From patchwork Thu Sep 19 08:30:36 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151847 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8EA9576 for ; Thu, 19 Sep 2019 08:30:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6D07221928 for ; Thu, 19 Sep 2019 08:30:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881855; bh=oYuwwby07dojENNOSRT3Jp1jNTk5yZ2h/LDlYvi7y6M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=t6j3Y3/gHSfD2pNboa3mqQcuZrxmIWORZb7PG/IoDegixl1Is0ECane0h1nnx3myD 2ZJReyFmT5PojU0sVWYeAQFNJ8/qnmYlnmUxNr9B9pdKE4M6SqkivTBX25McwGxSXQ JzMUtx8H8rtRE4xZLRcuY9wL5RoGvo4bv7eH4MGs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387581AbfISIaw (ORCPT ); Thu, 19 Sep 2019 04:30:52 -0400 Received: from mail-lf1-f67.google.com ([209.85.167.67]:43302 "EHLO mail-lf1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729969AbfISIaw (ORCPT ); Thu, 19 Sep 2019 04:30:52 -0400 Received: by mail-lf1-f67.google.com with SMTP id u3so1684541lfl.10; Thu, 19 Sep 2019 01:30:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=bdKMehp6wxnbpllEkvXzzRnRrggViXMGu8demEwoja0=; b=VXUSdlE6Ri6ESaoxk3lWITkQ1mVflfbJOxvLcYbfg+C04o0funROPOHCPm68HGr5RS 4/L1Zj+tPESTUzJ4/+q60+B9EeGD2wk43Fb1GLpldDI5KRZ7Vcn/T5IWMVt6/UFSTIC0 fffy6oJWyOU3oNcARq14rNEh48osNxpeABgUd0PYLEvzK6ImHNMAA1s/8OOQc3VyYXbu 3aXss7lf351q3QEHM6GeDMu81x2l2z/70Tzx3ugv/6zFJzkwQLeZ93rrd2UAiV9uJByn W5BrSjWq4DAZMRWa1kYFpZR/yC1+BVgvc21mKhoR3R4AhN+d/7PMz0mbpyeE8qoI9pd/ 0Epg== X-Gm-Message-State: APjAAAU+9uKJRL9/YveLs+MG5BWv499ocHO7SQw4s+31qVsVKl8scFmu cHm1RIC9r8OAGVrvxe38X6WEbNVZ X-Google-Smtp-Source: APXvYqx8Pi193s2urlmZvoqrSodEEIhqZY95aovAzpfgIzGr20GAOQFh2Rr3tb4HcRuNbAgU9buPvw== X-Received: by 2002:a19:14f:: with SMTP id 76mr4231365lfb.92.1568881850702; Thu, 19 Sep 2019 01:30:50 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id y26sm309370ljj.90.2019.09.19.01.30.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:30:49 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iArpx-00083C-LM; Thu, 19 Sep 2019 10:30:49 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Juergen Stuber , legousb-devel@lists.sourceforge.net, Johan Hovold , stable Subject: [PATCH RESEND 1/4] USB: legousbtower: fix slab info leak at probe Date: Thu, 19 Sep 2019 10:30:36 +0200 Message-Id: <20190919083039.30898-2-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919083039.30898-1-johan@kernel.org> References: <20190919083039.30898-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Make sure to check for short transfers when retrieving the version information at probe to avoid leaking uninitialised slab data when logging it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 006cf13b2199..1db07d4dc738 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -891,8 +891,10 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device get_version_reply, sizeof(*get_version_reply), 1000); - if (result < 0) { - dev_err(idev, "LEGO USB Tower get version control request failed\n"); + if (result < sizeof(*get_version_reply)) { + if (result >= 0) + result = -EIO; + dev_err(idev, "get version request failed: %d\n", result); retval = result; goto error; } From patchwork Thu Sep 19 08:30:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151853 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 209F01747 for ; Thu, 19 Sep 2019 08:30:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F3CED21927 for ; Thu, 19 Sep 2019 08:30:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881857; bh=V8ucxWU19i46/+RgdQ0wHBSVIF44aw1YWfhNeyrdVJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=qUP0iJtyPeL+g+UG6IFuLfgaUrC8NoVscenYPZkTqg2fota2tFxpj6rE/bsYKSFgz VQh5bg4v7IuCAxHCvutvrd8rPPhsvJLUGiHiCTD+K7IpdO3M5DW1kz9iZPKPeoEBgY 0xObzB9rs2AEtziOveb9gV/AJrrlFKJSElM2TaAI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388327AbfISIaz (ORCPT ); Thu, 19 Sep 2019 04:30:55 -0400 Received: from mail-lf1-f66.google.com ([209.85.167.66]:42193 "EHLO mail-lf1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730637AbfISIay (ORCPT ); Thu, 19 Sep 2019 04:30:54 -0400 Received: by mail-lf1-f66.google.com with SMTP id c195so1683048lfg.9; Thu, 19 Sep 2019 01:30:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=41PvRhGRLq0dlBM5WD0KyQTd8CspilI9BYvqI9ESeqY=; b=EV/XWoPNnBFyZF+CLg92YWPHQCjqVBO3juEmR1GMIQsGnnXAuySRWYf1yh1Es1oIdA 6x5N4gu1/CkMIk1kcPhwpD05/ZJrYr8/GrXRMw7T90U//w2FpPucsmE5EsEoJZSSMpx7 Z8Jh0ShB9vQ3N/Tvvu6bjE8QRfJRnQYbJuWaulMuS7aQ2TNlO/u5nit/g7/COJUHeTpv v+aiMabGzi6nmGPRoKOXfBBgMbf30d9eW7G9cB5USWCPfKudAlJVHMetBQt7+pLLTf6a vQQ3iB43W28yKJWN5Ocnr2yXjb2IbRbPCGTdAgkqgJifNG974+Uh+Ep9xmC5xth+eDMr ejsA== X-Gm-Message-State: APjAAAWRi/a2OKOzhTpTPe4U9C0SsoeWd4rAbkUprccMVFKWi5r3go4a 8JPRJw2N3BkgwdCRBCe1+7lyhq/O X-Google-Smtp-Source: APXvYqxV9rylGTlck9D/jjAV7I+lDZZq96WtiWxXB1wgGQPeJoPo9UofKLtGw/geHrBVFjklLRESYg== X-Received: by 2002:a19:5515:: with SMTP id n21mr4596570lfe.131.1568881851161; Thu, 19 Sep 2019 01:30:51 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id a23sm1430920lfl.66.2019.09.19.01.30.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:30:49 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iArpx-00083I-Od; Thu, 19 Sep 2019 10:30:49 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Juergen Stuber , legousb-devel@lists.sourceforge.net, Johan Hovold , stable , syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com Subject: [PATCH RESEND 2/4] USB: legousbtower: fix deadlock on disconnect Date: Thu, 19 Sep 2019 10:30:37 +0200 Message-Id: <20190919083039.30898-3-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919083039.30898-1-johan@kernel.org> References: <20190919083039.30898-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Fix a potential deadlock if disconnect races with open. Since commit d4ead16f50f9 ("USB: prevent char device open/deregister race") core holds an rw-semaphore while open is called and when releasing the minor number during deregistration. This can lead to an ABBA deadlock if a driver takes a lock in open which it also holds during deregistration. This effectively reverts commit 78663ecc344b ("USB: disconnect open race in legousbtower") which needlessly introduced this issue after a generic fix for this race had been added to core by commit d4ead16f50f9 ("USB: prevent char device open/deregister race"). Fixes: 78663ecc344b ("USB: disconnect open race in legousbtower") Cc: stable # 2.6.24 Reported-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com Tested-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 1db07d4dc738..773e4188f336 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -179,7 +179,6 @@ static const struct usb_device_id tower_table[] = { }; MODULE_DEVICE_TABLE (usb, tower_table); -static DEFINE_MUTEX(open_disc_mutex); #define LEGO_USB_TOWER_MINOR_BASE 160 @@ -332,18 +331,14 @@ static int tower_open (struct inode *inode, struct file *file) goto exit; } - mutex_lock(&open_disc_mutex); dev = usb_get_intfdata(interface); - if (!dev) { - mutex_unlock(&open_disc_mutex); retval = -ENODEV; goto exit; } /* lock this device */ if (mutex_lock_interruptible(&dev->lock)) { - mutex_unlock(&open_disc_mutex); retval = -ERESTARTSYS; goto exit; } @@ -351,12 +346,10 @@ static int tower_open (struct inode *inode, struct file *file) /* allow opening only once */ if (dev->open_count) { - mutex_unlock(&open_disc_mutex); retval = -EBUSY; goto unlock_exit; } dev->open_count = 1; - mutex_unlock(&open_disc_mutex); /* reset the tower */ result = usb_control_msg (dev->udev, @@ -423,10 +416,9 @@ static int tower_release (struct inode *inode, struct file *file) if (dev == NULL) { retval = -ENODEV; - goto exit_nolock; + goto exit; } - mutex_lock(&open_disc_mutex); if (mutex_lock_interruptible(&dev->lock)) { retval = -ERESTARTSYS; goto exit; @@ -456,10 +448,7 @@ static int tower_release (struct inode *inode, struct file *file) unlock_exit: mutex_unlock(&dev->lock); - exit: - mutex_unlock(&open_disc_mutex); -exit_nolock: return retval; } @@ -912,7 +901,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device if (retval) { /* something prevented us from registering this driver */ dev_err(idev, "Not able to get a minor for this device.