From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Wei Wang <wvw@google.com>,
Zhang Rui <rui.zhang@intel.com>
Subject: [PATCH 5.4 87/92] thermal: Fix deadlock in thermal thermal_zone_device_check
Date: Wed, 11 Dec 2019 16:06:18 +0100 [thread overview]
Message-ID: <20191211150302.037884152@linuxfoundation.org> (raw)
In-Reply-To: <20191211150221.977775294@linuxfoundation.org>
From: Wei Wang <wvw@google.com>
commit 163b00cde7cf2206e248789d2780121ad5e6a70b upstream.
1851799e1d29 ("thermal: Fix use-after-free when unregistering thermal zone
device") changed cancel_delayed_work to cancel_delayed_work_sync to avoid
a use-after-free issue. However, cancel_delayed_work_sync could be called
insides the WQ causing deadlock.
[54109.642398] c0 1162 kworker/u17:1 D 0 11030 2 0x00000000
[54109.642437] c0 1162 Workqueue: thermal_passive_wq thermal_zone_device_check
[54109.642447] c0 1162 Call trace:
[54109.642456] c0 1162 __switch_to+0x138/0x158
[54109.642467] c0 1162 __schedule+0xba4/0x1434
[54109.642480] c0 1162 schedule_timeout+0xa0/0xb28
[54109.642492] c0 1162 wait_for_common+0x138/0x2e8
[54109.642511] c0 1162 flush_work+0x348/0x40c
[54109.642522] c0 1162 __cancel_work_timer+0x180/0x218
[54109.642544] c0 1162 handle_thermal_trip+0x2c4/0x5a4
[54109.642553] c0 1162 thermal_zone_device_update+0x1b4/0x25c
[54109.642563] c0 1162 thermal_zone_device_check+0x18/0x24
[54109.642574] c0 1162 process_one_work+0x3cc/0x69c
[54109.642583] c0 1162 worker_thread+0x49c/0x7c0
[54109.642593] c0 1162 kthread+0x17c/0x1b0
[54109.642602] c0 1162 ret_from_fork+0x10/0x18
[54109.643051] c0 1162 kworker/u17:2 D 0 16245 2 0x00000000
[54109.643067] c0 1162 Workqueue: thermal_passive_wq thermal_zone_device_check
[54109.643077] c0 1162 Call trace:
[54109.643085] c0 1162 __switch_to+0x138/0x158
[54109.643095] c0 1162 __schedule+0xba4/0x1434
[54109.643104] c0 1162 schedule_timeout+0xa0/0xb28
[54109.643114] c0 1162 wait_for_common+0x138/0x2e8
[54109.643122] c0 1162 flush_work+0x348/0x40c
[54109.643131] c0 1162 __cancel_work_timer+0x180/0x218
[54109.643141] c0 1162 handle_thermal_trip+0x2c4/0x5a4
[54109.643150] c0 1162 thermal_zone_device_update+0x1b4/0x25c
[54109.643159] c0 1162 thermal_zone_device_check+0x18/0x24
[54109.643167] c0 1162 process_one_work+0x3cc/0x69c
[54109.643177] c0 1162 worker_thread+0x49c/0x7c0
[54109.643186] c0 1162 kthread+0x17c/0x1b0
[54109.643195] c0 1162 ret_from_fork+0x10/0x18
[54109.644500] c0 1162 cat D 0 7766 1 0x00000001
[54109.644515] c0 1162 Call trace:
[54109.644524] c0 1162 __switch_to+0x138/0x158
[54109.644536] c0 1162 __schedule+0xba4/0x1434
[54109.644546] c0 1162 schedule_preempt_disabled+0x80/0xb0
[54109.644555] c0 1162 __mutex_lock+0x3a8/0x7f0
[54109.644563] c0 1162 __mutex_lock_slowpath+0x14/0x20
[54109.644575] c0 1162 thermal_zone_get_temp+0x84/0x360
[54109.644586] c0 1162 temp_show+0x30/0x78
[54109.644609] c0 1162 dev_attr_show+0x5c/0xf0
[54109.644628] c0 1162 sysfs_kf_seq_show+0xcc/0x1a4
[54109.644636] c0 1162 kernfs_seq_show+0x48/0x88
[54109.644656] c0 1162 seq_read+0x1f4/0x73c
[54109.644664] c0 1162 kernfs_fop_read+0x84/0x318
[54109.644683] c0 1162 __vfs_read+0x50/0x1bc
[54109.644692] c0 1162 vfs_read+0xa4/0x140
[54109.644701] c0 1162 SyS_read+0xbc/0x144
[54109.644708] c0 1162 el0_svc_naked+0x34/0x38
[54109.845800] c0 1162 D 720.000s 1->7766->7766 cat [panic]
Fixes: 1851799e1d29 ("thermal: Fix use-after-free when unregistering thermal zone device")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Wang <wvw@google.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/thermal_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -304,7 +304,7 @@ static void thermal_zone_device_set_poll
&tz->poll_queue,
msecs_to_jiffies(delay));
else
- cancel_delayed_work_sync(&tz->poll_queue);
+ cancel_delayed_work(&tz->poll_queue);
}
static void monitor_thermal_zone(struct thermal_zone_device *tz)
@@ -1414,7 +1414,7 @@ void thermal_zone_device_unregister(stru
mutex_unlock(&thermal_list_lock);
- thermal_zone_device_set_polling(tz, 0);
+ cancel_delayed_work_sync(&tz->poll_queue);
thermal_set_governor(tz, NULL);
next prev parent reply other threads:[~2019-12-11 16:11 UTC|newest]
