linux-kernel - RE: [PATCH] usb: gadget: composite: unlock spinlock before usb_gadget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <063D6719AE5E284EB5DD2968C1650D6D1725C37A@AcuExch.aculab.com>
Date:	Fri, 13 Jun 2014 11:36:24 +0000
From:	David Laight <David.Laight@...LAB.COM>
To:	'Robert Baldyga' <r.baldyga@...sung.com>,
	"balbi@...com" <balbi@...com>
CC:	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"m.szyprowski@...sung.com" <m.szyprowski@...sung.com>,
	"andrzej.p@...sung.com" <andrzej.p@...sung.com>
Subject: RE: [PATCH] usb: gadget: composite: unlock spinlock before
 usb_gadget_disconnect()

From: Robert Baldyga
> usb_gadget_disconnect() shouldn't be called under spinlock to avoid
> spinlock recursion. Function usb_gadget_disconnect() calls pullup(),
> which is callback from UDC driver, usually calling composite_disconnect().
> This function wants to lock spinlock used in usb_function_deactivate()
> causing spinlock recursion.
...
> +++ b/drivers/usb/gadget/composite.c
> @@ -260,8 +260,11 @@ int usb_function_deactivate(struct usb_function *function)
> 
>  	spin_lock_irqsave(&cdev->lock, flags);
> 
> -	if (cdev->deactivations == 0)
> +	if (cdev->deactivations == 0) {
> +		spin_unlock_irqrestore(&cdev->lock, flags);
>  		status = usb_gadget_disconnect(cdev->gadget);
> +		spin_lock_irqsave(&cdev->lock, flags);
> +	}
>  	if (status == 0)
>  		cdev->deactivations++;

That sort of change rings big alarm bells.
You've effectively isolated the usb_gadget_disconnect() call
from the check that cdev->deactivations == 0.
And then you increment cdev->deactivations below.

Looks like it will be racy to me.

	David



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/