On Thu, Mar 11, 2021 at 07:27:37PM -0700, Shuah Khan wrote: > vhci_shutdown_connection() references connection state (tcp_socket, > tcp_rx, tcp_tx, sockfd) saved in usbpip_device without holding the > lock. > > Current connection tear down sequence: > Step 1: shutdown the socket > Step 2: stop rx thread and reset tcp_rx pointer > Step 3: stop tx thread and reset tcp_tx pointer > Step 4: Reset tcp_socket and sockfd > > There are several race windows between these steps. In addition, device > reset routine (vhci_device_reset) resets tcp_socket and sockfd holding > the lock. > > Fix these races: > - Introduce in_disconnect flag to ensure vhci_shutdown_connection() runs > only once. > - Change attach_store() to initialize in_disconnect to false while > initializing connection status (tcp_socket, tcp_rx, tcp_tx, sockfd) > - Change vhci_shutdown_connection() to check in_disconnect and bail > out if disconnect is in progress. > - Change vhci_shutdown_connection() to > -- hold lock to save connection state pointers and unlock. > -- Shutdown the socket and stop threads. > -- Hold lock to clear connection status and in_disconnect flag. > - Change vhci_device_reset() to reset tcp_socket and sockfd. > if !in_disconnect > > Tested syzbot and the reproducer did not trigger any issue. > > Reported-and-tested-by: syzbot+a93fba6d384346a761e3@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> > --- > drivers/usb/usbip/usbip_common.h | 1 + > drivers/usb/usbip/vhci_hcd.c | 55 +++++++++++++++++++++++--------- > drivers/usb/usbip/vhci_sysfs.c | 4 +++ > 3 files changed, 45 insertions(+), 15 deletions(-) > diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c > index 3209b5ddd30c..c1917efe5737 100644 > --- a/drivers/usb/usbip/vhci_hcd.c > +++ b/drivers/usb/usbip/vhci_hcd.c > @@ -1007,31 +1007,54 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev) > static void vhci_shutdown_connection(struct usbip_device *ud) > { > struct vhci_device *vdev = container_of(ud, struct vhci_device, ud); > + unsigned long flags; > + struct socket *socket; > + struct task_struct *tcp_rx = NULL; > + struct task_struct *tcp_tx = NULL; > + int sockfd = 0; > + > + spin_lock_irqsave(&ud->lock, flags); > + if (vdev->ud.in_disconnect) { > + pr_info("%s: Disconnect in progress for sockfd %d\n", > + __func__, ud->sockfd); Looks like you forgot to remove all you debug printks like this one before submitting. > + spin_unlock_irqrestore(&ud->lock, flags); > + return; > + } Johan