Thread overview: 106+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-11 15:04 [PATCH 5.4 00/92] 5.4.3-stable review Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 01/92] rsi: release skb if rsi_prepare_beacon fails Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 02/92] arm64: tegra: Fix active-low warning for Jetson TX1 regulator Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 03/92] arm64: tegra: Fix active-low warning for Jetson Xavier regulator Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 04/92] perf scripts python: exported-sql-viewer.py: Fix use of TRUE with SQLite Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 05/92] sparc64: implement ioremap_uc Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 06/92] lp: fix sparc64 LPSETTIMEOUT ioctl Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 07/92] time: Zero the upper 32-bits in __kernel_timespec on 32-bit Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.4 08/92] mailbox: tegra: Fix superfluous IRQ error message Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 09/92] staging/octeon: Use stubs for MIPS && !CAVIUM_OCTEON_SOC Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 10/92] usb: gadget: u_serial: add missing port entry locking Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 11/92] serial: 8250-mtk: Use platform_get_irq_optional() for optional irq Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 12/92] tty: serial: fsl_lpuart: use the sg count from dma_map_sg Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 13/92] tty: serial: msm_serial: Fix flow control Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 14/92] serial: pl011: Fix DMA ->flush_buffer() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 15/92] serial: serial_core: Perform NULL checks for break_ctl ops Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 16/92] serial: stm32: fix clearing interrupt error flags Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 17/92] serial: 8250_dw: Avoid double error messaging when IRQ absent Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 18/92] serial: ifx6x60: add missed pm_runtime_disable Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 19/92] mwifiex: Re-work support for SDIO HW reset Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 20/92] io_uring: fix dead-hung for non-iter fixed rw Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 21/92] io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 22/92] fuse: fix leak of fuse_io_priv Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 23/92] fuse: verify nlink Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 24/92] fuse: verify write return Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 25/92] fuse: verify attributes Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 26/92] io_uring: fix missing kmap() declaration on powerpc Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 27/92] io_uring: ensure req->submit is copied when req is deferred Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 28/92] SUNRPC: Avoid RPC delays when exiting suspend Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 29/92] ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 30/92] ALSA: hda/realtek - Enable the headset-mic on a Xiaomis laptop Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 31/92] ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 32/92] ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 33/92] ALSA: pcm: oss: Avoid potential buffer overflows Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 34/92] ALSA: hda - Add mute led support for HP ProBook 645 G4 Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 35/92] ALSA: hda: Modify stream stripe mask only when needed Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 36/92] soc: mediatek: cmdq: fixup wrong input order of write api Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 37/92] Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 38/92] Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 39/92] Input: synaptics-rmi4 - dont increment rmiaddr for SMBus transfers Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 40/92] Input: goodix - add upside-down quirk for Teclast X89 tablet Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 41/92] coresight: etm4x: Fix input validation for sysfs Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 42/92] Input: Fix memory leak in psxpad_spi_probe Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 43/92] media: rc: mark input device as pointing stick Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 44/92] x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 45/92] x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 46/92] CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 47/92] CIFS: Fix SMB2 oplock break processing Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 48/92] tty: vt: keyboard: reject invalid keycodes Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 49/92] can: slcan: Fix use-after-free Read in slcan_open Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 50/92] nfsd: Ensure CLONE persists data and metadata changes to the target file Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 51/92] nfsd: restore NFSv3 ACL support Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 52/92] kernfs: fix ino wrap-around detection Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 53/92] jbd2: Fix possible