Re: [PATCH] scsi: sd: fix crashes in sd_resume_runtime

From: Bart Van Assche
Date: Fri Oct 15 2021 - 17:14:42 EST


On 10/15/21 13:11, miles.chen@xxxxxxxxxxxx wrote:
I hit this in v5.15-rc1 merge, I can still reproduce this with v5.15-rc5.
I found two ways to avoid the crash:
1) revert commit ed4246d37f3b ("scsi: sd: REQUEST SENSE for
BLIST_IGN_MEDIA_CHANGE devices in runtime_resume()") works for me.
2) adding the NULL point check in this patch.

From the backtrace, dev_set_drvdata() is called after sd_resume_runtime()
is called.

sd_probe()
{
scsi_autopm_get_device()
pm_runtime_get_sync()
__pm_runtime_resume()
rpm_resume()
...
sd_resume_runtime() // crash here

dev_set_drvdata(dev, sdkp); // sdkp is set later
}

[ 4.861395][ T151] sd_resume_runtime+0x20/0x14c
[ 4.862025][ T151] scsi_runtime_resume+0x84/0xe4
[ 4.862667][ T151] __rpm_callback+0x1f4/0x8cc
[ 4.863275][ T151] rpm_resume+0x7e8/0xaa4
[ 4.863836][ T151] __pm_runtime_resume+0xa0/0x110
[ 4.864489][ T151] sd_probe+0x30/0x428
[ 4.865016][ T151] really_probe+0x14c/0x500

Thanks for the clarification. Given this clarification I'm fine with your patch.

Bart.