lkml.org 
[lkml]   [2017]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 08/56] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ajay Kaher <ajay.kaher@samsung.com>

    commit 2f86a96be0ccb1302b7eee7855dbee5ce4dc5dfb upstream.

    There is race condition when two USB class drivers try to call
    init_usb_class at the same time and leads to crash.
    code path: probe->usb_register_dev->init_usb_class

    To solve this, mutex locking has been added in init_usb_class() and
    destroy_usb_class().

    As pointed by Alan, removed "if (usb_class)" test from destroy_usb_class()
    because usb_class can never be NULL there.

    Signed-off-by: Ajay Kaher <ajay.kaher@samsung.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/core/file.c | 9 +++++++--
    1 file changed, 7 insertions(+), 2 deletions(-)

    --- a/drivers/usb/core/file.c
    +++ b/drivers/usb/core/file.c
    @@ -26,6 +26,7 @@
    #define MAX_USB_MINORS 256
    static const struct file_operations *usb_minors[MAX_USB_MINORS];
    static DECLARE_RWSEM(minor_rwsem);
    +static DEFINE_MUTEX(init_usb_class_mutex);

    static int usb_open(struct inode *inode, struct file *file)
    {
    @@ -108,8 +109,9 @@ static void release_usb_class(struct kre

    static void destroy_usb_class(void)
    {
    - if (usb_class)
    - kref_put(&usb_class->kref, release_usb_class);
    + mutex_lock(&init_usb_class_mutex);
    + kref_put(&usb_class->kref, release_usb_class);
    + mutex_unlock(&init_usb_class_mutex);
    }

    int usb_major_init(void)
    @@ -171,7 +173,10 @@ int usb_register_dev(struct usb_interfac
    if (intf->minor >= 0)
    return -EADDRINUSE;

    + mutex_lock(&init_usb_class_mutex);
    retval = init_usb_class();
    + mutex_unlock(&init_usb_class_mutex);
    +
    if (retval)
    return retval;


    \
     
     \ /
      Last update: 2017-05-18 13:02    [W:4.059 / U:0.680 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site