forked from luck/tmp_suning_uos_patched
4cf6ba9367
[ Upstream commit db264d4c66c0fe007b5d19fd007707cd0697603d ] Since usb_register_dev() from imon_init_display() from imon_probe() holds minor_rwsem while display_open() which holds driver_lock and ictx->lock is called with minor_rwsem held from usb_open(), holding driver_lock or ictx->lock when calling usb_register_dev() causes circular locking dependency problem. Since usb_deregister_dev() from imon_disconnect() holds minor_rwsem while display_open() which holds driver_lock is called with minor_rwsem held, holding driver_lock when calling usb_deregister_dev() also causes circular locking dependency problem. Sean Young explained that the problem is there are imon devices which have two usb interfaces, even though it is one device. The probe and disconnect function of both usb interfaces can run concurrently. Alan Stern responded that the driver and USB cores guarantee that when an interface is probed, both the interface and its USB device are locked. Ditto for when the disconnect callback gets run. So concurrent probing/ disconnection of multiple interfaces on the same device is not possible. Therefore, we don't need locks for handling race between imon_probe() and imon_disconnect(). But we still need to handle race between display_open() /vfd_write()/lcd_write()/display_close() and imon_disconnect(), for disconnect event can happen while file descriptors are in use. Since "struct file"->private_data is set by display_open(), vfd_write()/ lcd_write()/display_close() can assume that "struct file"->private_data is not NULL even after usb_set_intfdata(interface, NULL) was called. Replace insufficiently held driver_lock with refcount_t based management. Add a boolean flag for recording whether imon_disconnect() was already called. Use RCU for accessing this boolean flag and refcount_t. Since the boolean flag for imon_disconnect() is shared, disconnect event on either intf0 or intf1 affects both interfaces. But I assume that this change does not matter, for usually disconnect event would not happen while interfaces are in use. Link: https://syzkaller.appspot.com/bug?extid=c558267ad910fc494497 Reported-by: syzbot <syzbot+c558267ad910fc494497@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+c558267ad910fc494497@syzkaller.appspotmail.com> Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|---|---|---|
| .. | ||
| img-ir | ||
| keymaps | ||
| ati_remote.c | ||
| bpf-lirc.c | ||
| ene_ir.c | ||
| ene_ir.h | ||
| fintek-cir.c | ||
| fintek-cir.h | ||
| gpio-ir-recv.c | ||
| gpio-ir-tx.c | ||
| igorplugusb.c | ||
| iguanair.c | ||
| imon_raw.c | ||
| imon.c | ||
| ir_toy.c | ||
| ir-hix5hd2.c | ||
| ir-imon-decoder.c | ||
| ir-jvc-decoder.c | ||
| ir-mce_kbd-decoder.c | ||
| ir-nec-decoder.c | ||
| ir-rc5-decoder.c | ||
| ir-rc6-decoder.c | ||
| ir-rcmm-decoder.c | ||
| ir-rx51.c | ||
| ir-sanyo-decoder.c | ||
| ir-sharp-decoder.c | ||
| ir-sony-decoder.c | ||
| ir-spi.c | ||
| ir-xmp-decoder.c | ||
| ite-cir.c | ||
| ite-cir.h | ||
| Kconfig | ||
| lirc_dev.c | ||
| Makefile | ||
| mceusb.c | ||
| meson-ir.c | ||
| mtk-cir.c | ||
| nuvoton-cir.c | ||
| nuvoton-cir.h | ||
| pwm-ir-tx.c | ||
| rc-core-priv.h | ||
| rc-ir-raw.c | ||
| rc-loopback.c | ||
| rc-main.c | ||
| redrat3.c | ||
| serial_ir.c | ||
| sir_ir.c | ||
| st_rc.c | ||
| streamzap.c | ||
| sunxi-cir.c | ||
| tango-ir.c | ||
| ttusbir.c | ||
| winbond-cir.c | ||
| xbox_remote.c | ||
| zx-irdec.c | ||