linux-kernel - Re: [PATCH 1/2] usb: typec: Add USB Power Delivery sink port support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Jul 2016 15:33:57 -0700
From:	Bin Gao <bin.gao@...ux.intel.com>
To:	Oliver Neukum <oneukum@...e.com>
Cc:	Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
	Bin Gao <bin.gao@...el.com>,
	Chandra Sekhar Anagani <chandra.sekhar.anagani@...el.com>
Subject: Re: [PATCH 1/2] usb: typec: Add USB Power Delivery sink port support

On Fri, Jul 15, 2016 at 08:31:08AM +0200, Oliver Neukum wrote:
> > +static void ack_message(struct pd_sink_port *port, int msg_id)
> > +{
> > +	struct pd_msg_header *header = kzalloc(PD_MSG_HEADER_LEN, GFP_KERNEL);
> 
> This must be GFP_NOIO. We are in a cycle that can lead to deadlock.
> 
> Assume we are waiting for a request for more power to process IO
> which we need to ack.
> 
> 1. memory allocation leads to laundering, blocks on freeing memory
> 2. launderer decides to perform IO which needs more power
> 3. more power has already been requested, wait for it to be granted
> 
> 4. BANG - DEADLOCK
Agree, I'll change the GFP flag in next revision.

> > +	struct pd_msg_header *header = kzalloc(PD_MSG_HEADER_LEN +
> > +		port->nr_ps * PD_OBJ_SIZE, GFP_KERNEL);
> 
> Must be GFP_NOIO. For the same reason as above. We may be asked
> this to resolve a mismatch due to needing more power for IO.
Yes will do.

> > +static void handle_soft_reset(struct pd_sink_port *port)
> > +{
> > +	struct pd_msg_header *header = kzalloc(PD_MSG_HEADER_LEN, GFP_KERNEL);
> > +
> > +	if (!header)
> > +		return;
> > +
> > +	flush_workqueue(port->rx_wq);
> 
> That is problematic. We may be here precisely because something is wrong
> blocking progress. In particular what happens if another soft reset
> is queued?
I'm going to remove the workqueue.

> > +	struct pd_msg_header *header = kzalloc(PD_MSG_HEADER_LEN +
> > +					PD_OBJ_SIZE, GFP_KERNEL);
> 
> GFP_NOIO, same reasons
Yes.

> > +
> 
> 	HTH
> 		Oliver
Thanks for your review.