Patch "ubi: Fix deadlock caused by recursively holding work_sem" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ubi: Fix deadlock caused by recursively holding work_sem

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ubi-fix-deadlock-caused-by-recursively-holding-work_.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 448699981b30d1be50e4138df350cb764dd39c0e
Author: ZhaoLong Wang <wangzhaolong1@xxxxxxxxxx>
Date:   Sat Mar 4 09:41:41 2023 +0800

    ubi: Fix deadlock caused by recursively holding work_sem
    
    [ Upstream commit f773f0a331d6c41733b17bebbc1b6cae12e016f5 ]
    
    During the processing of the bgt, if the sync_erase() return -EBUSY
    or some other error code in __erase_worker(),schedule_erase() called
    again lead to the down_read(ubi->work_sem) hold twice and may get
    block by down_write(ubi->work_sem) in ubi_update_fastmap(),
    which cause deadlock.
    
              ubi bgt                        other task
     do_work
      down_read(&ubi->work_sem)          ubi_update_fastmap
      erase_worker                         # Blocked by down_read
       __erase_worker                      down_write(&ubi->work_sem)
        schedule_erase
         schedule_ubi_work
          down_read(&ubi->work_sem)
    
    Fix this by changing input parameter @nested of the schedule_erase() to
    'true' to avoid recursively acquiring the down_read(&ubi->work_sem).
    
    Also, fix the incorrect comment about @nested parameter of the
    schedule_erase() because when down_write(ubi->work_sem) is held, the
    @nested is also need be true.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217093
    Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()")
    Signed-off-by: ZhaoLong Wang <wangzhaolong1@xxxxxxxxxx>
    Reviewed-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
    Signed-off-by: Richard Weinberger <richard@xxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 210866614f492..83c460f7a8837 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -568,7 +568,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
  * @vol_id: the volume ID that last used this PEB
  * @lnum: the last used logical eraseblock number for the PEB
  * @torture: if the physical eraseblock has to be tortured
- * @nested: denotes whether the work_sem is already held in read mode
+ * @nested: denotes whether the work_sem is already held
  *
  * This function returns zero in case of success and a %-ENOMEM in case of
  * failure.
@@ -1096,7 +1096,7 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
 		int err1;
 
 		/* Re-schedule the LEB for erasure */
-		err1 = schedule_erase(ubi, e, vol_id, lnum, 0, false);
+		err1 = schedule_erase(ubi, e, vol_id, lnum, 0, true);
 		if (err1) {
 			spin_lock(&ubi->wl_lock);
 			wl_entry_destroy(ubi, e);