linux-kernel - Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2023040541-gladly-refold-38a6@gregkh>
Date:   Wed, 5 Apr 2023 19:15:17 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Badhri Jagan Sridharan <badhri@...gle.com>
Cc:     stern@...land.harvard.edu, colin.i.king@...il.com,
        xuetao09@...wei.com, quic_eserrao@...cinc.com,
        water.zhangjiantao@...wei.com, peter.chen@...escale.com,
        balbi@...com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect
 only when started

On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
> usb_udc_connect_control does not check to see if the udc
> has already been started. This causes gadget->ops->pullup
> to be called through usb_gadget_connect when invoked
> from usb_udc_vbus_handler even before usb_gadget_udc_start
> is called. Guard this by checking for udc->started in
> usb_udc_connect_control before invoking usb_gadget_connect.
> 
> Guarding udc_connect_control, udc->started and udc->vbus
> with its own mutex as usb_udc_connect_control_locked
> can be simulataneously invoked from different code paths.

You have a full 72 columns, please use them all :)

> 
> Cc: stable@...r.kernel.org
> 
> Signed-off-by: Badhri Jagan Sridharan <badhri@...gle.com>
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")

No blank line after cc: stable, and put the fixes above your
signed-off-by line please.

> ---
>  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> index 3dcbba739db6..890f92cb6344 100644
> --- a/drivers/usb/gadget/udc/core.c
> +++ b/drivers/usb/gadget/udc/core.c
> @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
>  /* Protects udc_list, udc->driver, driver->is_bound, and related calls */
>  static DEFINE_MUTEX(udc_lock);
>  
> +/* Protects udc->vbus, udc-started and udc_connect_control_locked */
> +static DEFINE_MUTEX(udc_connect_control_lock);

Why a global lock?  Shouldn't this be a per-device lock?


>  /* ------------------------------------------------------------------------- */
>  
>  /**
> @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
>  
>  /* ------------------------------------------------------------------------- */
>  
> -static void usb_udc_connect_control(struct usb_udc *udc)
> +/* Acquire udc_connect_control_lock before calling this function. */
> +static void usb_udc_connect_control_locked(struct usb_udc *udc)
>  {
> -	if (udc->vbus)
> +	if (udc->vbus && udc->started)
>  		usb_gadget_connect(udc->gadget);
>  	else
>  		usb_gadget_disconnect(udc->gadget);
> @@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
>  {
>  	struct usb_udc *udc = gadget->udc;
>  
> +	mutex_lock(&udc_connect_control_lock);
>  	if (udc) {
>  		udc->vbus = status;
> -		usb_udc_connect_control(udc);
> +		usb_udc_connect_control_locked(udc);
>  	}
> +	mutex_unlock(&udc_connect_control_lock);
>  }
>  EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
>  
> @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>  {
>  	int ret;
>  
> +	mutex_lock(&udc_connect_control_lock);
>  	if (udc->started) {
>  		dev_err(&udc->dev, "UDC had already started\n");
> +		mutex_unlock(&udc_connect_control_lock);
>  		return -EBUSY;
>  	}
>  
>  	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
>  	if (!ret)
>  		udc->started = true;
> +	usb_udc_connect_control_locked(udc);
> +	mutex_unlock(&udc_connect_control_lock);
>  
>  	return ret;
>  }
> @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>   */
>  static inline void usb_gadget_udc_stop(struct usb_udc *udc)
>  {
> +	mutex_lock(&udc_connect_control_lock);
>  	if (!udc->started) {
>  		dev_err(&udc->dev, "UDC had already stopped\n");
> +		mutex_unlock(&udc_connect_control_lock);
>  		return;
>  	}
>  
>  	udc->gadget->ops->udc_stop(udc->gadget);
>  	udc->started = false;
> +	usb_udc_connect_control_locked(udc);
> +	mutex_unlock(&udc_connect_control_lock);
>  }
>  
>  /**
> @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
>  	if (ret)
>  		goto err_start;
>  	usb_gadget_enable_async_callbacks(udc);
> -	usb_udc_connect_control(udc);

Why drop this call here?

thanks,

greg k-h