git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 2f86a96be0ccb1302b7eee7855dbee5ce4dc5dfb Mon Sep 17 00:00:00 2001
   2 From: Ajay Kaher <ajay.kaher@samsung.com>
   3 Date: Tue, 28 Mar 2017 08:09:32 -0400
   4 Subject: USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
   5
   6 From: Ajay Kaher <ajay.kaher@samsung.com>
   7
   8 commit 2f86a96be0ccb1302b7eee7855dbee5ce4dc5dfb upstream.
   9
  10 There is race condition when two USB class drivers try to call
  11 init_usb_class at the same time and leads to crash.
  12 code path: probe->usb_register_dev->init_usb_class
  13
  14 To solve this, mutex locking has been added in init_usb_class() and
  15 destroy_usb_class().
  16
  17 As pointed by Alan, removed "if (usb_class)" test from destroy_usb_class()
  18 because usb_class can never be NULL there.
  19
  20 Signed-off-by: Ajay Kaher <ajay.kaher@samsung.com>
  21 Acked-by: Alan Stern <stern@rowland.harvard.edu>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  drivers/usb/core/file.c |    9 +++++++--
  26  1 file changed, 7 insertions(+), 2 deletions(-)
  27
  28 --- a/drivers/usb/core/file.c
  29 +++ b/drivers/usb/core/file.c
  30 @@ -27,6 +27,7 @@
  31  #define MAX_USB_MINORS 256
  32  static const struct file_operations *usb_minors[MAX_USB_MINORS];
  33  static DECLARE_RWSEM(minor_rwsem);
  34 +static DEFINE_MUTEX(init_usb_class_mutex);
  35
  36  static int usb_open(struct inode *inode, struct file *file)
  37  {
  38 @@ -109,8 +110,9 @@ static void release_usb_class(struct kre
  39
  40  static void destroy_usb_class(void)
  41  {
  42 -       if (usb_class)
  43 -               kref_put(&usb_class->kref, release_usb_class);
  44 +       mutex_lock(&init_usb_class_mutex);
  45 +       kref_put(&usb_class->kref, release_usb_class);
  46 +       mutex_unlock(&init_usb_class_mutex);
  47  }
  48
  49  int usb_major_init(void)
  50 @@ -171,7 +173,10 @@ int usb_register_dev(struct usb_interfac
  51         if (intf->minor >= 0)
  52                 return -EADDRINUSE;
  53
  54 +       mutex_lock(&init_usb_class_mutex);
  55         retval = init_usb_class();
  56 +       mutex_unlock(&init_usb_class_mutex);
  57 +
  58         if (retval)
  59                 return retval;
  60