Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ca359f4 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

Revert "USB: rio500: simplify locking" 



This reverts commit d710734b.
This simplification causes a deadlock.

Reported-by: default avatar <syzbot+7bbcbe9c9ff0cd49592a@syzkaller.appspotmail.com>
Fixes: d710734b ("USB: rio500: simplify locking")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20190808092854.23519-1-oneukum@suse.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c43f28df

drivers/usb/misc/rio500.c

+27 −16
Original line number Diff line number Diff line
@@ -51,6 +51,7 @@ struct rio_usb_data { 
        char *obuf, *ibuf;              /* transfer buffers */

        char bulk_in_ep, bulk_out_ep;   /* Endpoint assignments */

        wait_queue_head_t wait_q;       /* for timeouts */

	struct mutex lock;          /* general race avoidance */

};



static DEFINE_MUTEX(rio500_mutex);
@@ -62,8 +63,10 @@ static int open_rio(struct inode *inode, struct file *file) 


	/* against disconnect() */

	mutex_lock(&rio500_mutex);

	mutex_lock(&(rio->lock));



	if (rio->isopen || !rio->present) {

		mutex_unlock(&(rio->lock));

		mutex_unlock(&rio500_mutex);

		return -EBUSY;

	}
@@ -71,6 +74,7 @@ static int open_rio(struct inode *inode, struct file *file) 


	init_waitqueue_head(&rio->wait_q);



	mutex_unlock(&(rio->lock));



	dev_info(&rio->rio_dev->dev, "Rio opened.\n");

	mutex_unlock(&rio500_mutex);
@@ -84,6 +88,7 @@ static int close_rio(struct inode *inode, struct file *file) 


	/* against disconnect() */

	mutex_lock(&rio500_mutex);

	mutex_lock(&(rio->lock));



	rio->isopen = 0;

	if (!rio->present) {
@@ -95,6 +100,7 @@ static int close_rio(struct inode *inode, struct file *file) 
	} else {

		dev_info(&rio->rio_dev->dev, "Rio closed.\n");

	}

	mutex_unlock(&(rio->lock));

	mutex_unlock(&rio500_mutex);

	return 0;

}
@@ -109,7 +115,7 @@ static long ioctl_rio(struct file *file, unsigned int cmd, unsigned long arg) 
	int retries;

	int retval=0;



	mutex_lock(&rio500_mutex);

	mutex_lock(&(rio->lock));

        /* Sanity check to make sure rio is connected, powered, etc */

        if (rio->present == 0 || rio->rio_dev == NULL) {

		retval = -ENODEV;
@@ -253,7 +259,7 @@ static long ioctl_rio(struct file *file, unsigned int cmd, unsigned long arg) 




err_out:

	mutex_unlock(&rio500_mutex);

	mutex_unlock(&(rio->lock));

	return retval;

}
@@ -273,12 +279,12 @@ write_rio(struct file *file, const char __user *buffer, 
	int errn = 0;

	int intr;



	intr = mutex_lock_interruptible(&rio500_mutex);

	intr = mutex_lock_interruptible(&(rio->lock));

	if (intr)

		return -EINTR;

        /* Sanity check to make sure rio is connected, powered, etc */

        if (rio->present == 0 || rio->rio_dev == NULL) {

		mutex_unlock(&rio500_mutex);

		mutex_unlock(&(rio->lock));

		return -ENODEV;

	}
@@ -301,7 +307,7 @@ write_rio(struct file *file, const char __user *buffer, 
				goto error;

			}

			if (signal_pending(current)) {

				mutex_unlock(&rio500_mutex);

				mutex_unlock(&(rio->lock));

				return bytes_written ? bytes_written : -EINTR;

			}
@@ -339,12 +345,12 @@ write_rio(struct file *file, const char __user *buffer, 
		buffer += copy_size;

	} while (count > 0);



	mutex_unlock(&rio500_mutex);

	mutex_unlock(&(rio->lock));



	return bytes_written ? bytes_written : -EIO;



error:

	mutex_unlock(&rio500_mutex);

	mutex_unlock(&(rio->lock));

	return errn;

}
@@ -361,12 +367,12 @@ read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos) 
	char *ibuf;

	int intr;



	intr = mutex_lock_interruptible(&rio500_mutex);

	intr = mutex_lock_interruptible(&(rio->lock));

	if (intr)

		return -EINTR;

	/* Sanity check to make sure rio is connected, powered, etc */

        if (rio->present == 0 || rio->rio_dev == NULL) {

		mutex_unlock(&rio500_mutex);

		mutex_unlock(&(rio->lock));

		return -ENODEV;

	}
@@ -377,11 +383,11 @@ read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos) 


	while (count > 0) {

		if (signal_pending(current)) {

			mutex_unlock(&rio500_mutex);

			mutex_unlock(&(rio->lock));

			return read_count ? read_count : -EINTR;

		}

		if (!rio->rio_dev) {

			mutex_unlock(&rio500_mutex);

			mutex_unlock(&(rio->lock));

			return -ENODEV;

		}

		this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count;
@@ -399,7 +405,7 @@ read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos) 
			count = this_read = partial;

		} else if (result == -ETIMEDOUT || result == 15) {	/* FIXME: 15 ??? */

			if (!maxretry--) {

				mutex_unlock(&rio500_mutex);

				mutex_unlock(&(rio->lock));

				dev_err(&rio->rio_dev->dev,

					"read_rio: maxretry timeout\n");

				return -ETIME;
@@ -409,19 +415,19 @@ read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos) 
			finish_wait(&rio->wait_q, &wait);

			continue;

		} else if (result != -EREMOTEIO) {

			mutex_unlock(&rio500_mutex);

			mutex_unlock(&(rio->lock));

			dev_err(&rio->rio_dev->dev,

				"Read Whoops - result:%d partial:%u this_read:%u\n",

				result, partial, this_read);

			return -EIO;

		} else {

			mutex_unlock(&rio500_mutex);

			mutex_unlock(&(rio->lock));

			return (0);

		}



		if (this_read) {

			if (copy_to_user(buffer, ibuf, this_read)) {

				mutex_unlock(&rio500_mutex);

				mutex_unlock(&(rio->lock));

				return -EFAULT;

			}

			count -= this_read;
@@ -429,7 +435,7 @@ read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos) 
			buffer += this_read;

		}

	}

	mutex_unlock(&rio500_mutex);

	mutex_unlock(&(rio->lock));

	return read_count;

}
@@ -494,6 +500,8 @@ static int probe_rio(struct usb_interface *intf, 
	}

	dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);



	mutex_init(&(rio->lock));



	usb_set_intfdata (intf, rio);

	rio->present = 1;

bail_out:
@@ -511,10 +519,12 @@ static void disconnect_rio(struct usb_interface *intf) 
	if (rio) {

		usb_deregister_dev(intf, &usb_rio_class);



		mutex_lock(&(rio->lock));

		if (rio->isopen) {

			rio->isopen = 0;

			/* better let it finish - the release will do whats needed */

			rio->rio_dev = NULL;

			mutex_unlock(&(rio->lock));

			mutex_unlock(&rio500_mutex);

			return;

		}
@@ -524,6 +534,7 @@ static void disconnect_rio(struct usb_interface *intf) 
		dev_info(&intf->dev, "USB Rio disconnected.\n");



		rio->present = 0;

		mutex_unlock(&(rio->lock));

	}

	mutex_unlock(&rio500_mutex);

}