lkml.org 
[lkml]   [2021]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 027/103] USB: xhci: dbc: fix tty registration race
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 880de403777376e50bdf60def359fa50a722006f upstream.

    Make sure to allocate resources before registering the tty device to
    avoid having a racing open() and write() fail to enable rx or
    dereference a NULL pointer when accessing the uninitialised fifo.

    Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
    Cc: stable@vger.kernel.org # 4.16
    Cc: Lu Baolu <baolu.lu@linux.intel.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://lore.kernel.org/r/20211008092547.3996295-4-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/host/xhci-dbgtty.c | 28 +++++++++++++---------------
    1 file changed, 13 insertions(+), 15 deletions(-)

    --- a/drivers/usb/host/xhci-dbgtty.c
    +++ b/drivers/usb/host/xhci-dbgtty.c
    @@ -408,40 +408,38 @@ static int xhci_dbc_tty_register_device(
    return -EBUSY;

    xhci_dbc_tty_init_port(dbc, port);
    - tty_dev = tty_port_register_device(&port->port,
    - dbc_tty_driver, 0, NULL);
    - if (IS_ERR(tty_dev)) {
    - ret = PTR_ERR(tty_dev);
    - goto register_fail;
    - }

    ret = kfifo_alloc(&port->write_fifo, DBC_WRITE_BUF_SIZE, GFP_KERNEL);
    if (ret)
    - goto buf_alloc_fail;
    + goto err_exit_port;

    ret = xhci_dbc_alloc_requests(dbc, BULK_IN, &port->read_pool,
    dbc_read_complete);
    if (ret)
    - goto request_fail;
    + goto err_free_fifo;

    ret = xhci_dbc_alloc_requests(dbc, BULK_OUT, &port->write_pool,
    dbc_write_complete);
    if (ret)
    - goto request_fail;
    + goto err_free_requests;
    +
    + tty_dev = tty_port_register_device(&port->port,
    + dbc_tty_driver, 0, NULL);
    + if (IS_ERR(tty_dev)) {
    + ret = PTR_ERR(tty_dev);
    + goto err_free_requests;
    + }

    port->registered = true;

    return 0;

    -request_fail:
    +err_free_requests:
    xhci_dbc_free_requests(&port->read_pool);
    xhci_dbc_free_requests(&port->write_pool);
    +err_free_fifo:
    kfifo_free(&port->write_fifo);
    -
    -buf_alloc_fail:
    - tty_unregister_device(dbc_tty_driver, 0);
    -
    -register_fail:
    +err_exit_port:
    xhci_dbc_tty_exit_port(port);

    dev_err(dbc->dev, "can't register tty port, err %d\n", ret);

    \
     
     \ /
      Last update: 2021-10-18 15:41    [W:2.721 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site