linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-14 05:55:17 +00:00

No description

C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Alan Stern 1a065e4673 USB: gadget: Fix obscure lockdep violation for udc_mutex commit `1016fc0c09` upstream. A recent commit expanding the scope of the udc_lock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form: ====================================================== WARNING: possible circular locking dependency detected 5.19.0-rc7+ #12510 Not tainted ------------------------------------------------------ udevadm/312 is trying to acquire lock: ffff80000aae1058 (udc_lock){+.+.}-{3:3}, at: usb_udc_uevent+0x54/0xe0 but task is already holding lock: ffff000002277548 (kn->active#4){++++}-{0:0}, at: kernfs_seq_start+0x34/0xe0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (kn->active#4){++++}-{0:0}: lock_acquire+0x68/0x84 __kernfs_remove+0x268/0x380 kernfs_remove_by_name_ns+0x58/0xac sysfs_remove_file_ns+0x18/0x24 device_del+0x15c/0x440 -> #2 (device_links_lock){+.+.}-{3:3}: lock_acquire+0x68/0x84 __mutex_lock+0x9c/0x430 mutex_lock_nested+0x38/0x64 device_link_remove+0x3c/0xa0 _regulator_put.part.0+0x168/0x190 regulator_put+0x3c/0x54 devm_regulator_release+0x14/0x20 -> #1 (regulator_list_mutex){+.+.}-{3:3}: lock_acquire+0x68/0x84 __mutex_lock+0x9c/0x430 mutex_lock_nested+0x38/0x64 regulator_lock_dependent+0x54/0x284 regulator_enable+0x34/0x80 phy_power_on+0x24/0x130 __dwc2_lowlevel_hw_enable+0x100/0x130 dwc2_lowlevel_hw_enable+0x18/0x40 dwc2_hsotg_udc_start+0x6c/0x2f0 gadget_bind_driver+0x124/0x1f4 -> #0 (udc_lock){+.+.}-{3:3}: __lock_acquire+0x1298/0x20cc lock_acquire.part.0+0xe0/0x230 lock_acquire+0x68/0x84 __mutex_lock+0x9c/0x430 mutex_lock_nested+0x38/0x64 usb_udc_uevent+0x54/0xe0 Evidently this was caused by the scope of udc_mutex being too large. The mutex is only meant to protect udc->driver along with a few other things. As far as I can tell, there's no reason for the mutex to be held while the gadget core calls a gadget driver's ->bind or ->unbind routine, or while a UDC is being started or stopped. (This accounts for link #1 in the chain above, where the mutex is held while the dwc2_hsotg_udc is started as part of driver probing.) Gadget drivers' ->disconnect callbacks are problematic. Even though usb_gadget_disconnect() will now acquire the udc_mutex, there's a window in usb_gadget_bind_driver() between the times when the mutex is released and the ->bind callback is invoked. If a disconnect occurred during that window, we could call the driver's ->disconnect routine before its ->bind routine. To prevent this from happening, it will be necessary to prevent a UDC from connecting while it has no gadget driver. This should be done already but it doesn't seem to be; currently usb_gadget_connect() has no check for this. Such a check will have to be added later. Some degree of mutual exclusion is required in soft_connect_store(), which can dereference udc->driver at arbitrary times since it is a sysfs callback. The solution here is to acquire the gadget's device lock rather than the udc_mutex. Since the driver core guarantees that the device lock is always held during driver binding and unbinding, this will make the accesses in soft_connect_store() mutually exclusive with any changes to udc->driver. Lastly, it turns out there is one place which should hold the udc_mutex but currently does not: The function_show() routine needs protection while it dereferences udc->driver. The missing lock and unlock calls are added. Link: https://lore.kernel.org/all/b2ba4245-9917-e399-94c8-03a383e7070e@samsung.com/ Fixes: `2191c00855` ("USB: gadget: Fix use-after-free Read in usb_udc_uevent()") Cc: Felipe Balbi <balbi@kernel.org> Cc: stable@vger.kernel.org Reported-by: Marek Szyprowski <m.szyprowski@samsung.com> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/YwkfhdxA/I2nOcK7@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2022-09-08 11:24:06 +02:00
arch	s390: fix nospec table alignments	2022-09-08 11:24:06 +02:00
block	blk-mq: fix io hung due to missing commit_rqs	2022-08-31 17:18:19 +02:00
certs	certs: make system keyring depend on x509 parser	2022-07-24 12:53:55 -07:00
crypto	KEYS: asymmetric: enforce SM2 signature use pkey algo	2022-08-17 15:16:17 +02:00
Documentation	rtla: Fix tracer name	2022-09-05 10:31:31 +02:00
drivers	USB: gadget: Fix obscure lockdep violation for udc_mutex	2022-09-08 11:24:06 +02:00
fs	cifs: fix small mempool leak in SMB2_negotiate()	2022-09-08 11:24:02 +02:00
include	USB: core: Prevent nested device-reset calls	2022-09-08 11:24:06 +02:00
init	arm64: fix rodata=full	2022-08-31 17:18:19 +02:00
io_uring	io_uring: fix issue with io_write() not always undoing sb_start_write()	2022-08-31 17:18:17 +02:00
ipc	ipc: Free mq_sysctls if ipc namespace creation failed	2022-06-22 17:47:41 -05:00
kernel	bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO	2022-09-08 11:23:58 +02:00
lib	crypto: lib - remove unneeded selection of XOR_BLOCKS	2022-09-05 10:31:26 +02:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	mm: pagewalk: Fix race between unmap and page walker	2022-09-08 11:24:04 +02:00
net	net/smc: Remove redundant refcount increase	2022-09-08 11:24:00 +02:00
samples	sample: bpf: xdp_router_ipv4: Allow the kernel to send arp requests	2022-08-17 15:14:25 +02:00
scripts	kbuild: dummy-tools: avoid tmpdir leak in dummy gcc	2022-08-29 11:07:58 +02:00
security	landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER	2022-09-08 11:24:02 +02:00
sound	ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array	2022-09-08 11:23:58 +02:00
tools	landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER	2022-09-08 11:24:02 +02:00
usr	Not a lot of material this cycle. Many singleton patches against various	2022-05-27 11:22:03 -07:00
virt	KVM: Unconditionally get a ref to /dev/kvm module when creating a VM	2022-08-25 11:45:05 +02:00
.clang-format	clang-format: Fix space after for_each macros	2022-05-20 19:27:16 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: split the second line of .mod into .usyms	2022-05-08 03:16:59 +09:00
.mailmap	ARM: SoC fixes for 5.19, part 4	2022-07-27 09:43:07 -07:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: mark ARM/PALM TREO SUPPORT orphan	2022-07-07 15:17:00 +02:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	io_uring: move to separate directory	2022-08-17 15:14:20 +02:00
Makefile	Linux 5.19.7	2022-09-05 10:31:36 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.