linux-stable/drivers/base/power
Rafael J. Wysocki 7dce99d318 PM: core: Fix handling of devices deleted during system-wide resume
commit 0552e05fdf upstream.

If a device is deleted by one of its system-wide resume callbacks
(for example, because it does not appear to be present or accessible
any more) along with its children, the resume of the children may
continue leading to use-after-free errors and other issues
(potentially).

Namely, if the device's children are resumed asynchronously, their
resume may have been scheduled already before the device's callback
runs and so the device may be deleted while dpm_wait_for_superior()
is being executed for them.  The memory taken up by the parent device
object may be freed then while dpm_wait() is waiting for the parent's
resume callback to complete, which leads to a use-after-free.
Moreover, the resume of the children is really not expected to
continue after they have been unregistered, so it must be terminated
right away in that case.

To address this problem, modify dpm_wait_for_superior() to check
if the target device is still there in the system-wide PM list of
devices and if so, to increment its parent's reference counter, both
under dpm_list_mtx which prevents device_del() running for the child
from dropping the parent's reference counter prematurely.

If the device is not present in the system-wide PM list of devices
any more, the resume of it cannot continue, so check that again after
dpm_wait() returns, which means that the parent's callback has been
completed, and pass the result of that check to the caller of
dpm_wait_for_superior() to allow it to abort the device's resume
if it is not there any more.

Link: https://lore.kernel.org/linux-pm/1579568452-27253-1-git-send-email-chanho.min@lge.com
Reported-by: Chanho Min <chanho.min@lge.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:25 -08:00
..
clock_ops.c PM / clk: Remove error message on out-of-memory condition 2019-05-28 19:40:21 +02:00
common.c drivers: base: power: add proper SPDX identifiers on files that did not have them. 2019-04-04 20:03:40 +02:00
domain.c PM / Domains: Verify PM domain type in dev_pm_genpd_set_performance_state() 2019-09-02 22:38:00 +02:00
domain_governor.c PM / QOS: Pass request type to dev_pm_qos_read_value() 2019-07-04 10:40:54 +02:00
generic_ops.c drivers: base: power: add proper SPDX identifiers on files that did not have them. 2019-04-04 20:03:40 +02:00
main.c PM: core: Fix handling of devices deleted during system-wide resume 2020-02-11 04:35:25 -08:00
Makefile PM / wakeup: Show wakeup sources stats in sysfs 2019-08-21 00:20:40 +02:00
power.h PM / wakeup: Register wakeup class kobj after device is added 2019-08-21 00:25:16 +02:00
qos.c PM: QoS: Drop frequency QoS types from device PM QoS 2019-10-21 02:05:21 +02:00
runtime.c Driver core patches for 5.4-rc1 2019-09-18 10:04:39 -07:00
sysfs.c PM / wakeup: Register wakeup class kobj after device is added 2019-08-21 00:25:16 +02:00
trace.c drivers: base: power: add proper SPDX identifiers on files that did not have them. 2019-04-04 20:03:40 +02:00
wakeirq.c drivers: base: power: add proper SPDX identifiers on files that did not have them. 2019-04-04 20:03:40 +02:00
wakeup.c Merge suspend-to-idle rework material for v5.4. 2019-09-17 09:35:35 +02:00
wakeup_stats.c PM / wakeup: Unexport wakeup_source_sysfs_{add,remove}() 2019-08-21 00:26:43 +02:00