linux-kernel - Re: [PATCH] usb: gadget: f_ecm: Fix ecm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKzKK0q4aioOOYZyXVp1-GTcQFaU036YoecKzvVCRPjeUAyNKA@mail.gmail.com>
Date: Thu, 4 Sep 2025 13:49:28 +0800
From: Kuen-Han Tsai <khtsai@...gle.com>
To: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
Cc: gregkh@...uxfoundation.org, prashanth.k@....qualcomm.com, 
	Thinh.Nguyen@...opsys.com, s.hauer@...gutronix.de, linux-usb@...r.kernel.org, 
	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [PATCH] usb: gadget: f_ecm: Fix ecm_opts->bound logic in bind path

Hi Krzysztof,

On Wed, Sep 3, 2025 at 4:33 PM Krzysztof Kozlowski
<krzysztof.kozlowski@...aro.org> wrote:
>
> On 03/09/2025 10:30, Kuen-Han Tsai wrote:
> > The bound flag in ecm_opts is being set to true even if
> > gether_register_netdev() failed.
> >
> > Set ecm_opts->bound to true only upon success.
> >
> > Fixes: d65e6b6e884a ("usb: gadget: f_ecm: Always set current gadget in ecm_bind()")
> > Cc: stable@...nel.org
> > Signed-off-by: Kuen-Han Tsai <khtsai@...gle.com>
> > ---
> >  drivers/usb/gadget/function/f_ecm.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
> > index 027226325039..9f5ed6f32a62 100644
> > --- a/drivers/usb/gadget/function/f_ecm.c
> > +++ b/drivers/usb/gadget/function/f_ecm.c
> > @@ -690,13 +690,14 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
> >
> >       if (!ecm_opts->bound) {
> >               status = gether_register_netdev(ecm_opts->net);
> > -             ecm_opts->bound = true;
> >       }
> >
> >       mutex_unlock(&ecm_opts->lock);
> >       if (status)
> >               return status;
> >
> > +     ecm_opts->bound = true;
>
> Now it is outside of mutex, so this is raising questions you should have
> answered in commit msg.
>

Thanks for the review.

1. Commit da92801c647c ("usb: gadget: f_ecm: add configfs support")
introduced a mutex_lock in the ecm_bind function, but this lock did
not protect the ecm_opts->bound flag. Subsequently, commit
d65e6b6e884a ("usb: gadget: f_ecm: Always set current gadget in
ecm_bind()") moved the status check outside the locked section but
neglected to also move the assignment for ecm_opts->bound.
2. The caller, configfs_composite_bind(), binds functions
sequentially, which prevents race conditions when accessing
ecm_opts->bound.

I will update the commit message and submit a new version shortly.

Regards,
Kuen-Han