Patch "PM: hibernate: defer device probing when resuming from hibernation" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    PM: hibernate: defer device probing when resuming from hibernation

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     pm-hibernate-defer-device-probing-when-resuming-from.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a5a08bb4632aff8067d803a96252cbfbc379b6f5
Author: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Date:   Fri Jul 15 14:49:58 2022 +0900

    PM: hibernate: defer device probing when resuming from hibernation
    
    [ Upstream commit 8386c414e27caba8501119948e9551e52b527f59 ]
    
    syzbot is reporting hung task at misc_open() [1], for there is a race
    window of AB-BA deadlock which involves probe_count variable. Currently
    wait_for_device_probe() from snapshot_open() from misc_open() can sleep
    forever with misc_mtx held if probe_count cannot become 0.
    
    When a device is probed by hub_event() work function, probe_count is
    incremented before the probe function starts, and probe_count is
    decremented after the probe function completed.
    
    There are three cases that can prevent probe_count from dropping to 0.
    
      (a) A device being probed stopped responding (i.e. broken/malicious
          hardware).
    
      (b) A process emulating a USB device using /dev/raw-gadget interface
          stopped responding for some reason.
    
      (c) New device probe requests keeps coming in before existing device
          probe requests complete.
    
    The phenomenon syzbot is reporting is (b). A process which is holding
    system_transition_mutex and misc_mtx is waiting for probe_count to become
    0 inside wait_for_device_probe(), but the probe function which is called
     from hub_event() work function is waiting for the processes which are
    blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface.
    
    This patch mitigates (b) by deferring wait_for_device_probe() from
    snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that
    the possibility of (b) remains as long as any thread which is emulating a
    USB device via /dev/raw-gadget interface can be blocked by uninterruptible
    blocking operations (e.g. mutex_lock()).
    
    Please also note that (a) and (c) are not addressed. Regarding (c), we
    should change the code to wait for only one device which contains the
    image for resuming from hibernation. I don't know how to address (a), for
    use of timeout for wait_for_device_probe() might result in loss of user
    data in the image. Maybe we should require the userland to wait for the
    image device before opening /dev/snapshot interface.
    
    Link: https://syzkaller.appspot.com/bug?extid=358c9ab4c93da7b7238c [1]
    Reported-by: syzbot <syzbot+358c9ab4c93da7b7238c@xxxxxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
    Tested-by: syzbot <syzbot+358c9ab4c93da7b7238c@xxxxxxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/power/user.c b/kernel/power/user.c
index 2d8b60a3c86b..6a11154b3d52 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -29,6 +29,7 @@
 
 #include "power.h"
 
+static bool need_wait;
 
 #define SNAPSHOT_MINOR	231
 
@@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file *filp)
 		 * Resuming.  We may need to wait for the image device to
 		 * appear.
 		 */
-		wait_for_device_probe();
+		need_wait = true;
 
 		data->swap = -1;
 		data->mode = O_WRONLY;
@@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf,
 	ssize_t res;
 	loff_t pg_offp = *offp & ~PAGE_MASK;
 
+	if (need_wait) {
+		wait_for_device_probe();
+		need_wait = false;
+	}
+
 	lock_system_sleep();
 
 	data = filp->private_data;
@@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
 	loff_t size;
 	sector_t offset;
 
+	if (need_wait) {
+		wait_for_device_probe();
+		need_wait = false;
+	}
+
 	if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC)
 		return -ENOTTY;
 	if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR)