linux-kernel - Re: [PATCH V2] usb: gadget: f_fs: don't free buffer prematurely

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALAqxLUwB4vYiCM1Yi2CizMu-FvEoBB-eNqwaTFi2b=gnvCCZQ@mail.gmail.com>
Date:   Wed, 20 Mar 2019 11:21:02 -0700
From:   John Stultz <john.stultz@...aro.org>
To:     fei.yang@...el.com
Cc:     Felipe Balbi <balbi@...nel.org>,
        Greg KH <gregkh@...uxfoundation.org>, andrzej.p@...labora.com,
        Vincent Pelletier <plr.vincent@...il.com>,
        Linux USB List <linux-usb@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>, Josh Gao <jmgao@...gle.com>,
        Alistair Strachan <astrachan@...gle.com>,
        Shen Jing <jingx.shen@...el.com>,
        Alan Stern <stern@...land.harvard.edu>
Subject: Re: [PATCH V2] usb: gadget: f_fs: don't free buffer prematurely

On Wed, Mar 20, 2019 at 9:40 AM John Stultz <john.stultz@...aro.org> wrote:
>
> On Tue, Mar 19, 2019 at 10:32 PM <fei.yang@...el.com> wrote:
>   So while this patch does resolve the issues I was seeing with
> mainline kernels and recent changes to adbd, Josh pointed out that it
> wouldn't resolve the issues I was seeing with older kernels which is
> slightly different (but still related to aio usage).
>
> On the older kernels I'm hitting scheduling while atomic on reboot,
> which seems to be due to ffs_aio_cancel() taking a spinlock then
> calling usb_ep_dequeue() which might sleep.
>
> It seems a fix for this was tried earlier with d52e4d0c0c428 ("usb:
> gadget: ffs: Fix BUG when userland exits with submitted AIO
> transfers") which was then reverted by a9c859033f6e.
>
> Elsewhere it seems the ffs driver takes effort to drop any locks
> before calling usb_ep_dequeue(), so this seems like that should be
> addressed, but it also seems like recent change to the dwc3 driver has
> been made to avoid sleeping in that path (see fec9095bdef4 ("usb:
> dwc3: gadget: remove wait_end_transfer")), which may be why I'm not
> seeing the problem with mainline (and your patch here, of coarse).
> But that also doesn't clarify if its still a potential issue w/
> non-dwc3 platforms.

Felipe: Given Alan's point, does it make sense to mark the commits
that remove the possible sleep from wait_event_lock_irq() in
dwc3_gadget_ep_dequeue()  for -stable?

Against 4.19.30, the following set manages to cherry-pick cleanly:
git cherry-pick 1a22ec643580626f439c8583edafdcc73798f2fb
git cherry-pick 09fe1f8d7e2f461275b1cdd832f2cfa5e9be346d
git cherry-pick c3acd59014148470dc58519870fbc779785b4bf7
git cherry-pick 7746a8dfb3f9c91b3a0b63a1d5c2664410e6498d
git cherry-pick d5443bbf5fc8f8389cce146b1fc2987cdd229d12
git cherry-pick d4f1afe5e896c18ae01099a85dab5e1a198bd2a8
git cherry-pick fec9095bdef4e7c988adb603d0d4f92ee735d4a1
# To get things building, revert modified -stable fix
git revert 25ad17d
#pick actual upstream fix replacing the previous
git cherry-pick bd6742249b9ca918565e4e3abaa06665e587f4b5

(Though I'm always a bit hesitant with -stable backports on subsystems
I don't know well. So I'm not sure if this set is fully correct.)

This set seems to avoid the crash on reboot I was seeing.

And of course, I'm sure getting that set backported to 4.14 and 4.9
(and maybe even 4.4, I need to check) will be less clean.

thanks
-john