Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe471bf1 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

USB: legousbtower: fix deadlock on disconnect 



commit 33a7813219f208f4952ece60ee255fd983272dec upstream.

Fix a potential deadlock if disconnect races with open.

Since commit d4ead16f ("USB: prevent char device open/deregister
race") core holds an rw-semaphore while open is called and when
releasing the minor number during deregistration. This can lead to an
ABBA deadlock if a driver takes a lock in open which it also holds
during deregistration.

This effectively reverts commit 78663ecc ("USB: disconnect open race
in legousbtower") which needlessly introduced this issue after a generic
fix for this race had been added to core by commit d4ead16f ("USB:
prevent char device open/deregister race").

Fixes: 78663ecc ("USB: disconnect open race in legousbtower")
Cc: stable <stable@vger.kernel.org>	# 2.6.24
Reported-by: default avatar <syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190919083039.30898-3-johan@kernel.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4fde6c98

drivers/usb/misc/legousbtower.c

+2 −17
Original line number Diff line number Diff line
@@ -179,7 +179,6 @@ static const struct usb_device_id tower_table[] = { 
};



MODULE_DEVICE_TABLE (usb, tower_table);

static DEFINE_MUTEX(open_disc_mutex);



#define LEGO_USB_TOWER_MINOR_BASE	160
@@ -332,18 +331,14 @@ static int tower_open (struct inode *inode, struct file *file) 
		goto exit;

	}



	mutex_lock(&open_disc_mutex);

	dev = usb_get_intfdata(interface);



	if (!dev) {

		mutex_unlock(&open_disc_mutex);

		retval = -ENODEV;

		goto exit;

	}



	/* lock this device */

	if (mutex_lock_interruptible(&dev->lock)) {

		mutex_unlock(&open_disc_mutex);

	        retval = -ERESTARTSYS;

		goto exit;

	}
@@ -351,12 +346,10 @@ static int tower_open (struct inode *inode, struct file *file) 


	/* allow opening only once */

	if (dev->open_count) {

		mutex_unlock(&open_disc_mutex);

		retval = -EBUSY;

		goto unlock_exit;

	}

	dev->open_count = 1;

	mutex_unlock(&open_disc_mutex);



	/* reset the tower */

	result = usb_control_msg (dev->udev,
@@ -423,10 +416,9 @@ static int tower_release (struct inode *inode, struct file *file) 


	if (dev == NULL) {

		retval = -ENODEV;

		goto exit_nolock;

		goto exit;

	}



	mutex_lock(&open_disc_mutex);

	if (mutex_lock_interruptible(&dev->lock)) {

	        retval = -ERESTARTSYS;

		goto exit;
@@ -456,10 +448,7 @@ static int tower_release (struct inode *inode, struct file *file) 


unlock_exit:

	mutex_unlock(&dev->lock);



exit:

	mutex_unlock(&open_disc_mutex);

exit_nolock:

	return retval;

}
@@ -912,7 +901,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
	if (retval) {

		/* something prevented us from registering this driver */

		dev_err(idev, "Not able to get a minor for this device.\n");

		usb_set_intfdata (interface, NULL);

		goto error;

	}

	dev->minor = interface->minor;
@@ -944,16 +932,13 @@ static void tower_disconnect (struct usb_interface *interface) 
	int minor;



	dev = usb_get_intfdata (interface);

	mutex_lock(&open_disc_mutex);

	usb_set_intfdata (interface, NULL);



	minor = dev->minor;



	/* give back our minor */

	/* give back our minor and prevent further open() */

	usb_deregister_dev (interface, &tower_class);



	mutex_lock(&dev->lock);

	mutex_unlock(&open_disc_mutex);



	/* if the device is not opened, then we clean up right now */

	if (!dev->open_count) {