lkml.org 
[lkml]   [2021]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 23/66] usbip: stub-dev synchronize sysfs code paths
    Date
    From: Shuah Khan <skhan@linuxfoundation.org>

    commit 9dbf34a834563dada91366c2ac266f32ff34641a upstream.

    Fuzzing uncovered race condition between sysfs code paths in usbip
    drivers. Device connect/disconnect code paths initiated through
    sysfs interface are prone to races if disconnect happens during
    connect and vice versa.

    Use sysfs_lock to protect sysfs paths in stub-dev.

    Cc: stable@vger.kernel.org
    Reported-and-tested-by: syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com
    Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
    Link: https://lore.kernel.org/r/2b182f3561b4a065bf3bf6dce3b0e9944ba17b3f.1616807117.git.skhan@linuxfoundation.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/usbip/stub_dev.c | 11 +++++++++--
    1 file changed, 9 insertions(+), 2 deletions(-)

    --- a/drivers/usb/usbip/stub_dev.c
    +++ b/drivers/usb/usbip/stub_dev.c
    @@ -63,6 +63,7 @@ static ssize_t usbip_sockfd_store(struct

    dev_info(dev, "stub up\n");

    + mutex_lock(&sdev->ud.sysfs_lock);
    spin_lock_irq(&sdev->ud.lock);

    if (sdev->ud.status != SDEV_ST_AVAILABLE) {
    @@ -87,13 +88,13 @@ static ssize_t usbip_sockfd_store(struct
    tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
    if (IS_ERR(tcp_rx)) {
    sockfd_put(socket);
    - return -EINVAL;
    + goto unlock_mutex;
    }
    tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
    if (IS_ERR(tcp_tx)) {
    kthread_stop(tcp_rx);
    sockfd_put(socket);
    - return -EINVAL;
    + goto unlock_mutex;
    }

    /* get task structs now */
    @@ -112,6 +113,8 @@ static ssize_t usbip_sockfd_store(struct
    wake_up_process(sdev->ud.tcp_rx);
    wake_up_process(sdev->ud.tcp_tx);

    + mutex_unlock(&sdev->ud.sysfs_lock);
    +
    } else {
    dev_info(dev, "stub down\n");

    @@ -122,6 +125,7 @@ static ssize_t usbip_sockfd_store(struct
    spin_unlock_irq(&sdev->ud.lock);

    usbip_event_add(&sdev->ud, SDEV_EVENT_DOWN);
    + mutex_unlock(&sdev->ud.sysfs_lock);
    }

    return count;
    @@ -130,6 +134,8 @@ sock_err:
    sockfd_put(socket);
    err:
    spin_unlock_irq(&sdev->ud.lock);
    +unlock_mutex:
    + mutex_unlock(&sdev->ud.sysfs_lock);
    return -EINVAL;
    }
    static DEVICE_ATTR_WO(usbip_sockfd);
    @@ -295,6 +301,7 @@ static struct stub_device *stub_device_a
    sdev->ud.side = USBIP_STUB;
    sdev->ud.status = SDEV_ST_AVAILABLE;
    spin_lock_init(&sdev->ud.lock);
    + mutex_init(&sdev->ud.sysfs_lock);
    sdev->ud.tcp_socket = NULL;
    sdev->ud.sockfd = -1;


    \
     
     \ /
      Last update: 2021-04-12 11:11    [W:3.512 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site