overflow in jbd2_log_space_left() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 54/92] drm/msm: fix memleak on release Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 55/92] drm: damage_helper: Fix race checking plane->state->fb Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 56/92] drm/i810: Prevent underflow in ioctl Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 57/92] arm64: Validate tagged addresses in access_ok() called from kernel threads Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 58/92] arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node" Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 59/92] KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 60/92] KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 61/92] KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are allocated Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 62/92] KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 63/92] KVM: arm/arm64: vgic: Dont rely on the wrong pending table Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 64/92] KVM: x86: do not modify masked bits of shared MSRs Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 65/92] KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 66/92] KVM: x86: Remove a spurious export of a static function Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 67/92] KVM: x86: Grab KVMs srcu lock when setting nested state Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.4 68/92] crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 69/92] crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 70/92] crypto: af_alg - cast ki_complete ternary op to int Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 71/92] crypto: geode-aes - switch to skcipher for cbc(aes) fallback Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 72/92] crypto: ccp - fix uninitialized list head Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 73/92] crypto: ecdh - fix big endian bug in ECC library Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 74/92] crypto: user - fix memory leak in crypto_report Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 75/92] crypto: user - fix memory leak in crypto_reportstat Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 76/92] spi: spi-fsl-qspi: Clear TDH bits in FLSHCR register Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 77/92] spi: stm32-qspi: Fix kernel oops when unbinding driver Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 78/92] spi: atmel: Fix CS high support Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 79/92] spi: Fix SPI_CS_HIGH setting when using native and GPIO CS Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 80/92] spi: Fix NULL pointer when setting SPI_CS_HIGH for " Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 81/92] can: ucan: fix non-atomic allocation in completion handler Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 82/92] RDMA/qib: Validate ->show()/store() callbacks before calling them Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 83/92] rfkill: allocate static minor Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 84/92] bdev: Factor out bdev revalidation into a common helper Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 85/92] bdev: Refresh bdev size for disks without partitioning Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 86/92] iomap: Fix pipe page leakage during splicing Greg Kroah-Hartman
2019-12-11 15:06 ` Greg Kroah-Hartman [this message]
2019-12-11 15:06 ` [PATCH 5.4 88/92] vcs: prevent write access to vcsu devices Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 89/92] Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices" Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 90/92] binder: Fix race between mmap() and binder_alloc_print_pages() Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 91/92] binder: Prevent repeated use of ->mmap() via NULL mapping Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.4 92/92] binder: Handle start==NULL in binder_update_page_range() Greg Kroah-Hartman
2019-12-11 21:13 ` [PATCH 5.4 00/92] 5.4.3-stable review Jon Hunter
2019-12-12 2:48 ` shuah
2019-12-12 9:36 ` Greg Kroah-Hartman
2019-12-12 5:28 ` Naresh Kamboju
2019-12-12 9:37 ` Greg Kroah-Hartman
2019-12-12 8:27 ` Jeffrin Jose
2019-12-12 9:10 ` Greg Kroah-Hartman
2019-12-12 10:04 ` Greg Kroah-Hartman
2019-12-12 13:18 ` Jon Hunter
2019-12-13 4:49 ` Naresh Kamboju
2019-12-13 16:08 ` Greg Kroah-Hartman
2019-12-12 18:25 ` Guenter Roeck
2019-12-13 16:07 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191211150302.037884152@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rui.zhang@intel.com \
--cc=stable@vger.kernel.org \
--cc=wvw@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).