linux-kernel - Re: [PATCH v8 2/2] usb: gadget: udc: core: Prevent soft_connect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7b1a8de9-3811-4b4b-b85f-9afded0e45d1@rowland.harvard.edu>
Date:   Thu, 8 Jun 2023 21:17:59 -0400
From:   Alan Stern <stern@...land.harvard.edu>
To:     Badhri Jagan Sridharan <badhri@...gle.com>
Cc:     gregkh@...uxfoundation.org, colin.i.king@...il.com,
        xuetao09@...wei.com, quic_eserrao@...cinc.com,
        water.zhangjiantao@...wei.com, francesco@...cini.it,
        alistair@...stair23.me, stephan@...hold.net, bagasdotme@...il.com,
        luca@...tu.xyz, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v8 2/2] usb: gadget: udc: core: Prevent
 soft_connect_store() race

On Fri, Jun 09, 2023 at 01:02:27AM +0000, Badhri Jagan Sridharan wrote:
> usb_udc_connect_control(), soft_connect_store() and
> usb_gadget_deactivate() can potentially race against each other to invoke
> usb_gadget_connect()/usb_gadget_disconnect(). To prevent this, guard
> udc->started, gadget->allow_connect, gadget->deactivate and
> gadget->connect with connect_lock so that ->pullup() is only invoked when
> the gadget is bound, started and not deactivated. The routines
> usb_gadget_connect_locked(), usb_gadget_disconnect_locked(),
> usb_udc_connect_control_locked(), usb_gadget_udc_start_locked(),
> usb_gadget_udc_stop_locked() are called with this lock held.
> 
> An earlier version of this commit was reverted due to the crash reported in
> https://lore.kernel.org/all/ZF4BvgsOyoKxdPFF@francesco-nb.int.toradex.com/.
> commit 16737e78d190 ("usb: gadget: udc: core: Offload usb_udc_vbus_handler processing")
> addresses the crash reported.
> 
> Cc: stable@...r.kernel.org
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
> Signed-off-by: Badhri Jagan Sridharan <badhri@...gle.com>
> ---

Reviewed-by: Alan Stern <stern@...land.harvard.edu>