From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [1/3] rio500: refuse more than one device at a time From: Alan Stern Message-Id: Date: Tue, 30 Apr 2019 10:47:26 -0400 (EDT) To: Oliver Neukum Cc: gregKH@linuxfoundation.org, miquel@df.uba.ar, linux-usb@vger.kernel.org List-ID: T24gVHVlLCAzMCBBcHIgMjAxOSwgT2xpdmVyIE5ldWt1bSB3cm90ZToKCj4gVGhpcyBkcml2ZXIg aXMgdXNpbmcgYSBnbG9iYWwgdmFyaWFibGUuIEl0IGNhbm5vdCBoYW5kbGUgbW9yZSB0aGFuCj4g b25lIGRldmljZSBhdCBhIHRpbWUuIFRoZSBpc3N1ZSBoYXMgYmVlbiBleGlzeWluZyBzaW5jZSB0 aGUgZGF3bgoKcy9leGlzeWluZy9leGlzdGluZy8KCj4gb2YgdGhlIGRyaXZlci4KPiAKPiBTaWdu ZWQtb2ZmLWJ5OiBPbGl2ZXIgTmV1a3VtIDxvbmV1a3VtQHN1c2UuY29tPgo+IFJlcG9ydGVkLWJ5 OiBzeXpib3QrMzVmMDRkMTM2ZmM5NzVhNzBkYTRAc3l6a2FsbGVyLmFwcHNwb3RtYWlsLmNvbQo+ IC0tLQo+ICBkcml2ZXJzL3VzYi9taXNjL3JpbzUwMC5jIHwgNyArKysrKystCj4gIDEgZmlsZSBj aGFuZ2VkLCA2IGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKPiAKPiBkaWZmIC0tZ2l0IGEv ZHJpdmVycy91c2IvbWlzYy9yaW81MDAuYyBiL2RyaXZlcnMvdXNiL21pc2MvcmlvNTAwLmMKPiBp bmRleCAxM2U0ODg5YmMzNGYuLmE0YjZmYmVhOTc1ZiAxMDA2NDQKPiAtLS0gYS9kcml2ZXJzL3Vz Yi9taXNjL3JpbzUwMC5jCj4gKysrIGIvZHJpdmVycy91c2IvbWlzYy9yaW81MDAuYwo+IEBAIC00 NDksNyArNDQ5LDEyIEBAIHN0YXRpYyBpbnQgcHJvYmVfcmlvKHN0cnVjdCB1c2JfaW50ZXJmYWNl ICppbnRmLAo+ICAJc3RydWN0IHJpb191c2JfZGF0YSAqcmlvID0gJnJpb19pbnN0YW5jZTsKPiAg CWludCByZXR2YWw7Cj4gIAo+IC0JZGV2X2luZm8oJmludGYtPmRldiwgIlVTQiBSaW8gZm91bmQg YXQgYWRkcmVzcyAlZFxuIiwgZGV2LT5kZXZudW0pOwo+ICsJaWYgKHJpby0+cHJlc2VudCkgewo+ ICsJCWRldl9pbmZvKCZpbnRmLT5kZXYsICJTZWNvbmQgVVNCIFJpbyBhdCBhZGRyZXNzICVkIHJl ZnVzZWRcbiIsIGRldi0+ZGV2bnVtKTsKPiArCQlyZXR1cm4gLUVCVVNZOwo+ICsJfSBlbHNlIHsK PiArCQlkZXZfaW5mbygmaW50Zi0+ZGV2LCAiVVNCIFJpbyBmb3VuZCBhdCBhZGRyZXNzICVkXG4i LCBkZXYtPmRldm51bSk7Cj4gKwl9CgpUaGlzIHdpbGwgcmFjZSBpZiBtb3JlIHRoYW4gb25lIFJp byBpcyBwcm9iZWQgYXQgdGhlIHNhbWUgdGltZS4gIFlvdSAKc2hvdWxkIGhvbGQgdGhlIHJpbzUw MF9tdXRleCB0aHJvdWdob3V0IHRoaXMgcm91dGluZS4KCkFsYW4gU3Rlcm4K From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D87DC43219 for ; Tue, 30 Apr 2019 14:47:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6444F2147A for ; Tue, 30 Apr 2019 14:47:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726229AbfD3Or1 (ORCPT ); Tue, 30 Apr 2019 10:47:27 -0400 Received: from iolanthe.rowland.org ([192.131.102.54]:35592 "HELO iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1726053AbfD3Or1 (ORCPT ); Tue, 30 Apr 2019 10:47:27 -0400 Received: (qmail 3188 invoked by uid 2102); 30 Apr 2019 10:47:26 -0400 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 30 Apr 2019 10:47:26 -0400 Date: Tue, 30 Apr 2019 10:47:26 -0400 (EDT) From: Alan Stern X-X-Sender: stern@iolanthe.rowland.org To: Oliver Neukum cc: gregKH@linuxfoundation.org, , Subject: Re: [PATCH 1/3] rio500: refuse more than one device at a time In-Reply-To: <20190430142326.25815-1-oneukum@suse.com> Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Message-ID: <20190430144726.D9CCrys3nget0TVVwM71cCc9nzuK_8oMstigujRzvV8@z> On Tue, 30 Apr 2019, Oliver Neukum wrote: > This driver is using a global variable. It cannot handle more than > one device at a time. The issue has been exisying since the dawn s/exisying/existing/ > of the driver. > > Signed-off-by: Oliver Neukum > Reported-by: syzbot+35f04d136fc975a70da4@syzkaller.appspotmail.com > --- > drivers/usb/misc/rio500.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c > index 13e4889bc34f..a4b6fbea975f 100644 > --- a/drivers/usb/misc/rio500.c > +++ b/drivers/usb/misc/rio500.c > @@ -449,7 +449,12 @@ static int probe_rio(struct usb_interface *intf, > struct rio_usb_data *rio = &rio_instance; > int retval; > > - dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum); > + if (rio->present) { > + dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum); > + return -EBUSY; > + } else { > + dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum); > + } This will race if more than one Rio is probed at the same time. You should hold the rio500_mutex throughout this routine. Alan Stern