Re: [PATCH 0/6] usbip fixes to crashes found by syzbot
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: 2021-03-17 06:22:15
Also in:
lkml
Shuah, this driver is getting more and more cryptic and buggy. Please explain the strategy for serialization before you write patches.
- Fix attach_store() to check usbip_event_happened() before waking up threads.
No, this helps nothing.
quoted hunk ↗ jump to hunk
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c index c4b4256e5dad3..f0a770adebd97 100644 --- a/drivers/usb/usbip/vhci_sysfs.c +++ b/drivers/usb/usbip/vhci_sysfs.c@@ -418,6 +418,15 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, spin_unlock_irqrestore(&vhci->lock, flags); /* end the lock */ + if (usbip_event_happened(&vdev->ud)) { + /* + * something went wrong - event handler shutting + * the connection and doing reset - bail out + */ + dev_err(dev, "Event happended - handler is active\n"); + return -EAGAIN; + } +
detach_store() can queue shutdown event as soon as reaching "/* end the lock */" line but attach_store() might be preempted immediately after verifying that usbip_event_happened() was false (i.e. at this location) in order to wait for shutdown event posted by detach_store() to be processed.
wake_up_process(vdev->ud.tcp_rx); wake_up_process(vdev->ud.tcp_tx);