Re: [PATCH] hid: usbhid: fix possible deadlock in __usbhid_submit_report

[Oliver Neukum <oneukum@suse.de>]

Am Mittwoch, 25. April 2012, 08:19:32 schrieb Oliver Neukum:
> Am Mittwoch, 25. April 2012, 03:27:19 schrieb Ming Lei:

> > @@ -546,8 +557,13 @@ static void __usbhid_submit_report(struct
> > hid_device *hid, struct hid_report *re
> >  			 * no race because this is called under
> >  			 * spinlock
> >  			 */
> > -			if (time_after(jiffies, usbhid->last_out + HZ * 5))
> > +
> > +			if (time_after(jiffies, usbhid->last_out + HZ * 5) &&
> > +					!usbhid->urbout->unlinked) {
> > +				spin_unlock(&usbhid->lock);
> >  				usb_unlink_urb(usbhid->urbout);
> > +				spin_lock(&usbhid->lock);
> > +			}
> >  		}
> >  		return;
> >  	}
> 
> Same objection. You are just making the race unlikelier. The flag
> needs to be set under a lock you hold while checking time_after().
> We'd be back at the original proposal.

In fact, now that I think about it, we could solve this with splitting
up usb_poison_urb(). We need to increase urb->reject under the
lock and then drop the lock. The only problem is double timeout.

	Regards
		Oliver