linux-kernel - Re: [PATCH] usb-gadget-ether: Prevent oops caused by error interrupt race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 21 Sep 2007 15:08:42 -0700
From:	David Brownell <david-b@...bell.net>
To:	Thomas Gleixner <tglx@...utronix.de>
Cc:	Andrew Morton <akpm@...l.org>, LKML <linux-kernel@...r.kernel.org>,
	Benedikt Spranger <bene@...utronix.de>,
	Stable Team <stable@...nel.org>
Subject: Re: [PATCH] usb-gadget-ether: Prevent oops caused by error interrupt race

On Thursday 20 September 2007, Thomas Gleixner wrote:
> From: Benedikt Spranger <bene@...utronix.de>
> 
> An USB error interrupt (e.g. disconnect) nukes the pending requests for
> an ethernet gadget device asynchronously. This can race against
> eth_start_xmit(), where we end up dereferencing the list head itself.
> 
> The nuke code is serialized against eth_start_xmit via dev->req_lock,
> but we need to check the list for empty first instead of unconditionally
> accessing dev->tx_reqs.next.

Looks OK, although the comments are confusingly incorrect which
made it hard to see what this was doing:

 - There is no "nuke()" method in this driver, even comments
   don't use that term.

 - When "nuke" is used in the gadget stack, it means the way
   that controller drivers scrub out a queue of live requests
   queued to an endpoint ... *NOT* recycling memory that sits
   on a freelist, which is what's involved here.

 - Disconnect is *NOT* an error, it's a routine occurrence
   which can happen at essentially any time.

If you update the patch and comments accordingly, ACK.


> This is a long standing bug, which should be fixed in stable as well.
> 
> Signed-off-by: Benedikt Spranger <bene@...utronix.de>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> 
> diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
> index 593e235..f1d7c82 100644
> --- a/drivers/usb/gadget/ether.c
> +++ b/drivers/usb/gadget/ether.c
> @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
>  	}
>  
>  	spin_lock_irqsave(&dev->req_lock, flags);
> +	/*
> +	 * dev->tx_reqs may be empty due to an error interrupt which

Please reword:  "may be empty because disconnecting an
active device cleans out this freelist".  

> +	 * nuked all requests.
> +	 */
> +	if (list_empty(&dev->tx_reqs)) {
> +		netif_stop_queue(net);
> +		spin_unlock_irqrestore(&dev->req_lock, flags);
> +		return 1;
> +	}
> +
>  	req = container_of (dev->tx_reqs.next, struct usb_request, list);
>  	list_del (&req->list);
> +
> +	/* last request in list: stop queue */
>  	if (list_empty (&dev->tx_reqs))
>  		netif_stop_queue (net);
>  	spin_unlock_irqrestore(&dev->req_lock, flags);
> 
> 


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/