This is a note to let you know that I've just added the patch titled usbip: stub-dev synchronize sysfs code paths to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usbip-stub-dev-synchronize-sysfs-code-paths.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Tue Apr 20 01:51:40 PM CEST 2021 From: Tom Seewald <tseewald@xxxxxxxxx> Date: Fri, 16 Apr 2021 15:53:17 -0500 Subject: usbip: stub-dev synchronize sysfs code paths To: stable@xxxxxxxxxxxxxxx Cc: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx>, syzbot+a93fba6d384346a761e3@xxxxxxxxxxxxxxxxxxxxxxxxx, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>, Tom Seewald <tseewald@xxxxxxxxx>, Valentina Manea <valentina.manea.m@xxxxxxxxx>, Shuah Khan <shuah@xxxxxxxxxx> Message-ID: <20210416205319.14075-2-tseewald@xxxxxxxxx> From: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> commit 9dbf34a834563dada91366c2ac266f32ff34641a upstream. Fuzzing uncovered race condition between sysfs code paths in usbip drivers. Device connect/disconnect code paths initiated through sysfs interface are prone to races if disconnect happens during connect and vice versa. Use sysfs_lock to protect sysfs paths in stub-dev. Cc: stable@xxxxxxxxxxxxxxx # 4.9.x Reported-and-tested-by: syzbot+a93fba6d384346a761e3@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/2b182f3561b4a065bf3bf6dce3b0e9944ba17b3f.1616807117.git.skhan@xxxxxxxxxxxxxxxxxxx Signed-off-by: Tom Seewald <tseewald@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/usb/usbip/stub_dev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/drivers/usb/usbip/stub_dev.c +++ b/drivers/usb/usbip/stub_dev.c @@ -77,6 +77,7 @@ static ssize_t store_sockfd(struct devic dev_info(dev, "stub up\n"); + mutex_lock(&sdev->ud.sysfs_lock); spin_lock_irq(&sdev->ud.lock); if (sdev->ud.status != SDEV_ST_AVAILABLE) { @@ -101,13 +102,13 @@ static ssize_t store_sockfd(struct devic tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx"); if (IS_ERR(tcp_rx)) { sockfd_put(socket); - return -EINVAL; + goto unlock_mutex; } tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx"); if (IS_ERR(tcp_tx)) { kthread_stop(tcp_rx); sockfd_put(socket); - return -EINVAL; + goto unlock_mutex; } /* get task structs now */ @@ -126,6 +127,8 @@ static ssize_t store_sockfd(struct devic wake_up_process(sdev->ud.tcp_rx); wake_up_process(sdev->ud.tcp_tx); + mutex_unlock(&sdev->ud.sysfs_lock); + } else { dev_info(dev, "stub down\n"); @@ -136,6 +139,7 @@ static ssize_t store_sockfd(struct devic spin_unlock_irq(&sdev->ud.lock); usbip_event_add(&sdev->ud, SDEV_EVENT_DOWN); + mutex_unlock(&sdev->ud.sysfs_lock); } return count; @@ -144,6 +148,8 @@ sock_err: sockfd_put(socket); err: spin_unlock_irq(&sdev->ud.lock); +unlock_mutex: + mutex_unlock(&sdev->ud.sysfs_lock); return -EINVAL; } static DEVICE_ATTR(usbip_sockfd, S_IWUSR, NULL, store_sockfd); @@ -309,6 +315,7 @@ static struct stub_device *stub_device_a sdev->ud.side = USBIP_STUB; sdev->ud.status = SDEV_ST_AVAILABLE; spin_lock_init(&sdev->ud.lock); + mutex_init(&sdev->ud.sysfs_lock); sdev->ud.tcp_socket = NULL; sdev->ud.sockfd = -1; Patches currently in stable-queue which might be from tseewald@xxxxxxxxx are queue-4.9/usbip-vudc-synchronize-sysfs-code-paths.patch queue-4.9/usbip-fix-incorrect-double-assignment-to-udc-ud.tcp_rx.patch queue-4.9/usbip-synchronize-event-handler-with-sysfs-code-paths.patch queue-4.9/usbip-add-sysfs_lock-to-synchronize-sysfs-code-paths.patch queue-4.9/usbip-stub-dev-synchronize-sysfs-code-paths.patch