linux-kernel - Re: [PATCH v4 1/2] usb: gadget: udc: core: Invoke usb_gadget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 May 2023 12:35:57 +0200
From:   Francesco Dolcini <francesco@...cini.it>
To:     Linux regressions mailing list <regressions@...ts.linux.dev>
Cc:     Alistair <alistair@...stair23.me>,
        Badhri Jagan Sridharan <badhri@...gle.com>,
        gregkh@...uxfoundation.org, stern@...land.harvard.edu,
        colin.i.king@...il.com, xuetao09@...wei.com,
        quic_eserrao@...cinc.com, water.zhangjiantao@...wei.com,
        peter.chen@...escale.com, balbi@...com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Francesco Dolcini <francesco@...cini.it>
Subject: Re: [PATCH v4 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect
 only when started

On Wed, May 17, 2023 at 12:23:39PM +0200, Linux regression tracking (Thorsten Leemhuis) wrote:
> [CCing Francesco Dolcini; and the regression list too, as it should be
> in the loop for regressions:
> https://docs.kernel.org/admin-guide/reporting-regressions.html]
> 
> On 16.05.23 14:53, Alistair wrote:
> > On Fri, 2023-04-07 at 03:07 +0000, Badhri Jagan Sridharan wrote:
> >> usb_udc_connect_control does not check to see if the udc has already
> >> been started. This causes gadget->ops->pullup to be called through
> >> usb_gadget_connect when invoked from usb_udc_vbus_handler even before
> >> usb_gadget_udc_start is called. Guard this by checking for udc-
> >>> started
> >> in usb_udc_connect_control before invoking usb_gadget_connect.
> > [...]
> >> Cc: stable@...r.kernel.org
> >> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
> >> Signed-off-by: Badhri Jagan Sridharan <badhri@...gle.com>
> > 
> > This patch causes a kernel hang when trying to boot with the
> > usb/chipidea/udc.c driver.
> > 
> > The call stack below causes the hang:
> > 
> >  - gadget_bind_driver(struct device *dev)
> >     - mutex_lock(&udc->connect_lock);
> >     - usb_gadget_udc_start_locked(struct usb_udc *udc)
> >         - udc->gadget->ops->udc_start(udc->gadget, udc->driver)
> > 
> > At which point we are calling ci_udc_start(..), but with the
> > connect_lock mutex locked.
> > 
> > ci_udc_start() then calls usb_udc_vbus_handler() which tries to lock
> > the connect_lock while it's already locked. Resulting in a kernel hang.
> > 
> > Reverting this patch fixes the hang.
> 
> Not my area of expertise, but I guess it might be the same error as this
> one:
> 
> https://lore.kernel.org/all/ZF4BvgsOyoKxdPFF@francesco-nb.int.toradex.com/
> 
> Francesco sent a revert on Friday, but no reaction from Badhri Jagan
> Sridharan or Greg yet afaics.
> 
> https://lore.kernel.org/all/20230512131435.205464-1-francesco@dolcini.it/

Revert patches were applied and are in linux-next. I expect those to
land in Linus tree with the next pull request from Greg.

Francesco