linux-kernel - Re: Locking problem in usbserial with 2.6.23-git 5a34417f

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0710192304590.18815@twin.jikos.cz>
Date:	Fri, 19 Oct 2007 23:06:18 +0200 (CEST)
From:	Jiri Kosina <jikos@...os.cz>
To:	Larry Finger <Larry.Finger@...inger.net>
cc:	LKML <linux-kernel@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	linux-usb-devel@...ts.sourceforge.net
Subject: Re: Locking problem in usbserial with 2.6.23-git 5a34417f

On Fri, 19 Oct 2007, Larry Finger wrote:

> While attempting to configure a new USB modem, the following locking 
> problem occurred. In addition, shortly after this problem occurred, the 
> computer froze. The log data starts at the point that usbserial was 
> loaded and contains everything that was written to disk before the 
> machine locked up. Some info may be missing from the end of the stack 
> dump.

I guess this one is needed.


From: Jiri Kosina <jkosina@...e.cz>

USB: usbserial - fix potential deadlock between write() and irq

usb_serial_generic_write() doesn't disable interrupts when taking port->lock,
and could therefore deadlock with usb_serial_generic_read_bulk_callback()
being called from interrupt, taking the same lock. Fix it.

Signed-off-by: Jiri Kosina <jkosina@...e.cz>

diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 88a2c7d..6f8d712 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -208,14 +208,15 @@ int usb_serial_generic_write(struct usb_serial_port *port, const unsigned char *
 
 	/* only do something if we have a bulk out endpoint */
 	if (serial->num_bulk_out) {
-		spin_lock_bh(&port->lock);
+		unsigned long flags;
+		spin_lock_irqsave(&port->lock, flags);
 		if (port->write_urb_busy) {
 			spin_unlock_bh(&port->lock);
 			dbg("%s - already writing", __FUNCTION__);
 			return 0;
 		}
 		port->write_urb_busy = 1;
-		spin_unlock_bh(&port->lock);
+		spin_unlock_irqrestore(&port->lock, flags);
 
 		count = (count > port->bulk_out_size) ? port->bulk_out_size : count;
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/