Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 72ab0f6f authored by Niels Dossche's avatar Niels Dossche Committed by Greg Kroah-Hartman
Browse files

usb: usbip: add missing device lock on tweak configuration cmd 



[ Upstream commit d088fabace2ca337b275d1d4b36db4fe7771e44f ]

The function documentation of usb_set_configuration says that its
callers should hold the device lock. This lock is held for all
callsites except tweak_set_configuration_cmd. The code path can be
executed for example when attaching a remote USB device.
The solution is to surround the call by the device lock.

This bug was found using my experimental own-developed static analysis
tool, which reported the missing lock on v5.17.2. I manually verified
this bug report by doing code review as well. I runtime checked that
the required lock is not held. I compiled and runtime tested this on
x86_64 with a USB mouse. After applying this patch, my analyser no
longer reports this potential bug.

Fixes: 2c8c9815 ("staging: usbip: let client choose device configuration")
Reviewed-by: default avatarShuah Khan <skhan@linuxfoundation.org>
Signed-off-by: default avatarNiels Dossche <dossche.niels@gmail.com>
Link: https://lore.kernel.org/r/20220412165055.257113-1-dossche.niels@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 2f0ae93e

drivers/usb/usbip/stub_rx.c

+2 −0
Original line number Diff line number Diff line
@@ -138,7 +138,9 @@ static int tweak_set_configuration_cmd(struct urb *urb) 
	req = (struct usb_ctrlrequest *) urb->setup_packet;

	config = le16_to_cpu(req->wValue);



	usb_lock_device(sdev->udev);

	err = usb_set_configuration(sdev->udev, config);

	usb_unlock_device(sdev->udev);

	if (err && err != -ENODEV)

		dev_err(&sdev->udev->dev, "can't set config #%d, error %d\n",

			config, err);