ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
authorZhihao Cheng <chengzhihao1@huawei.com>
Mon, 13 Jun 2022 06:59:04 +0000 (14:59 +0800)
committerRichard Weinberger <richard@nod.at>
Thu, 2 Feb 2023 20:13:50 +0000 (21:13 +0100)
Following process will trigger an infinite loop in ubi_wl_put_peb():

ubifs_bgt ubi_bgt
ubifs_leb_unmap
  ubi_leb_unmap
    ubi_eba_unmap_leb
      ubi_wl_put_peb wear_leveling_worker
                          e1 = rb_entry(rb_first(&ubi->used)
  e2 = get_peb_for_wl(ubi)
  ubi_io_read_vid_hdr  // return err (flash fault)
  out_error:
    ubi->move_from = ubi->move_to = NULL
    wl_entry_destroy(ubi, e1)
      ubi->lookuptbl[e->pnum] = NULL
      retry:
        e = ubi->lookuptbl[pnum]; // return NULL
if (e == ubi->move_from) { // NULL == NULL gets true
  goto retry; // infinite loop !!!

$ top
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND
  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0

Fix it by:
 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
    been removed from 'ubi->lookuptbl'.
 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an
    use-after-free problem for wl entry in ubi_wl_put_peb().

Fetch a reproducer in [Link].

Fixes: 43f9b25a9cdd7b1 ("UBI: bugfix: protect from volume removal")
Fixes: ee59ba8b064f692 ("UBI: Fix stale pointers in ubi->lookuptbl")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216111
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
drivers/mtd/ubi/wl.c

index f45df3b..9e14319 100644 (file)
@@ -976,11 +976,11 @@ out_error:
        spin_lock(&ubi->wl_lock);
        ubi->move_from = ubi->move_to = NULL;
        ubi->move_to_put = ubi->wl_scheduled = 0;
+       wl_entry_destroy(ubi, e1);
+       wl_entry_destroy(ubi, e2);
        spin_unlock(&ubi->wl_lock);
 
        ubi_free_vid_buf(vidb);
-       wl_entry_destroy(ubi, e1);
-       wl_entry_destroy(ubi, e2);
 
 out_ro:
        ubi_ro_mode(ubi);
@@ -1260,6 +1260,18 @@ int ubi_wl_put_peb(struct ubi_device *ubi, int vol_id, int lnum,
 retry:
        spin_lock(&ubi->wl_lock);
        e = ubi->lookuptbl[pnum];
+       if (!e) {
+               /*
+                * This wl entry has been removed for some errors by other
+                * process (eg. wear leveling worker), corresponding process
+                * (except __erase_worker, which cannot concurrent with
+                * ubi_wl_put_peb) will set ubi ro_mode at the same time,
+                * just ignore this wl entry.
+                */
+               spin_unlock(&ubi->wl_lock);
+               up_read(&ubi->fm_protect);
+               return 0;
+       }
        if (e == ubi->move_from) {
                /*
                 * User is putting the physical eraseblock which was selected to