linux-kernel - [PATCH] usbip: Support error(event) detection in vhci_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 25 Mar 2019 23:23:32 +0900
From:   Suwan Kim <suwan.kim027@...il.com>
To:     shuah@...nel.org, valentina.manea.m@...il.com,
        gregkh@...uxfoundation.org
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        Suwan Kim <suwan.kim027@...il.com>
Subject: [PATCH] usbip: Support error(event) detection in vhci_tx_loop() kernel thread

In the case of stub driver and vudc driver, tx threads have error
(event) detection logic that is usbip_event_happened() and checks
error condition and halts the tx thread if there is an error. However,
vhci_tx_loop() has no error detection logic and there is a possibility
that an error(event) may occur before vhci_tx_loop() is executed.

For example, assume that a driver uses multiple URBs. vhci_rx_loop()
receives a URB and gives the URB to the device driver calling URB
complete function. And URB complete function calls usb_submit_urb()
and vhci_urb_enqueue() which wakes up the tx thread (vhci_tx_loop()).
And there is possible situation that the first URB is successfully
received but receiving second URB fails and the tx thread is scheduled
but not yet executed. In this situation, the tx thread must detect an
error in rx path and terminate itself when it is executed.

Signed-off-by: Suwan Kim <suwan.kim027@...il.com>
---
 drivers/usb/usbip/vhci_tx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
index 9aed15a358b7..004c91aa75ed 100644
--- a/drivers/usb/usbip/vhci_tx.c
+++ b/drivers/usb/usbip/vhci_tx.c
@@ -195,6 +195,9 @@ int vhci_tx_loop(void *data)
 	struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);

 	while (!kthread_should_stop()) {
+		if (usbip_event_happened(ud))
+			break;
+
 		if (vhci_send_cmd_submit(vdev) < 0)
 			break;

-- 
2.20.1