linux-kernel - Re: [PATCH] usb: fix deadlock with bandwidth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.1008171048550.1656-100000@iolanthe.rowland.org>
Date:	Tue, 17 Aug 2010 10:55:17 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Thadeu Lima de Souza Cascardo <cascardo@...oscopio.com>
cc:	linux-usb@...r.kernel.org, <linux-kernel@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	Sarah Sharp <sarah.a.sharp@...ux.intel.com>
Subject: Re: [PATCH] usb: fix deadlock with bandwidth_mutex

On Tue, 17 Aug 2010, Thadeu Lima de Souza Cascardo wrote:

> When using the remove sysfs file, the device configuration is set to -1
> (unconfigured). This eventually unbind drivers with the bandwidth_mutex
> held. Some drivers may call functions that hold said mutex, like
> usb_reset_device. This is the case for rtl8187, for example. This will
> lead to the same process holding the mutex twice, which deadlocks.

The deadlock problem probably could be handled somehow, but there's a
separate issue: Until the usb_disable_device call finishes unbinding
the drivers, the drivers are free to continue using their allocated
bandwidth.  We musn't change the bandwidth allocations until after the
unbinding is done.  So this patch is indeed necessary.

> Unbinding the driver before holding the bandwidth_mutex solves the
> problem. If any operation after that fails, drivers are not bound again.
> But that would be a problem anyway that the user may solve resetting the
> device configuration to one that works, just like he would need to do in
> most other failure cases.

That's right; we don't have to worry about this case.

Incidentally, you might also want to change the following code at the 
same time:

	mutex_lock(&hcd->bandwidth_mutex);
	ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
	if (ret < 0) {
		usb_autosuspend_device(dev);
		mutex_unlock(&hcd->bandwidth_mutex);
		goto free_interfaces;
	}

In the failure case, it would be safer to drop the mutex _before_
calling usb_autosuspend_device.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/