Patch "mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release" has been added to the 5.18-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release

to the 5.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mtd-sm_ftl-fix-deadlock-caused-by-cancel_work_sync-i.patch
and it can be found in the queue-5.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 15210b89a111d7e2eb6c9cc5ef26b86567aace4d
Author: Duoming Zhou <duoming@xxxxxxxxxx>
Date:   Tue May 24 12:48:41 2022 +0800

    mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
    
    [ Upstream commit a61528d997619a518ee8c51cf0ef0513021afaff ]
    
    There is a deadlock between sm_release and sm_cache_flush_work
    which is a work item. The cancel_work_sync in sm_release will
    not return until sm_cache_flush_work is finished. If we hold
    mutex_lock and use cancel_work_sync to wait the work item to
    finish, the work item also requires mutex_lock. As a result,
    the sm_release will be blocked forever. The race condition is
    shown below:
    
        (Thread 1)             |   (Thread 2)
    sm_release                 |
      mutex_lock(&ftl->mutex)  | sm_cache_flush_work
                               |   mutex_lock(&ftl->mutex)
      cancel_work_sync         |   ...
    
    This patch moves del_timer_sync and cancel_work_sync out of
    mutex_lock in order to mitigate deadlock.
    
    Fixes: 7d17c02a01a1 ("mtd: Add new SmartMedia/xD FTL")
    Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
    Signed-off-by: Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
    Link: https://lore.kernel.org/linux-mtd/20220524044841.10517-1-duoming@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 0cff2cda1b5a..7f955fade838 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -1111,9 +1111,9 @@ static void sm_release(struct mtd_blktrans_dev *dev)
 {
 	struct sm_ftl *ftl = dev->priv;
 
-	mutex_lock(&ftl->mutex);
 	del_timer_sync(&ftl->timer);
 	cancel_work_sync(&ftl->flush_work);
+	mutex_lock(&ftl->mutex);
 	sm_cache_flush(ftl);
 	mutex_unlock(&ftl->mutex);
 }