From patchwork Thu Sep 19 08:18:12 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151835 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 259FD1745 for ; Thu, 19 Sep 2019 08:18:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 03DD021848 for ; Thu, 19 Sep 2019 08:18:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881122; bh=oYuwwby07dojENNOSRT3Jp1jNTk5yZ2h/LDlYvi7y6M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zU7zVjK+cNR2rWHrxuz0EVGR2RMPqGcJqDYAAHbtIS+Imep46n7P+9TRiyYTzYMoY RoPbWYXcl9YeaIta1DyZ6U9gDJoH/CHwVZwrrXtexSpGuqq1JUG8ObHTULEz+TaB9j G04PlZXfomD+PMxLlfRrJFB0qt0aKl4oM1+WMIQM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387523AbfISISk (ORCPT ); Thu, 19 Sep 2019 04:18:40 -0400 Received: from mail-lj1-f194.google.com ([209.85.208.194]:37591 "EHLO mail-lj1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728879AbfISISk (ORCPT ); Thu, 19 Sep 2019 04:18:40 -0400 Received: by mail-lj1-f194.google.com with SMTP id l21so2654929lje.4; Thu, 19 Sep 2019 01:18:39 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=bdKMehp6wxnbpllEkvXzzRnRrggViXMGu8demEwoja0=; b=s3+xIIjcJ/yKr06fleC5N7Xl+qZPqho+MNGLZplQJ4q3QDY9+VxipGz9JaSb4yEWNz UMEEdswfSwU3luu/XSpyE9oP9rauOg3tcSHRcmBxM9Q+FtM6WT63nFnD9uzxiVXirj82 cRTwgRU4QKW2J86f7qD8CRz9OwK1Pe/BYJjoPVMFrWGMtu0C2X1gJmXCFck3nMywvVOv RqvmlejKi3rDEAxQi9MM14Tiqm6j+DlgkmWwUnC7q/IXw4geR66GAWB4cjZ3R0/dNIWC XJt79+gYf+qlCf8Vwq6cFeW2flFUEQ4uiGKAME/U6rwWibYpOgJuy7i7DqU1xse/Go+v +Heg== X-Gm-Message-State: APjAAAWKv/Lx9zN8RatHISx5cKY+iIGja4VWR3Wwaj8aohLMfp2GM1/i 1V/z4jFvj/1LodAVaO3fCws= X-Google-Smtp-Source: APXvYqzmEAZneyg861HpgqHOF2chTtJL7HveCo6ZXfOB8sYWTcdkQdNk3BPX32Ow62y5lFpj1RAkbw== X-Received: by 2002:a05:651c:1102:: with SMTP id d2mr4043271ljo.74.1568881118454; Thu, 19 Sep 2019 01:18:38 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id h10sm1473716ljb.14.2019.09.19.01.18.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:18:37 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iAre8-0007vY-M7; Thu, 19 Sep 2019 10:18:36 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Johan Hovold , stable Subject: [PATCH 1/4] USB: legousbtower: fix slab info leak at probe Date: Thu, 19 Sep 2019 10:18:12 +0200 Message-Id: <20190919081815.30422-2-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919081815.30422-1-johan@kernel.org> References: <20190919081815.30422-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Make sure to check for short transfers when retrieving the version information at probe to avoid leaking uninitialised slab data when logging it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 006cf13b2199..1db07d4dc738 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -891,8 +891,10 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device get_version_reply, sizeof(*get_version_reply), 1000); - if (result < 0) { - dev_err(idev, "LEGO USB Tower get version control request failed\n"); + if (result < sizeof(*get_version_reply)) { + if (result >= 0) + result = -EIO; + dev_err(idev, "get version request failed: %d\n", result); retval = result; goto error; } From patchwork Thu Sep 19 08:18:13 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151837 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8CDC1197C for ; Thu, 19 Sep 2019 08:18:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6BAB021927 for ; Thu, 19 Sep 2019 08:18:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881122; bh=V8ucxWU19i46/+RgdQ0wHBSVIF44aw1YWfhNeyrdVJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hhkco+F4UNxAYT4TBke12rNX5r16IalWsC2EOXh5X5SrWFjwlU/vFyGkae+854cxo NetBOwhPQzu/68n0VE6EgEkvK/KH3Zn6QZLBvtf0j0RAoy/OCysh6OXIUdt17y85jb QS4wIBgRWvkmlMdErRcL+JoTQHeVAmlSseScc/e0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387781AbfISISl (ORCPT ); Thu, 19 Sep 2019 04:18:41 -0400 Received: from mail-lf1-f66.google.com ([209.85.167.66]:35763 "EHLO mail-lf1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731438AbfISISl (ORCPT ); Thu, 19 Sep 2019 04:18:41 -0400 Received: by mail-lf1-f66.google.com with SMTP id w6so1692353lfl.2; Thu, 19 Sep 2019 01:18:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=41PvRhGRLq0dlBM5WD0KyQTd8CspilI9BYvqI9ESeqY=; b=jaqaea8pq2YMLXDsgitliBYKlTEp/SWDVlmYSqytEsc+hO7zqyvXonJEewOjy1eZUG py0DSw49E4iWG79ogZPOOcorQN+oKZ50eQCOxgsC1lHgzP/z2HBfjgLJa9F3H1nJX/hY Zy8hLhWgNNEuZPHYOy5a9ADDRtb0EeB4MS4cYVmu6YJAx3aCsi6vO55tQiRXgimjI7Uc uR+3wR9IGfLgFUa8+kqQQk3BVExkqRi0v4Pwzms2o+dZ7Qh6SqZ7m4BKo7E72qXJc6Gh MHi5jCLP0QsesanVWj5H6FZXXf7yt50gO4AVGPqsCeOsWE2q6F9a0b9Mo5OoIvdkwADR rg6w== X-Gm-Message-State: APjAAAXouppEVfHobCmL9SXdsnJqLVoQj03q18Ig9UAYkZTiByKrEN2u JyhHF9bzh7FtfLR0RzXB57WJvJ5+ X-Google-Smtp-Source: APXvYqwvgUFbUYoSP+QmdWnjtl75JNe+swZCRFGtaUYhuavjY6QqsYGv4d+kSblLOLjALHSSExtNNw== X-Received: by 2002:ac2:52a9:: with SMTP id r9mr4233821lfm.172.1568881119509; Thu, 19 Sep 2019 01:18:39 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id b63sm1481804ljf.38.2019.09.19.01.18.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:18:37 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iAre8-0007vd-Oy; Thu, 19 Sep 2019 10:18:36 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Johan Hovold , stable , syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com Subject: [PATCH 2/4] USB: legousbtower: fix deadlock on disconnect Date: Thu, 19 Sep 2019 10:18:13 +0200 Message-Id: <20190919081815.30422-3-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919081815.30422-1-johan@kernel.org> References: <20190919081815.30422-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Fix a potential deadlock if disconnect races with open. Since commit d4ead16f50f9 ("USB: prevent char device open/deregister race") core holds an rw-semaphore while open is called and when releasing the minor number during deregistration. This can lead to an ABBA deadlock if a driver takes a lock in open which it also holds during deregistration. This effectively reverts commit 78663ecc344b ("USB: disconnect open race in legousbtower") which needlessly introduced this issue after a generic fix for this race had been added to core by commit d4ead16f50f9 ("USB: prevent char device open/deregister race"). Fixes: 78663ecc344b ("USB: disconnect open race in legousbtower") Cc: stable # 2.6.24 Reported-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com Tested-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 1db07d4dc738..773e4188f336 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -179,7 +179,6 @@ static const struct usb_device_id tower_table[] = { }; MODULE_DEVICE_TABLE (usb, tower_table); -static DEFINE_MUTEX(open_disc_mutex); #define LEGO_USB_TOWER_MINOR_BASE 160 @@ -332,18 +331,14 @@ static int tower_open (struct inode *inode, struct file *file) goto exit; } - mutex_lock(&open_disc_mutex); dev = usb_get_intfdata(interface); - if (!dev) { - mutex_unlock(&open_disc_mutex); retval = -ENODEV; goto exit; } /* lock this device */ if (mutex_lock_interruptible(&dev->lock)) { - mutex_unlock(&open_disc_mutex); retval = -ERESTARTSYS; goto exit; } @@ -351,12 +346,10 @@ static int tower_open (struct inode *inode, struct file *file) /* allow opening only once */ if (dev->open_count) { - mutex_unlock(&open_disc_mutex); retval = -EBUSY; goto unlock_exit; } dev->open_count = 1; - mutex_unlock(&open_disc_mutex); /* reset the tower */ result = usb_control_msg (dev->udev, @@ -423,10 +416,9 @@ static int tower_release (struct inode *inode, struct file *file) if (dev == NULL) { retval = -ENODEV; - goto exit_nolock; + goto exit; } - mutex_lock(&open_disc_mutex); if (mutex_lock_interruptible(&dev->lock)) { retval = -ERESTARTSYS; goto exit; @@ -456,10 +448,7 @@ static int tower_release (struct inode *inode, struct file *file) unlock_exit: mutex_unlock(&dev->lock); - exit: - mutex_unlock(&open_disc_mutex); -exit_nolock: return retval; } @@ -912,7 +901,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device if (retval) { /* something prevented us from registering this driver */ dev_err(idev, "Not able to get a minor for this device.\n"); - usb_set_intfdata (interface, NULL); goto error; } dev->minor = interface->minor; @@ -944,16 +932,13 @@ static void tower_disconnect (struct usb_interface *interface) int minor; dev = usb_get_intfdata (interface); - mutex_lock(&open_disc_mutex); - usb_set_intfdata (interface, NULL); minor = dev->minor; - /* give back our minor */ + /* give back our minor and prevent further open() */ usb_deregister_dev (interface, &tower_class); mutex_lock(&dev->lock); - mutex_unlock(&open_disc_mutex); /* if the device is not opened, then we clean up right now */ if (!dev->open_count) { From patchwork Thu Sep 19 08:18:14 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151843 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1AF2116B1 for ; Thu, 19 Sep 2019 08:18:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EE0F221907 for ; Thu, 19 Sep 2019 08:18:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881125; bh=89YVnPWhEUyNKnlCRSOysn9t6rPLNOrwjH5hCorPYSs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hUTqvj145mYxshhVtq7razPsbVKbfOUIBmLiXXYqZFycQx1H57L7pdL5eXd1pp+LQ NiCLJDdOnr3n8luKUT8JLYwR3ast5vJ5bGLlY0o9w9aVJNuwQyo0aElvEsoxYr8uWO 2aqdzaoHqvyPbGsKZEpBC/7kcjSYlaQz9ufCSVno= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387911AbfISISn (ORCPT ); Thu, 19 Sep 2019 04:18:43 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:37593 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387581AbfISISn (ORCPT ); Thu, 19 Sep 2019 04:18:43 -0400 Received: by mail-lj1-f196.google.com with SMTP id l21so2654950lje.4; Thu, 19 Sep 2019 01:18:39 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=gOw3dGTcmm1iVIPl96Li1eNYVJdVoD8Cu2D+Apy5uOg=; b=Sp2qkjnMRrLkDlwRNIpk93U/EXHfN2UvnOilnFjVBfuVRCzqL8zV2M7Wi226v7bs/3 8kgu1duRykp9N7eUHI1A3YFuqxcOTXF8vEfDwPrJhN4NEv6LNST4kmjBqX5dXmn6UXfK L9If+xOwYn+O3K4kS1p+iHe3y+AMbQ1k46atz10Pg05JGBFNoPsi46sNh93zWx0s1ydT 82PZEQq9YIFaVNUehOEarAwoDoGijwXS7p2krHhM7fka9OfSlKQ9thv4g/WXeUHQgYMb WgS+vmQwlh7OF7cUizqS9uMTlP1YlV79t1+5Y/DQuhfHeads1wOEzl786SF7cu8jzqiV eBCw== X-Gm-Message-State: APjAAAUvHT//llhZbMIOXwGa52/j5uWG7Ml8ALK/nXSong+0hzb4TMlv RTXpt9mu4hmKwvR2az93KIA= X-Google-Smtp-Source: APXvYqyl9IBLYWk7cwMlWNYx+QovpnWMo+tlIMGgaAy3T26qh2BG6+Pq5zb4+dR2N/mcN8WzHvF8Gg== X-Received: by 2002:a2e:9586:: with SMTP id w6mr4409130ljh.47.1568881118946; Thu, 19 Sep 2019 01:18:38 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id r75sm1419504lff.7.2019.09.19.01.18.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:18:37 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iAre8-0007vj-RR; Thu, 19 Sep 2019 10:18:36 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Johan Hovold , stable Subject: [PATCH 3/4] USB: legousbtower: fix potential NULL-deref on disconnect Date: Thu, 19 Sep 2019 10:18:14 +0200 Message-Id: <20190919081815.30422-4-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919081815.30422-1-johan@kernel.org> References: <20190919081815.30422-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver is using its struct usb_device pointer as an inverted disconnected flag, but was setting it to NULL before making sure all completion handlers had run. This could lead to a NULL-pointer dereference in a number of dev_dbg and dev_err statements in the completion handlers which relies on said pointer. Fix this by unconditionally stopping all I/O and preventing resubmissions by poisoning the interrupt URBs at disconnect and using a dedicated disconnected flag. This also makes sure that all I/O has completed by the time the disconnect callback returns. Fixes: 9d974b2a06e3 ("USB: legousbtower.c: remove err() usage") Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") Fixes: 4dae99638097 ("USB: legotower: remove custom debug macro and module parameter") Cc: stable # 3.5 Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 773e4188f336..4fa999882635 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -190,6 +190,7 @@ struct lego_usb_tower { unsigned char minor; /* the starting minor number for this device */ int open_count; /* number of times this port has been opened */ + unsigned long disconnected:1; char* read_buffer; size_t read_buffer_length; /* this much came in */ @@ -289,8 +290,6 @@ static inline void lego_usb_tower_debug_data(struct device *dev, */ static inline void tower_delete (struct lego_usb_tower *dev) { - tower_abort_transfers (dev); - /* free data structures */ usb_free_urb(dev->interrupt_in_urb); usb_free_urb(dev->interrupt_out_urb); @@ -430,7 +429,8 @@ static int tower_release (struct inode *inode, struct file *file) retval = -ENODEV; goto unlock_exit; } - if (dev->udev == NULL) { + + if (dev->disconnected) { /* the device was unplugged before the file was released */ /* unlock here as tower_delete frees dev */ @@ -466,10 +466,9 @@ static void tower_abort_transfers (struct lego_usb_tower *dev) if (dev->interrupt_in_running) { dev->interrupt_in_running = 0; mb(); - if (dev->udev) - usb_kill_urb (dev->interrupt_in_urb); + usb_kill_urb(dev->interrupt_in_urb); } - if (dev->interrupt_out_busy && dev->udev) + if (dev->interrupt_out_busy) usb_kill_urb(dev->interrupt_out_urb); } @@ -505,7 +504,7 @@ static __poll_t tower_poll (struct file *file, poll_table *wait) dev = file->private_data; - if (!dev->udev) + if (dev->disconnected) return EPOLLERR | EPOLLHUP; poll_wait(file, &dev->read_wait, wait); @@ -552,7 +551,7 @@ static ssize_t tower_read (struct file *file, char __user *buffer, size_t count, } /* verify that the device wasn't unplugged */ - if (dev->udev == NULL) { + if (dev->disconnected) { retval = -ENODEV; pr_err("No device or device unplugged %d\n", retval); goto unlock_exit; @@ -638,7 +637,7 @@ static ssize_t tower_write (struct file *file, const char __user *buffer, size_t } /* verify that the device wasn't unplugged */ - if (dev->udev == NULL) { + if (dev->disconnected) { retval = -ENODEV; pr_err("No device or device unplugged %d\n", retval); goto unlock_exit; @@ -748,7 +747,7 @@ static void tower_interrupt_in_callback (struct urb *urb) resubmit: /* resubmit if we're still running */ - if (dev->interrupt_in_running && dev->udev) { + if (dev->interrupt_in_running) { retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC); if (retval) dev_err(&dev->udev->dev, @@ -813,6 +812,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device dev->udev = udev; dev->open_count = 0; + dev->disconnected = 0; dev->read_buffer = NULL; dev->read_buffer_length = 0; @@ -938,6 +938,10 @@ static void tower_disconnect (struct usb_interface *interface) /* give back our minor and prevent further open() */ usb_deregister_dev (interface, &tower_class); + /* stop I/O */ + usb_poison_urb(dev->interrupt_in_urb); + usb_poison_urb(dev->interrupt_out_urb); + mutex_lock(&dev->lock); /* if the device is not