\n"); - usb_set_intfdata (interface, NULL); goto error; } dev->minor = interface->minor; @@ -944,16 +932,13 @@ static void tower_disconnect (struct usb_interface *interface) int minor; dev = usb_get_intfdata (interface); - mutex_lock(&open_disc_mutex); - usb_set_intfdata (interface, NULL); minor = dev->minor; - /* give back our minor */ + /* give back our minor and prevent further open() */ usb_deregister_dev (interface, &tower_class); mutex_lock(&dev->lock); - mutex_unlock(&open_disc_mutex); /* if the device is not opened, then we clean up right now */ if (!dev->open_count) { From patchwork Thu Sep 19 08:30:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151855 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EF13776 for ; Thu, 19 Sep 2019 08:30:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CE6D5217D6 for ; Thu, 19 Sep 2019 08:30:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881857; bh=89YVnPWhEUyNKnlCRSOysn9t6rPLNOrwjH5hCorPYSs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2dtS5fZbABYLohYCmhk3jjypl9Ur7Op5msnj+GIiICJuGnTB0v4DlNUfsMP8cR7ek /P2vZqKw1mOZHN8Wcfim5WweFPProkauELVvIBbH9rY5zAGHS+RoSApq3xAml+/PYm FZh34QkySXOm/qWklzzc1gcDL9Qhds9QjzEEh8Xs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387856AbfISIa4 (ORCPT ); Thu, 19 Sep 2019 04:30:56 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:34235 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387637AbfISIa4 (ORCPT ); Thu, 19 Sep 2019 04:30:56 -0400 Received: by mail-lj1-f196.google.com with SMTP id j19so1193046lja.1; Thu, 19 Sep 2019 01:30:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=gOw3dGTcmm1iVIPl96Li1eNYVJdVoD8Cu2D+Apy5uOg=; b=VSXQm9rq2kEK26jy2gQMIrrjT+odDFyLBS05gM1R5FiDdWS5GMoYPYmNYA/g7o6oUZ zeFQJ8h9R4C6jxm2K0yfuImkO1mFS1NtImhkFA/29TEi3zkjI8WnnmzhBb5NBpQBn1WE 9BKqZDAr7IQn9e3TEGshmvFA3zeoN5xLUf3J1pI0MTpPLeTnoq2AwtOxcLJfu9Efo4FR yW5Po6fbIOEB+kTZe40zLtRlhdBMPuEfSMKGe9MHMw6TQXUzJNJl6c2McZODB4t2VTcT ia53DhN1V2S5AmCWEMMhSJs/7pJqoFF4PpdDv3UuADO2UzEGlnhzTTUuMFUCEd6Zdl79 LTVQ== X-Gm-Message-State: APjAAAXwxM39orcJeRi0EA60QnqkNyG9A7y8ajwnCbHudnoib7A2kb/6 s8VAYyPF4+uOmWvsDpb2ejg= X-Google-Smtp-Source: APXvYqyWIQSjgHJuF5c2hJ/3S2Ghl17fi3f0cHmK25IEM9SRVN/sidVhGNKafEmPovwDTH1UmCxdHA== X-Received: by 2002:a2e:9cd3:: with SMTP id g19mr4730157ljj.150.1568881852452; Thu, 19 Sep 2019 01:30:52 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id q19sm1636171lfj.9.2019.09.19.01.30.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:30:50 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iArpx-00083N-Rp; Thu, 19 Sep 2019 10:30:49 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Juergen Stuber , legousb-devel@lists.sourceforge.net, Johan Hovold , stable Subject: [PATCH RESEND 3/4] USB: legousbtower: fix potential NULL-deref on disconnect Date: Thu, 19 Sep 2019 10:30:38 +0200 Message-Id: <20190919083039.30898-4-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919083039.30898-1-johan@kernel.org> References: <20190919083039.30898-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver is using its struct usb_device pointer as an inverted disconnected flag, but was setting it to NULL before making sure all completion handlers had run. This could lead to a NULL-pointer dereference in a number of dev_dbg and dev_err statements in the completion handlers which relies on said pointer. Fix this by unconditionally stopping all I/O and preventing resubmissions by poisoning the interrupt URBs at disconnect and using a dedicated disconnected flag. This also makes sure that all I/O has completed by the time the disconnect callback returns. Fixes: 9d974b2a06e3 ("USB: legousbtower.c: remove err() usage") Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") Fixes: 4dae99638097 ("USB: legotower: remove custom debug macro and module parameter") Cc: stable # 3.5 Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 773e4188f336..4fa999882635 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -190,6 +190,7 @@ struct lego_usb_tower { unsigned char minor; /* the starting minor number for this device */ int open_count; /* number of times this port has been opened */ + unsigned long disconnected:1; char* read_buffer; size_t read_buffer_length; /* this much came in */ @@ -289,8 +290,6 @@ static inline void lego_usb_tower_debug_data(struct device *dev, */ static inline void tower_delete (struct lego_usb_tower *dev) { - tower_abort_transfers (dev); - /* free data structures */ usb_free_urb(dev->interrupt_in_urb); usb_free_urb(dev->interrupt_out_urb); @@ -430,7 +429,8 @@ static int tower_release (struct inode *inode, struct file *file) retval = -ENODEV; goto unlock_exit; } - if (dev->udev == NULL) { + + if (dev->disconnected) { /* the device was unplugged before the file was released */ /* unlock here as tower_delete frees dev */ @@ -466,10 +466,9 @@ static void tower_abort_transfers (struct lego_usb_tower *dev) if (dev->interrupt_in_running) { dev->interrupt_in_running = 0; mb(); - if (dev->udev) - usb_kill_urb (dev->interrupt_in_urb); + usb_kill_urb(dev->interrupt_in_urb); } - if (dev->interrupt_out_busy && dev->udev) + if (dev->interrupt_out_busy) usb_kill_urb(dev->interrupt_out_urb); } @@ -505,7 +504,7 @@ static __poll_t tower_poll (struct file *file, poll_table *wait) dev = file->private_data; - if (!dev->udev) + if (dev->disconnected) return EPOLLERR | EPOLLHUP; poll_wait(file, &dev->read_wait, wait); @@ -552,7 +551,7 @@ static ssize_t tower_read (struct file *file, char __user *buffer, size_t count, } /* verify that the device wasn't unplugged */ - if (dev->udev == NULL) { + if (dev->disconnected) { retval = -ENODEV; pr_err("No device or device unplugged %d\n", retval); goto unlock_exit; @@ -638,7 +637,7 @@ static ssize_t tower_write (struct file *file, const char __user *buffer, size_t } /* verify that the device wasn't unplugged */ - if (dev->udev == NULL) { + if (dev->disconnected) { retval = -ENODEV; pr_err("No device or device unplugged %d\n", retval); goto unlock_exit; @@ -748,7 +747,7 @@ static void tower_interrupt_in_callback (struct urb *urb) resubmit: /* resubmit if we're still running */ - if (dev->interrupt_in_running && dev->udev) { + if (dev->interrupt_in_running) { retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC); if (retval) dev_err(&dev->udev->dev, @@ -813,6 +812,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device dev->udev = udev; dev->open_count = 0; + dev->disconnected = 0; dev->read_buffer = NULL; dev->read_buffer_length = 0; @@ -938,6 +938,10 @@ static void tower_disconnect (struct usb_interface *interface) /* give back our minor and prevent further open() */ usb_deregister_dev (interface, &tower_class); + /* stop I/O */ + usb_poison_urb(dev->interrupt_in_urb); + usb_poison_urb(dev->interrupt_out_urb); + mutex_lock(&dev->lock); /* if the device is not opened, then we clean up right now */ @@ -945,7 +949,7 @@ static void tower_disconnect (struct usb_interface *interface) mutex_unlock(&dev->lock); tower_delete (dev); } else { - dev->udev = NULL; + dev->disconnected = 1; /* wake up pollers */ wake_up_interruptible_all(&dev->read_wait); wake_up_interruptible_all(&dev->write_wait); From patchwork Thu Sep 19 08:30:39 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 11151851 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 84AAC16B1 for ; Thu, 19 Sep 2019 08:30:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 61B0321928 for ; Thu, 19 Sep 2019 08:30:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568881856; bh=lA5k1Dl2Ev2JsmOdLnJ+FP+W8l4kO+ee0hsRG29dJMI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=MQeOxn3PvA4Qiq4bCZfGiFfWiVNrKSMdgw2o/l2whKQ57vFb+ZHyvcyj7skP5YYhm qzUQD90eIJ4hHdOAmDFd9aXNfUxJqiHVm0NW1et4oAIL0ex8aCJbwAhh0+poLcSVSC b9zsSLSfCfh8ok8NIH/r7fM6ZRPO0DAJgYRPXguc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388339AbfISIaz (ORCPT ); Thu, 19 Sep 2019 04:30:55 -0400 Received: from mail-lf1-f65.google.com ([209.85.167.65]:36991 "EHLO mail-lf1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387856AbfISIaz (ORCPT ); Thu, 19 Sep 2019 04:30:55 -0400 Received: by mail-lf1-f65.google.com with SMTP id w67so1711565lff.4 for ; Thu, 19 Sep 2019 01:30:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=l086OEt/YmCp6+Ee4uju9cxpl1kQU9buLbBxRXPBhrY=; b=OIJSkZ2peox7zerRNtsPvIAFYgJXD4SR+GW2u1mMx8jfWg2yTDOh+NxXOF52UJS/tu LEnBoprTXM7b/cl9x63kdXjEZFn9j/9Yb97SV/Ko+0wm4mpbJHa0WYmdEfq8QFHm9GEJ uKvS1FupU+8tvpIGgGLO9+uqkf690tXcZj4Mg6jUNdZJpvEy15G76TmpeR+1Fpsee9lW BBn7mDR17KfiZGi/Ve5LAj370ZRKlOXLhEH5I6FQBGQf4WBVeNrwrSsZBfYUYM1VAP+c YxFpTYYIJq0fKKvb+1L62p6CVoYPPIu9UW+0mjp37dPMs+b8gnh3m7/zUlrZ3VMYKZRb XWcQ== X-Gm-Message-State: APjAAAW7+8HRHqMeDu3dAE/49RoqJkTsohWXzYpyqUcaLhpTTT2HrSw5 xsk1qb2bkUvZdy+jGnIU2Bs= X-Google-Smtp-Source: APXvYqz4O8+Ujagy5UqM1spK/jmi0oFcUwgbeaTJCeYLcHHorsUYFDqLbLPUFeSDFH/+vTV5OogKbQ== X-Received: by 2002:a19:9145:: with SMTP id y5mr4361326lfj.88.1568881853064; Thu, 19 Sep 2019 01:30:53 -0700 (PDT) Received: from xi.terra (c-51f1e055.07-184-6d6c6d4.bbcust.telenor.se. [85.224.241.81]) by smtp.gmail.com with ESMTPSA id i142sm1417302lfi.5.2019.09.19.01.30.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Sep 2019 01:30:51 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.92.2) (envelope-from ) id 1iArpx-00083R-V2; Thu, 19 Sep 2019 10:30:49 +0200 From: Johan Hovold To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, Alan Stern , Oliver Neukum , Juergen Stuber , legousb-devel@lists.sourceforge.net, Johan Hovold Subject: [PATCH RESEND 4/4] USB: legousbtower: fix open after failed reset request Date: Thu, 19 Sep 2019 10:30:39 +0200 Message-Id: <20190919083039.30898-5-johan@kernel.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190919083039.30898-1-johan@kernel.org> References: <20190919083039.30898-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver would return with a nonzero open count in case the reset control request failed. This would prevent any further attempts to open the char dev until the device was disconnected. Fix this by incrementing the open count only on successful open. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Johan Hovold --- drivers/usb/misc/legousbtower.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c index 4fa999882635..44d6a3381804 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c @@ -348,7 +348,6 @@ static int tower_open (struct inode *inode, struct file *file) retval = -EBUSY; goto unlock_exit; } - dev->open_count = 1; /* reset the tower */ result = usb_control_msg (dev->udev, @@ -388,13 +387,14 @@ static int tower_open (struct inode *inode, struct file *file) dev_err(&dev->udev->dev, "Couldn't submit interrupt_in_urb %d\n", retval); dev->interrupt_in_running = 0; - dev->open_count = 0; goto unlock_exit; } /* save device in the file's private structure */ file->private_data = dev; + dev->open_count = 1; + unlock_exit: mutex_unlock(&dev->lock);