Commit 9952ff28 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman

USB: serial: fix unthrottle races

commit 3f5edd58 upstream.

Fix two long-standing bugs which could potentially lead to memory
corruption or leave the port throttled until it is reopened (on weakly
ordered systems), respectively, when read-URB completion races with
unthrottle().

First, the URB must not be marked as free before processing is complete
to prevent it from being submitted by unthrottle() on another CPU.

	CPU 1				CPU 2
	================		================
	complete()			unthrottle()
	  process_urb();
	  smp_mb__before_atomic();
	  set_bit(i, free);		  if (test_and_clear_bit(i, free))
	  					  submit_urb();

Second, the URB must be marked as free before checking the throttled
flag to prevent unthrottle() on another CPU from failing to observe that
the URB needs to be submitted if complete() sees that the throttled flag
is set.

	CPU 1				CPU 2
	================		================
	complete()			unthrottle()
	  set_bit(i, free);		  throttled = 0;
	  smp_mb__after_atomic();	  smp_mb();
	  if (throttled)		  if (test_and_clear_bit(i, free))
	  	  return;			  submit_urb();

Note that test_and_clear_bit() only implies barriers when the test is
successful. To handle the case where the URB is still in use an explicit
barrier needs to be added to unthrottle() for the second race condition.

Fixes: d83b4053 ("USB: serial: add support for multiple read urbs")
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6fd04652
...@@ -376,6 +376,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb) ...@@ -376,6 +376,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
struct usb_serial_port *port = urb->context; struct usb_serial_port *port = urb->context;
unsigned char *data = urb->transfer_buffer; unsigned char *data = urb->transfer_buffer;
unsigned long flags; unsigned long flags;
bool stopped = false;
int status = urb->status; int status = urb->status;
int i; int i;
...@@ -383,33 +384,51 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb) ...@@ -383,33 +384,51 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
if (urb == port->read_urbs[i]) if (urb == port->read_urbs[i])
break; break;
} }
set_bit(i, &port->read_urbs_free);
dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i, dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i,
urb->actual_length); urb->actual_length);
switch (status) { switch (status) {
case 0: case 0:
usb_serial_debug_data(&port->dev, __func__, urb->actual_length,
data);
port->serial->type->process_read_urb(urb);
break; break;
case -ENOENT: case -ENOENT:
case -ECONNRESET: case -ECONNRESET:
case -ESHUTDOWN: case -ESHUTDOWN:
dev_dbg(&port->dev, "%s - urb stopped: %d\n", dev_dbg(&port->dev, "%s - urb stopped: %d\n",
__func__, status); __func__, status);
return; stopped = true;
break;
case -EPIPE: case -EPIPE:
dev_err(&port->dev, "%s - urb stopped: %d\n", dev_err(&port->dev, "%s - urb stopped: %d\n",
__func__, status); __func__, status);
return; stopped = true;
break;
default: default:
dev_dbg(&port->dev, "%s - nonzero urb status: %d\n", dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
__func__, status); __func__, status);
goto resubmit; break;
} }
usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data); /*
port->serial->type->process_read_urb(urb); * Make sure URB processing is done before marking as free to avoid
* racing with unthrottle() on another CPU. Matches the barriers
* implied by the test_and_clear_bit() in
* usb_serial_generic_submit_read_urb().
*/
smp_mb__before_atomic();
set_bit(i, &port->read_urbs_free);
/*
* Make sure URB is marked as free before checking the throttled flag
* to avoid racing with unthrottle() on another CPU. Matches the
* smp_mb() in unthrottle().
*/
smp_mb__after_atomic();
if (stopped)
return;
resubmit:
/* Throttle the device if requested by tty */ /* Throttle the device if requested by tty */
spin_lock_irqsave(&port->lock, flags); spin_lock_irqsave(&port->lock, flags);
port->throttled = port->throttle_req; port->throttled = port->throttle_req;
...@@ -484,6 +503,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty) ...@@ -484,6 +503,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
port->throttled = port->throttle_req = 0; port->throttled = port->throttle_req = 0;
spin_unlock_irq(&port->lock); spin_unlock_irq(&port->lock);
/*
* Matches the smp_mb__after_atomic() in
* usb_serial_generic_read_bulk_callback().
*/
smp_mb();
if (was_throttled) if (was_throttled)
usb_serial_generic_submit_read_urbs(port, GFP_KERNEL); usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment