linux-kernel - RE: Re: Subject: [PATCH v1] USB:Core: BugFix: Proper handling of Race Condition when two USB class drivers try to call init_usb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 31 Jan 2017 05:21:46 +0000
From:   Ajay Kaher <ajay.kaher@...sung.com>
To:     "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
Cc:     "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        AMAN DEEP <aman.deep@...sung.com>,
        HEMANSHU SRIVASTAVA <hemanshu.s@...sung.com>
Subject: RE: Re: Subject: [PATCH v1] USB:Core: BugFix: Proper handling of Race
 Condition when two USB class drivers try to call init_usb_class simultaneously


 
At boot time, probe function of multiple connected devices
(proprietary devices) execute simultaneously. And because
of the following code path race condition happens:
probe->usb_register_dev->init_usb_class

Tested with these changes, and problem has been solved.

thanks,
ajay kaher


--------- Original Message ---------
Sender : gregkh@...uxfoundation.org <gregkh@...uxfoundation.org>
Date   : 2017-01-30 14:36 (GMT+5:30)
Title  : Re: Subject: [PATCH v1] USB:Core: BugFix: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
 
On Mon, Jan 30, 2017 at 08:25:25AM +0000, Ajay Kaher wrote:
>  
 
First off, you are sending html email, which the mailing list keeps
rejecting, why are you ignoring that?
 
 
 
> 
> There is race condition when two USB class drivers try to call
> 
> init_usb_class at the same time and leads to crash.
> 
>  
> 
> The main reason for this is one of the Class drivers allocates memory
> for usb_class structure and initializes its member. In the meantime NULL
> check for usb_class structure fails and assumes that usb_class structure
> is properly initialized and crashed while trying to access its members.
> 
>  
> 
> To avoid this race condition locking required before calling
> init_usb_class from function usb_register_dev.
> 
>  
> 
>  
> 
> Signed-off-by: Ajay Kaher
 
Does this look correct?  Please work with some of the samsung kernel
developers for how to properly submit a patch.
 
And finally, how are two drivers calling init_usb_class() at the same
time?  What code path causes that?  Have you seen this happen, and if
so, what drivers caused it?
 
thanks,
 
greg k-h