linux-kernel - Re: [PATCH 4.19 093/125] usb: gadget: configfs: fix concurrent issue between composite APIs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191113134935.GA20980@duo.ucw.cz>
Date:   Wed, 13 Nov 2019 14:49:36 +0100
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Peter Chen <peter.chen@....com>,
        Felipe Balbi <felipe.balbi@...ux.intel.com>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.19 093/125] usb: gadget: configfs: fix concurrent issue
 between composite APIs

On Mon 2019-11-11 19:28:52, Greg Kroah-Hartman wrote:
> From: Peter Chen <peter.chen@....com>
> 
> [ Upstream commit 1a1c851bbd706ea9f3a9756c2d3db28523506d3b ]
> 
> We meet several NULL pointer issues if configfs_composite_unbind
> and composite_setup (or composite_disconnect) are running together.
> These issues occur when do the function switch stress test, the
> configfs_compsoite_unbind is called from user mode by
> echo "" to /sys/../UDC entry, and meanwhile, the setup interrupt
> or disconnect interrupt occurs by hardware. The composite_setup

> +++ b/drivers/usb/gadget/configfs.c
> @@ -61,6 +61,8 @@ struct gadget_info {
>  	bool use_os_desc;
>  	char b_vendor_code;
>  	char qw_sign[OS_STRING_QW_SIGN_LEN];
> +	spinlock_t spinlock;
> +	bool unbind;
>  };
>  
>  static inline struct gadget_info *to_gadget_info(struct config_item *item)
> @@ -1244,6 +1246,7 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
>  	int				ret;
>  
>  	/* the gi->lock is hold by the caller */
> +	gi->unbind = 0;
>  	cdev->gadget = gadget;

Since variable is bool, I'd expect "= false" here?

> +	unsigned long flags;
>  
>  	/* the gi->lock is hold by the caller */

"is held".

>  	cdev = get_gadget_data(gadget);
>  	gi = container_of(cdev, struct gadget_info, cdev);
> +	spin_lock_irqsave(&gi->spinlock, flags);
> +	gi->unbind = 1;

= true;

> +static int configfs_composite_setup(struct usb_gadget *gadget,
> +		const struct usb_ctrlrequest *ctrl)
> +{
> +	struct usb_composite_dev *cdev;
> +	struct gadget_info *gi;
> +	unsigned long flags;
> +	int ret;
> +
> +	cdev = get_gadget_data(gadget);
> +	if (!cdev)
> +		return 0;
> +
> +	gi = container_of(cdev, struct gadget_info, cdev);
> +	spin_lock_irqsave(&gi->spinlock, flags);
> +	cdev = get_gadget_data(gadget);

cdev already contains required value, why get it second time? (If it
needs to be done under lock, comment might be useful...)


Best regards,
									Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)