From: Shuah Khan <skhan@linuxfoundation.org>
To: Johan Hovold <johan@kernel.org>
Cc: valentina.manea.m@gmail.com, shuah@kernel.org,
gregkh@linuxfoundation.org, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org,
syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com,
Shuah Khan <skhan@linuxfoundation.org>
Subject: Re: [PATCH] usbip: fix vhci races in connection tear down
Date: Fri, 12 Mar 2021 11:43:02 -0700 [thread overview]
Message-ID: <3d2c0b3b-07fb-8f59-d7b4-81d7d992636c@linuxfoundation.org> (raw)
In-Reply-To: <YEtGMMjOg3pHTSma@hovoldconsulting.com>
On 3/12/21 3:45 AM, Johan Hovold wrote:
> On Thu, Mar 11, 2021 at 07:27:37PM -0700, Shuah Khan wrote:
>> vhci_shutdown_connection() references connection state (tcp_socket,
>> tcp_rx, tcp_tx, sockfd) saved in usbpip_device without holding the
>> lock.
>>
>> Current connection tear down sequence:
>> Step 1: shutdown the socket
>> Step 2: stop rx thread and reset tcp_rx pointer
>> Step 3: stop tx thread and reset tcp_tx pointer
>> Step 4: Reset tcp_socket and sockfd
>>
>> There are several race windows between these steps. In addition, device
>> reset routine (vhci_device_reset) resets tcp_socket and sockfd holding
>> the lock.
>>
>> Fix these races:
>> - Introduce in_disconnect flag to ensure vhci_shutdown_connection() runs
>> only once.
>> - Change attach_store() to initialize in_disconnect to false while
>> initializing connection status (tcp_socket, tcp_rx, tcp_tx, sockfd)
>> - Change vhci_shutdown_connection() to check in_disconnect and bail
>> out if disconnect is in progress.
>> - Change vhci_shutdown_connection() to
>> -- hold lock to save connection state pointers and unlock.
>> -- Shutdown the socket and stop threads.
>> -- Hold lock to clear connection status and in_disconnect flag.
>> - Change vhci_device_reset() to reset tcp_socket and sockfd.
>> if !in_disconnect
>>
>> Tested syzbot and the reproducer did not trigger any issue.
>>
>> Reported-and-tested-by: syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com
>> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
>> ---
>> drivers/usb/usbip/usbip_common.h | 1 +
>> drivers/usb/usbip/vhci_hcd.c | 55 +++++++++++++++++++++++---------
>> drivers/usb/usbip/vhci_sysfs.c | 4 +++
>> 3 files changed, 45 insertions(+), 15 deletions(-)
>
>> diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
>> index 3209b5ddd30c..c1917efe5737 100644
>> --- a/drivers/usb/usbip/vhci_hcd.c
>> +++ b/drivers/usb/usbip/vhci_hcd.c
>> @@ -1007,31 +1007,54 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
>> static void vhci_shutdown_connection(struct usbip_device *ud)
>> {
>> struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);
>> + unsigned long flags;
>> + struct socket *socket;
>> + struct task_struct *tcp_rx = NULL;
>> + struct task_struct *tcp_tx = NULL;
>> + int sockfd = 0;
>> +
>> + spin_lock_irqsave(&ud->lock, flags);
>> + if (vdev->ud.in_disconnect) {
>> + pr_info("%s: Disconnect in progress for sockfd %d\n",
>> + __func__, ud->sockfd);
>
> Looks like you forgot to remove all you debug printks like this one
> before submitting.
>
Some printks were already in there and helped with debug. Yes I added
a few more when I submitted for syzbot testing.
I will clean them up i v2.
thanks,
-- Shuah
next prev parent reply other threads:[~2021-03-12 18:44 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-12 2:27 [PATCH] usbip: fix vhci races in connection tear down Shuah Khan
2021-03-12 10:45 ` Johan Hovold
2021-03-12 18:43 ` Shuah Khan [this message]
[not found] ` <20210312070806.383-1-hdanton@sina.com>
2021-03-12 20:42 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3d2c0b3b-07fb-8f59-d7b4-81d7d992636c@linuxfoundation.org \
--to=skhan@linuxfoundation.org \
--cc=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=shuah@kernel.org \
--cc=syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com \
--cc=valentina.manea.m@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).