Patch "usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-gadget-f_fs-fix-race-between-aio_cancel-and-aio-.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 57dfa6e90d8993c888fbff383a10be3f9980e1ca
Author: Wesley Cheng <quic_wcheng@xxxxxxxxxxx>
Date:   Mon Apr 8 18:40:59 2024 -0700

    usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
    
    [ Upstream commit 24729b307eefcd7c476065cd7351c1a018082c19 ]
    
    FFS based applications can utilize the aio_cancel() callback to dequeue
    pending USB requests submitted to the UDC.  There is a scenario where the
    FFS application issues an AIO cancel call, while the UDC is handling a
    soft disconnect.  For a DWC3 based implementation, the callstack looks
    like the following:
    
        DWC3 Gadget                               FFS Application
    dwc3_gadget_soft_disconnect()              ...
      --> dwc3_stop_active_transfers()
        --> dwc3_gadget_giveback(-ESHUTDOWN)
          --> ffs_epfile_async_io_complete()   ffs_aio_cancel()
            --> usb_ep_free_request()            --> usb_ep_dequeue()
    
    There is currently no locking implemented between the AIO completion
    handler and AIO cancel, so the issue occurs if the completion routine is
    running in parallel to an AIO cancel call coming from the FFS application.
    As the completion call frees the USB request (io_data->req) the FFS
    application is also referencing it for the usb_ep_dequeue() call.  This can
    lead to accessing a stale/hanging pointer.
    
    commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")
    relocated the usb_ep_free_request() into ffs_epfile_async_io_complete().
    However, in order to properly implement locking to mitigate this issue, the
    spinlock can't be added to ffs_epfile_async_io_complete(), as
    usb_ep_dequeue() (if successfully dequeuing a USB request) will call the
    function driver's completion handler in the same context.  Hence, leading
    into a deadlock.
    
    Fix this issue by moving the usb_ep_free_request() back to
    ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req
    to NULL after freeing it within the ffs->eps_lock.  This resolves the race
    condition above, as the ffs_aio_cancel() routine will not continue
    attempting to dequeue a request that has already been freed, or the
    ffs_user_copy_work() not freeing the USB request until the AIO cancel is
    done referencing it.
    
    This fix depends on
      commit b566d38857fc ("usb: gadget: f_fs: use io_data->status
      consistently")
    
    Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
    Cc: stable <stable@xxxxxxxxxx>  # b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")
    Signed-off-by: Wesley Cheng <quic_wcheng@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240409014059.6740-1-quic_wcheng@xxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index d32e1ece3e0a1..698bf24ba44c7 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -832,6 +832,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
 						   work);
 	int ret = io_data->status;
 	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
+	unsigned long flags;
 
 	if (io_data->read && ret > 0) {
 		kthread_use_mm(io_data->mm);
@@ -844,6 +845,11 @@ static void ffs_user_copy_worker(struct work_struct *work)
 	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
 		eventfd_signal(io_data->ffs->ffs_eventfd, 1);
 
+	spin_lock_irqsave(&io_data->ffs->eps_lock, flags);
+	usb_ep_free_request(io_data->ep, io_data->req);
+	io_data->req = NULL;
+	spin_unlock_irqrestore(&io_data->ffs->eps_lock, flags);
+
 	if (io_data->read)
 		kfree(io_data->to_free);
 	ffs_free_buffer(io_data);
@@ -859,7 +865,6 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
 	ENTER();
 
 	io_data->status = req->status ? req->status : req->actual;
-	usb_ep_free_request(_ep, req);
 
 	INIT_WORK(&io_data->work, ffs_user_copy_worker);
 	queue_work(ffs->io_completion_wq, &io_data->work);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux