Re: [PATCH 5.10 044/300] memstick: Add timeout to prevent indefinite waiting
From: Ben Hutchings <hidden>
Date: 2025-12-04 21:45:22
Also in:
linux-patches
On Wed, 2025-12-03 at 16:24 +0100, Greg Kroah-Hartman wrote:
5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiayi Li <redacted> [ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ] Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures.
However, if the card does respond after the timeout, it appears that there can be a data race and UAF of the memstick_dev structure in memstick_next_req() and the callback function. It looks like some (but not all) host drivers implement command timeouts themselves, so perhaps that is where this should actually be fixed. Ben.
quoted hunk ↗ jump to hunk
Signed-off-by: Jiayi Li <redacted> Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn (local) Signed-off-by: Ulf Hansson <redacted> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/memstick/core/memstick.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c index e24ab362e51a9..7b8483f8d6f4f 100644 --- a/drivers/memstick/core/memstick.c +++ b/drivers/memstick/core/memstick.c@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) { card->next_request = h_memstick_set_rw_addr; memstick_new_req(card->host); - wait_for_completion(&card->mrq_complete); + if (!wait_for_completion_timeout(&card->mrq_complete, + msecs_to_jiffies(500))) + card->current_mrq.error = -ETIMEDOUT; return card->current_mrq.error; }@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) card->next_request = h_memstick_read_dev_id; memstick_new_req(host); - wait_for_completion(&card->mrq_complete); + if (!wait_for_completion_timeout(&card->mrq_complete, + msecs_to_jiffies(500))) + card->current_mrq.error = -ETIMEDOUT; if (card->current_mrq.error) goto err_out;
-- Ben Hutchings It is easier to change the specification to fit the program than vice versa.
Attachments
- signature.asc [application/pgp-signature] 833 bytes