linux-kernel - Re: [PATCH] usb: isp1760: fix possible deadlock in isp1760_udc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 05 Mar 2015 12:49:58 +0200
From:	Laurent Pinchart <laurent.pinchart@...asonboard.com>
To:	Sudeep Holla <sudeep.holla@....com>
Cc:	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	Felipe Balbi <balbi@...com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] usb: isp1760: fix possible deadlock in isp1760_udc_irq

Hi Sudeep,

Thank you for the patch.

On Wednesday 04 March 2015 17:07:57 Sudeep Holla wrote:
> Use spin_{un,}lock_irq{save,restore} in isp1760_udc_{start,stop} to
> prevent following potentially deadlock scenario between
> isp1760_udc_{start,stop} and isp1760_udc_irq :
> 
> =================================
> [ INFO: inconsistent lock state ]
> 4.0.0-rc2-00004-gf7bb2ef60173 #51 Not tainted
> ---------------------------------
> inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
> in:imklog/2118 [HC1[1]:SC0[0]:HE0:SE1] takes:
>  (&(&udc->lock)->rlock){?.+...}, at: [<c0397a93>]
> isp1760_udc_irq+0x367/0x9dc {HARDIRQ-ON-W} state was registered at:
>   [<c05135b3>] _raw_spin_lock+0x23/0x30
>   [<c0396b87>] isp1760_udc_start+0x23/0xf8
>   [<c039dc21>] udc_bind_to_driver+0x71/0xb0
>   [<c039de4f>] usb_gadget_probe_driver+0x53/0x9c
>   [<bf80d0df>] usb_composite_probe+0x8a/0xa4 [libcomposite]
>   [<bf8311a7>] 0xbf8311a7
>   [<c00088c5>] do_one_initcall+0x8d/0x17c
>   [<c050b92d>] do_init_module+0x49/0x148
>   [<c0087323>] load_module+0xb7f/0xbc4
>   [<c0087471>] SyS_finit_module+0x51/0x74
>   [<c000d8c1>] ret_fast_syscall+0x1/0x68
> irq event stamp: 4966
> hardirqs last  enabled at (4965): [<c05137df>]
> _raw_spin_unlock_irq+0x1f/0x24 hardirqs last disabled at (4966):
> [<c00110b3>] __irq_svc+0x33/0x64 softirqs last  enabled at (4458):
> [<c0023475>] __do_softirq+0x23d/0x2d0 softirqs last disabled at (4389):
> [<c002380b>] irq_exit+0xef/0x15c
> 
> other info that might help us debug this:
>  Possible unsafe locking scenario:
> 
>        CPU0
>        ----
>   lock(&(&udc->lock)->rlock);
>   <Interrupt>
>     lock(&(&udc->lock)->rlock);
> 
>  *** DEADLOCK ***
> 
> 1 lock held by in:imklog/2118:
>  #0:  (&f->f_pos_lock){+.+.+.}, at: [<c010a101>] __fdget_pos+0x31/0x34
> 
> Signed-off-by: Sudeep Holla <sudeep.holla@....com>
> Cc: Laurent Pinchart <laurent.pinchart@...asonboard.com>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: Felipe Balbi <balbi@...com>
> ---
>  drivers/usb/isp1760/isp1760-udc.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/isp1760/isp1760-udc.c
> b/drivers/usb/isp1760/isp1760-udc.c index 6d618b3fab07..fbfbd59aae64 100644
> --- a/drivers/usb/isp1760/isp1760-udc.c
> +++ b/drivers/usb/isp1760/isp1760-udc.c
> @@ -1191,6 +1191,7 @@ static int isp1760_udc_start(struct usb_gadget
> *gadget, struct usb_gadget_driver *driver)
>  {
>  	struct isp1760_udc *udc = gadget_to_udc(gadget);
> +	unsigned long flags;
> 
>  	/* The hardware doesn't support low speed. */
>  	if (driver->max_speed < USB_SPEED_FULL) {
> @@ -1198,7 +1199,7 @@ static int isp1760_udc_start(struct usb_gadget
> *gadget, return -EINVAL;
>  	}
> 
> -	spin_lock(&udc->lock);
> +	spin_lock_irqsave(&udc->lock, flags);

Strictly speaking spin_lock_irq() should be enough given that udc_start and 
udc_stop are called with interrupts enabled, but I suppose it doesn't hurt to 
be safe. I'll let you go with your preference. For both options,

Acked-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>

> 
>  	if (udc->driver) {
>  		dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
> @@ -1208,7 +1209,7 @@ static int isp1760_udc_start(struct usb_gadget
> *gadget,
> 
>  	udc->driver = driver;
> 
> -	spin_unlock(&udc->lock);
> +	spin_unlock_irqrestore(&udc->lock, flags);
> 
>  	dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
>  		driver->function);
> @@ -1232,6 +1233,7 @@ static int isp1760_udc_start(struct usb_gadget
> *gadget, static int isp1760_udc_stop(struct usb_gadget *gadget)
>  {
>  	struct isp1760_udc *udc = gadget_to_udc(gadget);
> +	unsigned long flags;
> 
>  	dev_dbg(udc->isp->dev, "%s\n", __func__);
> 
> @@ -1239,9 +1241,9 @@ static int isp1760_udc_stop(struct usb_gadget *gadget)
> 
>  	isp1760_udc_write(udc, DC_MODE, 0);
> 
> -	spin_lock(&udc->lock);
> +	spin_lock_irqsave(&udc->lock, flags);
>  	udc->driver = NULL;
> -	spin_unlock(&udc->lock);
> +	spin_unlock_irqrestore(&udc->lock, flags);
> 
>  	return 0;
>  }

-- 
Regards,

Laurent Pinchart

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/