opened, then we clean up right now */ @@ -945,7 +949,7 @@ static void tower_disconnect (struct usb_interface *interface) mutex_unlock(&dev->lock); tower_delete (dev); } else { - dev->udev = NULL; + dev->disconnected = 1; /* wake up pollers */ wake_up_interruptible_all(&dev->read_wait); wake_up_interruptible_all(&dev->write_wait); From patchwork Thu Sep 19 08:18:15 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151841 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A27D216B1 for ; Thu, 19 Sep 2019 08:18:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7FC3E21907 for ; Thu, 19 Sep 2019 08:18:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881123; bh=lA5k1Dl2Ev2JsmOdLnJ+FP+W8l4kO+ee0hsRG29dJMI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=TXwuw7FrQC6N3YHoXyP+hfHgnX6qWFJ8/yT2U5Xh/w6cQVdmkiBdHbwVn7Pca2QY4 sZ5PFStJsXBG69/AXK23zKqbiG3pwmuIH2D6j3wryzJyY876P0r2/BShtVg5B8o42j z0LAjgOerme6T/6dNUC/HdkgZl9ZKBiiY6j2plDM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387857AbfISISm (ORCPT ); Thu, 19 Sep 2019 04:18:42 -0400 Received: from mail-lj1-f194.google.com ([209.85.208.194]:42416 "EHLO mail-lj1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731572AbfISISm (ORCPT ); Thu, 19 Sep 2019 04:18:42 -0400 Received: by mail-lj1-f194.google.com with SMTP id y23so2622801lje.9 for ; Thu, 19 Sep 2019 01:18:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=l086OEt/YmCp6+Ee4uju9cxpl1kQU9buLbBxRXPBhrY=; b=PZbL0YU3p0UNy3Yid8fpnoGXd4l6sQ/api+YNoIosbZ0PV9JprAryZY7Q2XSTlveHk fUWFbqyZ7Wp9t8BDOdMqUMOG4TYpigT6310W5P4ex8WS4GyygYxJe5VfDXk8tUaMFNTw QHXSf8scgJuZZM7t9qoXlnsnTIOJhmiq4lMmBQNGGJ+uExY+7Xf/ZH39uHkaJ1mLd7lK SUJiObn4veB2I3AmvyrLevbyjS83xj+t3perKRpfEf+bSKoVD8p7QXkIqfH74JG16H0p wv9isi+Hjrd8nQWLgyHQhHzsX8a0Lv8MSuUyHFKfiUTOouoOIvkuMQmuKqMO0He6dq+L t2gg== X-Gm-Message-State: APjAAAXUNoiCULIcThcmPyg7rSR/KxVOZtVGoMrmt4UcjXfC+VGviJEy Q53SoWyXvvy3otzAOj8n+vU= X-Google-Smtp-Source: APXvYqyJBfSZH1pjJ+SiSIykFl6LL9gVt37ixkc3rfHGrP7gar6NEb4Qf+/Y/4OEoXquTQEWH5caAQ== X-Received: by 2002:a2e:810e:: with SMTP id d14mr4740962ljg.160.1568881119971; Thu, 19 Sep 2019 01:18:39 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id q13sm1415116lfk.51.2019.09.19.01.18.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:18:37 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iAre8-0007vn-Ue; Thu, 19 Sep 2019 10:18:36 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Johan Hovold Subject: [PATCH 4/4] USB: legousbtower: fix open after failed reset request Date: Thu, 19 Sep 2019 10:18:15 +0200 Message-Id: <20190919081815.30422-5-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919081815.30422-1-johan@kernel.org> References: <20190919081815.30422-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver would return with a nonzero open count in case the reset control request failed. This would prevent any further attempts to open the char dev until the device was disconnected. Fix this by incrementing the open count only on successful open. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 4fa999882635..44d6a3381804 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -348,7 +348,6 @@ static int tower_open (struct inode *inode, struct file *file) retval = -EBUSY; goto unlock_exit; } - dev->open_count = 1; /* reset the tower */ result = usb_control_msg (dev->udev, @@ -388,13 +387,14 @@ static int tower_open (struct inode *inode, struct file *file) dev_err(&dev->udev->dev, "Couldn't submit interrupt_in_urb %d\n", retval); dev->interrupt_in_running = 0; - dev->open_count = 0; goto unlock_exit; } /* save device in the file's private structure */ file->private_data = dev; + dev->open_count = 1; + unlock_exit: mutex_unlock(&dev->lock);