[PATCH 1/1] PM: runtime: fix bitfield race of needs_force_resume

[ed.tsai at mediatek.com]

From: Ed Tsai <ed.tsai at mediatek.com>

needs_force_resume is a bitfield member in struct dev_pm_info and must
be accessed under the same lock as its bitfield group.

A real concurrent write was observed between needs_force_resume and
idle_notification; stacks below:

write needs_force_resume:
  pm_runtime_reinit+0x110/0x360
  really_probe+0xe0/0x464
  __driver_probe_device+0x9c/0x104
  driver_probe_device+0x3c/0x1a8
  __device_attach_driver+0x100/0x17c
  bus_for_each_drv+0x10c/0x168
  __device_attach_async_helper+0x7c/0xf4
  async_run_entry_fn+0x4c/0x1b4
  process_scheduled_works+0x1dc/0x498
  worker_thread+0x220/0x320
  kthread+0x150/0x27c
  ret_from_fork+0x10/0x20

write idle_notification:
  rpm_idle+0x464/0x5f8
  __pm_runtime_idle+0x7c/0x170
  scsi_autopm_put_device+0x18/0x28
  scsi_sysfs_add_sdev+0x1a0/0x1d8
  scsi_probe_and_add_lun+0xbd8/0xcd0
  __scsi_add_device+0xb8/0x11c
  ufshcd_async_scan+0xb4/0x3a4
  async_run_entry_fn+0x4c/0x1b4
  process_scheduled_works+0x1dc/0x498
  worker_thread+0x220/0x320
  kthread+0x150/0x27c
  ret_from_fork+0x10/0x20

Fixes: 89d9cec3b1e9 ("PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()")
Signed-off-by: Ed Tsai <ed.tsai at mediatek.com>
---
 drivers/base/power/runtime.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 84676cc24221..3328543b1ed8 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1879,11 +1879,22 @@ void pm_runtime_reinit(struct device *dev)
 				pm_runtime_put(dev->parent);
 		}
 	}
+
 	/*
 	 * Clear power.needs_force_resume in case it has been set by
 	 * pm_runtime_force_suspend() invoked from a driver remove callback.
 	 */
+	if (dev->power.irq_safe)
+		spin_lock(&dev->power.lock);
+	else
+		spin_lock_irq(&dev->power.lock);
+
 	dev->power.needs_force_resume = false;
+
+	if (dev->power.irq_safe)
+		spin_unlock(&dev->power.lock);
+	else
+		spin_unlock_irq(&dev->power.lock);
 }
 
 /**
-- 
2.45.2