Race condition when accessing authorized_default for a root hub

[Thiébaud Weksteen <tweek@xxxxxxxxxx>]

Hi,

I believe there is a race condition for userland in hcd.c where the
kernel sends a uevent before the underlying sysfs is fully populated:

(drivers/usb/core/hcd.c)
          /* starting here, usbcore will pay attention to this root hub */
          retval = register_root_hub(hcd);
          if (retval != 0)
                  goto err_register_root_hub;
          [...]
          retval = sysfs_create_group(&rhdev->dev.kobj, &usb_bus_attr_group);
          if (retval < 0) {
                  printk(KERN_ERR "Cannot register USB bus sysfs
attributes: %d\n",
                         retval);
                  goto error_create_attr_group;
          }

Here, register_root_hub will call kobject_uevent(&dev->kobj, KOBJ_ADD)
(via usb_new_device and device_add). This was found in userland (see
https://github.com/USBGuard/usbguard/issues/321).

The fix is not as simple as swapping both blocks (that is, calling
sysfs_create_group before register_root_hub) as device_add is
responsible for calling kobject_add and kobject_uevent.

This can potentially be solved by adding the sysfs_create_group call
to the bus_notifier list (blocking). Thoughts?

Thanks,
Thiebaud