linux/drivers/usb/gadget
Al Viro 2005aabe94 functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
When all files are closed, functionfs needs ffs_data_reset() to be
done before any further opens are allowed.

During that time we have ffs->state set to FFS_CLOSING; that makes
->open() fail with -EBUSY.  Once ffs_data_reset() is done, it
switches state (to FFS_READ_DESCRIPTORS) indicating that opening
that thing is allowed again.  There's a couple of additional twists:
	* mounting with -o no_disconnect delays ffs_data_reset()
from doing that at the final ->release() to the first subsequent
open().  That's indicated by ffs->state set to FFS_DEACTIVATED;
if open() sees that, it immediately switches to FFS_CLOSING and
proceeds with doing ffs_data_reset() before returning to userland.
	* a couple of usb callbacks need to force the delayed
transition; unfortunately, they are done in locking environment
that does not allow blocking and ffs_data_reset() can block.
As the result, if these callbacks see FFS_DEACTIVATED, they change
state to FFS_CLOSING and use schedule_work() to get ffs_data_reset()
executed asynchronously.

Unfortunately, the locking is rather insufficient.  A fix attempted
in e5bf5ee266 ("functionfs: fix the open/removal races") had closed
a bunch of UAF, but it didn't do anything to the callbacks, lacked
barriers in transition from FFS_CLOSING to FFS_READ_DESCRIPTORS
_and_ it had been too heavy-handed in open()/open() serialization -
I've used ffs->mutex for that, and it's being held over actual IO on
ep0, complete with copy_from_user(), etc.

Even more unfortunately, the userland side is apparently racy enough
to have the resulting timing changes (no failures, just a delayed
return of open(2)) disrupt the things quite badly.  Userland bugs
or not, it's a clear regression that needs to be dealt with.

Solution is to use a spinlock for serializing these state checks and
transitions - unlike ffs->mutex it can be taken in these callbacks
and it doesn't disrupt the timings in open().

We could introduce a new spinlock, but it's easier to use the one
that is already there (ffs->eps_lock) instead - the locking
environment is safe for it in all affected places.

Since now it is held over all places that alter or check the
open count (ffs->opened), there's no need to keep that atomic_t -
int would serve just fine and it's simpler that way.

Fixes: e5bf5ee266 ("functionfs: fix the open/removal races")
Fixes: 18d6b32fca ("usb: gadget: f_fs: add "no_disconnect" mode") # v4.0
Tested-by: Samuel Wu <wusamuel@google.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
History 2026-02-05 13:53:12 -05:00
..
function functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions 2026-02-05 13:53:12 -05:00
legacy USB/Thunderbolt changes for 6.19-rc1 2025-12-06 18:42:12 -08:00
udc usb: gadget: lpc32xx_udc: clean up probe error labels 2025-12-23 15:48:46 +01:00
composite.c usb: gadget : fix use-after-free in composite_dev_cleanup() 2025-07-21 16:32:23 +02:00
config.c usb: gadget: config: Remove unused usb_gadget_config_buf 2025-06-19 12:26:48 +02:00
configfs.c usb: gadget: configfs: Correctly set use_os_string at bind 2025-09-06 15:22:36 +02:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: epautoconf: Use USB API functions rather than constants 2025-05-21 13:13:22 +02:00
functions.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
Kconfig usb: gadget: midi2: Reverse-select at the right place 2025-01-07 11:42:22 +01:00
Makefile usb: gadget: Makefile: remove ccflags-y 2022-03-18 12:56:08 +01:00
u_f.c usb: gadget: function: move u_f.h to include/linux/usb/func_utils.h 2024-09-03 09:57:08 +02:00
u_os_desc.h move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
usbstring.c drivers/usb/gadget: refactor min with min_t 2024-11-13 15:09:50 +01:00