lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 21 Sep 2007 15:08:42 -0700 From: David Brownell <david-b@...bell.net> To: Thomas Gleixner <tglx@...utronix.de> Cc: Andrew Morton <akpm@...l.org>, LKML <linux-kernel@...r.kernel.org>, Benedikt Spranger <bene@...utronix.de>, Stable Team <stable@...nel.org> Subject: Re: [PATCH] usb-gadget-ether: Prevent oops caused by error interrupt race On Thursday 20 September 2007, Thomas Gleixner wrote: > From: Benedikt Spranger <bene@...utronix.de> > > An USB error interrupt (e.g. disconnect) nukes the pending requests for > an ethernet gadget device asynchronously. This can race against > eth_start_xmit(), where we end up dereferencing the list head itself. > > The nuke code is serialized against eth_start_xmit via dev->req_lock, > but we need to check the list for empty first instead of unconditionally > accessing dev->tx_reqs.next. Looks OK, although the comments are confusingly incorrect which made it hard to see what this was doing: - There is no "nuke()" method in this driver, even comments don't use that term. - When "nuke" is used in the gadget stack, it means the way that controller drivers scrub out a queue of live requests queued to an endpoint ... *NOT* recycling memory that sits on a freelist, which is what's involved here. - Disconnect is *NOT* an error, it's a routine occurrence which can happen at essentially any time. If you update the patch and comments accordingly, ACK. > This is a long standing bug, which should be fixed in stable as well. > > Signed-off-by: Benedikt Spranger <bene@...utronix.de> > Signed-off-by: Thomas Gleixner <tglx@...utronix.de> > > diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c > index 593e235..f1d7c82 100644 > --- a/drivers/usb/gadget/ether.c > +++ b/drivers/usb/gadget/ether.c > @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net) > } > > spin_lock_irqsave(&dev->req_lock, flags); > + /* > + * dev->tx_reqs may be empty due to an error interrupt which Please reword: "may be empty because disconnecting an active device cleans out this freelist". > + * nuked all requests. > + */ > + if (list_empty(&dev->tx_reqs)) { > + netif_stop_queue(net); > + spin_unlock_irqrestore(&dev->req_lock, flags); > + return 1; > + } > + > req = container_of (dev->tx_reqs.next, struct usb_request, list); > list_del (&req->list); > + > + /* last request in list: stop queue */ > if (list_empty (&dev->tx_reqs)) > netif_stop_queue (net); > spin_unlock_irqrestore(&dev->req_lock, flags); > > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists