On 3/12/21 3:45 AM, Johan Hovold wrote:
On Thu, Mar 11, 2021 at 07:27:37PM -0700, Shuah Khan wrote:
vhci_shutdown_connection() references connection state (tcp_socket,
tcp_rx, tcp_tx, sockfd) saved in usbpip_device without holding the
lock.
Current connection tear down sequence:
Step 1: shutdown the socket
Step 2: stop rx thread and reset tcp_rx pointer
Step 3: stop tx thread and reset tcp_tx pointer
Step 4: Reset tcp_socket and sockfd
There are several race windows between these steps. In addition, device
reset routine (vhci_device_reset) resets tcp_socket and sockfd holding
the lock.
Fix these races:
- Introduce in_disconnect flag to ensure vhci_shutdown_connection() runs
only once.
- Change attach_store() to initialize in_disconnect to false while
initializing connection status (tcp_socket, tcp_rx, tcp_tx, sockfd)
- Change vhci_shutdown_connection() to check in_disconnect and bail
out if disconnect is in progress.
- Change vhci_shutdown_connection() to
-- hold lock to save connection state pointers and unlock.
-- Shutdown the socket and stop threads.
-- Hold lock to clear connection status and in_disconnect flag.
- Change vhci_device_reset() to reset tcp_socket and sockfd.
if !in_disconnect
Tested syzbot and the reproducer did not trigger any issue.
Reported-and-tested-by: syzbot+a93fba6d384346a761e3@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/usbip/usbip_common.h | 1 +
drivers/usb/usbip/vhci_hcd.c | 55 +++++++++++++++++++++++---------
drivers/usb/usbip/vhci_sysfs.c | 4 +++
3 files changed, 45 insertions(+), 15 deletions(-)
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 3209b5ddd30c..c1917efe5737 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -1007,31 +1007,54 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
static void vhci_shutdown_connection(struct usbip_device *ud)
{
struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);
+ unsigned long flags;
+ struct socket *socket;
+ struct task_struct *tcp_rx = NULL;
+ struct task_struct *tcp_tx = NULL;
+ int sockfd = 0;
+
+ spin_lock_irqsave(&ud->lock, flags);
+ if (vdev->ud.in_disconnect) {
+ pr_info("%s: Disconnect in progress for sockfd %d\n",
+ __func__, ud->sockfd);
Looks like you forgot to remove all you debug printks like this one
before submitting.
Some printks were already in there and helped with debug. Yes I added
a few more when I submitted for syzbot testing.
I will clean them up i v2.
thanks,
-- Shuah
