Messages in this thread | | | Subject | Re: [PATCH] usbip: fix vhci races in connection tear down | From | Shuah Khan <> | Date | Fri, 12 Mar 2021 11:43:02 -0700 |
| |
On 3/12/21 3:45 AM, Johan Hovold wrote: > On Thu, Mar 11, 2021 at 07:27:37PM -0700, Shuah Khan wrote: >> vhci_shutdown_connection() references connection state (tcp_socket, >> tcp_rx, tcp_tx, sockfd) saved in usbpip_device without holding the >> lock. >> >> Current connection tear down sequence: >> Step 1: shutdown the socket >> Step 2: stop rx thread and reset tcp_rx pointer >> Step 3: stop tx thread and reset tcp_tx pointer >> Step 4: Reset tcp_socket and sockfd >> >> There are several race windows between these steps. In addition, device >> reset routine (vhci_device_reset) resets tcp_socket and sockfd holding >> the lock. >> >> Fix these races: >> - Introduce in_disconnect flag to ensure vhci_shutdown_connection() runs >> only once. >> - Change attach_store() to initialize in_disconnect to false while >> initializing connection status (tcp_socket, tcp_rx, tcp_tx, sockfd) >> - Change vhci_shutdown_connection() to check in_disconnect and bail >> out if disconnect is in progress. >> - Change vhci_shutdown_connection() to >> -- hold lock to save connection state pointers and unlock. >> -- Shutdown the socket and stop threads. >> -- Hold lock to clear connection status and in_disconnect flag. >> - Change vhci_device_reset() to reset tcp_socket and sockfd. >> if !in_disconnect >> >> Tested syzbot and the reproducer did not trigger any issue. >> >> Reported-and-tested-by: syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com >> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> >> --- >> drivers/usb/usbip/usbip_common.h | 1 + >> drivers/usb/usbip/vhci_hcd.c | 55 +++++++++++++++++++++++--------- >> drivers/usb/usbip/vhci_sysfs.c | 4 +++ >> 3 files changed, 45 insertions(+), 15 deletions(-) > >> diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c >> index 3209b5ddd30c..c1917efe5737 100644 >> --- a/drivers/usb/usbip/vhci_hcd.c >> +++ b/drivers/usb/usbip/vhci_hcd.c >> @@ -1007,31 +1007,54 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev) >> static void vhci_shutdown_connection(struct usbip_device *ud) >> { >> struct vhci_device *vdev = container_of(ud, struct vhci_device, ud); >> + unsigned long flags; >> + struct socket *socket; >> + struct task_struct *tcp_rx = NULL; >> + struct task_struct *tcp_tx = NULL; >> + int sockfd = 0; >> + >> + spin_lock_irqsave(&ud->lock, flags); >> + if (vdev->ud.in_disconnect) { >> + pr_info("%s: Disconnect in progress for sockfd %d\n", >> + __func__, ud->sockfd); > > Looks like you forgot to remove all you debug printks like this one > before submitting. >
Some printks were already in there and helped with debug. Yes I added a few more when I submitted for syzbot testing.
I will clean them up i v2.
thanks, -- Shuah
| |