Sep 17, 2020

ubi: check kthread_should_stop() after the setting of task state



A detach hung is possible when a race occurs between the detach process
and the ubi background thread. The following sequences outline the race:

  ubi thread: if (list_empty(&ubi->works)...

  ubi detach: set_bit(KTHREAD_SHOULD_STOP, &kthread->flags)
              => by kthread_stop()
              wake_up_process()
              => ubi thread is still running, so 0 is returned

  ubi thread: set_current_state(TASK_INTERRUPTIBLE)
              schedule()
              => ubi thread will never be scheduled again

  ubi detach: wait_for_completion()
              => hung task!

To fix that, we need to check kthread_should_stop() after we set the
task state, so the ubi thread will either see the stop bit and exit or
the task state is reset to runnable such that it isn't scheduled out
indefinitely.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <stable@vger.kernel.org>
Fixes: 801c135c ("UBI: Unsorted Block Images")
Reported-by:  <syzbot+853639d0cb16c31c7a14@syzkaller.appspotmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

parent 58f6e78a

drivers/mtd/ubi/wl.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -1639,6 +1639,19 @@ int ubi_thread(void *u)
		!ubi->thread_enabled \|\| ubi_dbg_is_bgt_disabled(ubi)) {
		set_current_state(TASK_INTERRUPTIBLE);
		spin_unlock(&ubi->wl_lock);

		/*
		* Check kthread_should_stop() after we set the task
		* state to guarantee that we either see the stop bit
		* and exit or the task state is reset to runnable such
		* that it's not scheduled out indefinitely and detects
		* the stop bit at kthread_should_stop().
		*/
		if (kthread_should_stop()) {
		set_current_state(TASK_RUNNING);
		break;
		}

		schedule();
		continue;
		}

Admin message