linux/drivers/usb
Alan Stern 0c0ad07971 USB: don't free bandwidth_mutex too early
[ Upstream commit ab2a4bf839 ]

The USB core contains a bug that can show up when a USB-3 host
controller is removed.  If the primary (USB-2) hcd structure is
released before the shared (USB-3) hcd, the core will try to do a
double-free of the common bandwidth_mutex.

The problem was described in graphical form by Chung-Geol Kim, who
first reported it:

=================================================
     At *remove USB(3.0) Storage
     sequence <1> --> <5> ((Problem Case))
=================================================
                                  VOLD
------------------------------------|------------
                                 (uevent)
                            ________|_________
                           |<1>               |
                           |dwc3_otg_sm_work  |
                           |usb_put_hcd       |
                           |peer_hcd(kref=2)|
                           |__________________|
                            ________|_________
                           |<2>               |
                           |New USB BUS #2    |
                           |                  |
                           |peer_hcd(kref=1)  |
                           |                  |
                         --(Link)-bandXX_mutex|
                         | |__________________|
                         |
    ___________________  |
   |<3>                | |
   |dwc3_otg_sm_work   | |
   |usb_put_hcd        | |
   |primary_hcd(kref=1)| |
   |___________________| |
    _________|_________  |
   |<4>                | |
   |New USB BUS #1     | |
   |hcd_release        | |
   |primary_hcd(kref=0)| |
   |                   | |
   |bandXX_mutex(free) |<-
   |___________________|
                               (( VOLD ))
                            ______|___________
                           |<5>               |
                           |      SCSI        |
                           |usb_put_hcd       |
                           |peer_hcd(kref=0)  |
                           |*hcd_release      |
                           |bandXX_mutex(free*)|<- double free
                           |__________________|

=================================================

This happens because hcd_release() frees the bandwidth_mutex whenever
it sees a primary hcd being released (which is not a very good idea
in any case), but in the course of releasing the primary hcd, it
changes the pointers in the shared hcd in such a way that the shared
hcd will appear to be primary when it gets released.

This patch fixes the problem by changing hcd_release() so that it
deallocates the bandwidth_mutex only when the _last_ hcd structure
referencing it is released.  The patch also removes an unnecessary
test, so that when an hcd is released, both the shared_hcd and
primary_hcd pointers in the hcd's peer will be cleared.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Chung-Geol Kim <chunggeol.kim@samsung.com>
Tested-by: Chung-Geol Kim <chunggeol.kim@samsung.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-07-12 08:47:15 -04:00
..
atm usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
c67x00 USB: c67x00: correct spelling mistakes in comments 2014-01-08 15:05:14 -08:00
chipidea usb: chipidea: otg: change workqueue ci_otg as freezable 2016-03-10 09:44:36 -05:00
class USB: cdc-acm: more sanity checking 2016-04-18 08:49:35 -04:00
common usb: common: otg-fsm: add license to usb-otg-fsm 2016-07-11 11:16:23 -04:00
core USB: don't free bandwidth_mutex too early 2016-07-12 08:47:15 -04:00
dwc2 usb: dwc2: hcd: use new USB_RESUME_TIMEOUT 2015-06-28 13:39:22 -04:00
dwc3 usb: dwc3: exynos: Fix deferred probing storm. 2016-07-11 11:09:36 -04:00
early USB: ehci-dbgp: drop dead code. 2013-09-26 16:25:21 -07:00
gadget usb: gadget: fix spinlock dead lock in gadgetfs 2016-07-11 11:09:43 -04:00
host usb: host: ehci-tegra: Grab the correct UTMI pads reset 2016-07-11 11:10:44 -04:00
image USB: image: correct spelling mistake in comment 2014-01-08 15:08:14 -08:00
misc usb: misc: usbtest: fix pattern tests for scatterlists. 2016-06-03 11:30:33 -04:00
mon USB: regroup all depends on USB within an if USB block 2013-04-09 16:49:07 -07:00
musb usb: musb: Stop bulk endpoint while queue is rotated 2016-07-11 11:10:34 -04:00
phy usb: phy: Find the right match in devm_usb_phy_match 2015-05-17 19:11:58 -04:00
renesas_usbhs usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done() 2016-04-20 09:40:49 -04:00
serial USB: serial: quatech2: fix use-after-free in probe error path 2016-06-06 19:11:01 -04:00
storage USB: uas: Add a new NO_REPORT_LUNS quirk 2016-04-20 09:41:07 -04:00
usbip usbip: remove struct usb_device_id table 2014-08-25 10:40:58 -07:00
wusbcore usb: hub: rename khubd to hub_wq in documentation and comments 2014-09-23 22:33:19 -07:00
Kconfig usb: Add LED triggers for USB activity 2014-09-25 17:05:12 +02:00
Makefile usbip: move usbip kernel code out of staging 2014-08-25 10:40:06 -07:00
README usb: hub: rename khubd to hub_wq in documentation and comments 2014-09-23 22:33:19 -07:00
usb-skeleton.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.