From patchwork Wed Jul 3 16:34:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ladislav Michl X-Patchwork-Id: 11029861 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A958513B1 for ; Wed, 3 Jul 2019 16:34:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 97EA2205C0 for ; Wed, 3 Jul 2019 16:34:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8B5EF287B5; Wed, 3 Jul 2019 16:34:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 01CAD205C0 for ; Wed, 3 Jul 2019 16:34:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726918AbfGCQeg (ORCPT ); Wed, 3 Jul 2019 12:34:36 -0400 Received: from eddie.linux-mips.org ([148.251.95.138]:50426 "EHLO cvs.linux-mips.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726718AbfGCQeg (ORCPT ); Wed, 3 Jul 2019 12:34:36 -0400 Received: (from localhost user: 'ladis' uid#1021 fake: STDIN (ladis@eddie.linux-mips.org)) by eddie.linux-mips.org id S23992643AbfGCQeeS5ffC (ORCPT ); Wed, 3 Jul 2019 18:34:34 +0200 Date: Wed, 3 Jul 2019 18:34:33 +0200 From: Ladislav Michl To: linux-usb@vger.kernel.org Cc: Felipe Balbi , Greg Kroah-Hartman Subject: [PATCH 1/3] usb: gadget: u_serial: Fix console_req complete event race Message-ID: <20190703163433.GB28579@lenoch> References: <20190703163355.GA28579@lenoch> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190703163355.GA28579@lenoch> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP gs_complete_out might be called before con_lock following usb_ep_queue is locked, which prevents any future output on the console. Fix that by resetting req_busy only if usb_ep_queue fails. While there also put variable access we are racing with connection/disconnection events under con_lock as well. Fixes: a5beaaf39455 ("usb: gadget: Add the console support for usb-to-serial port") Signed-off-by: Ladislav Michl --- drivers/usb/gadget/function/u_serial.c | 38 +++++++++++--------------- 1 file changed, 16 insertions(+), 22 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 65f634ec7fc2..f8abb9c68e62 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -984,47 +984,41 @@ static int gs_console_thread(void *data) struct gs_port *port; struct usb_request *req; struct usb_ep *ep; - int xfer, ret, count, size; + int len, size, status; + spin_lock_irq(&info->con_lock); do { port = info->port; set_current_state(TASK_INTERRUPTIBLE); - if (!port || !port->port_usb - || !port->port_usb->in || !info->console_req) + if (!port || !port->port_usb || !info->console_req) goto sched; req = info->console_req; ep = port->port_usb->in; - - spin_lock_irq(&info->con_lock); - count = kfifo_len(&info->con_buf); - size = ep->maxpacket; - - if (count > 0 && !info->req_busy) { + len = kfifo_len(&info->con_buf); + if (len > 0 && !info->req_busy) { set_current_state(TASK_RUNNING); - if (count < size) - size = count; + size = ep->maxpacket; + if (len < size) + size = len; - xfer = kfifo_out(&info->con_buf, req->buf, size); - req->length = xfer; - - spin_unlock(&info->con_lock); - ret = usb_ep_queue(ep, req, GFP_ATOMIC); - spin_lock(&info->con_lock); - if (ret < 0) - info->req_busy = 0; - else - info->req_busy = 1; + req->length = kfifo_out(&info->con_buf, req->buf, size); + info->req_busy = 1; spin_unlock_irq(&info->con_lock); + status = usb_ep_queue(ep, req, GFP_ATOMIC); + spin_lock_irq(&info->con_lock); + if (status < 0) + info->req_busy = 0; } else { - spin_unlock_irq(&info->con_lock); sched: + spin_unlock_irq(&info->con_lock); if (kthread_should_stop()) { set_current_state(TASK_RUNNING); break; } schedule(); + spin_lock_irq(&info->con_lock); } } while (1); From patchwork Wed Jul 3 16:34:57 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ladislav Michl X-Patchwork-Id: 11029863 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9F31F13B1 for ; Wed, 3 Jul 2019 16:35:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8E22C205C0 for ; Wed, 3 Jul 2019 16:35:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8218B287B5; Wed, 3 Jul 2019 16:35:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 28E79205C0 for ; Wed, 3 Jul 2019 16:35:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726991AbfGCQe7 (ORCPT ); Wed, 3 Jul 2019 12:34:59 -0400 Received: from eddie.linux-mips.org ([148.251.95.138]:50426 "EHLO cvs.linux-mips.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726718AbfGCQe7 (ORCPT ); Wed, 3 Jul 2019 12:34:59 -0400 Received: (from localhost user: 'ladis' uid#1021 fake: STDIN (ladis@eddie.linux-mips.org)) by eddie.linux-mips.org id S23992643AbfGCQe6HNz-C (ORCPT ); Wed, 3 Jul 2019 18:34:58 +0200 Date: Wed, 3 Jul 2019 18:34:57 +0200 From: Ladislav Michl To: linux-usb@vger.kernel.org Cc: Felipe Balbi , Greg Kroah-Hartman Subject: [PATCH 2/3] usb: gadget: u_serial: Remove console specific alloc/free req functions Message-ID: <20190703163457.GC28579@lenoch> References: <20190703163355.GA28579@lenoch> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190703163355.GA28579@lenoch> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Driver already contains request allocation and deallocation functions, so use them also for console_req. While console_req is always null when calling gs_console_connect remove check and put access under con_lock as we are racing with gs_console_thread. Signed-off-by: Ladislav Michl --- drivers/usb/gadget/function/u_serial.c | 43 +++++++------------------- 1 file changed, 11 insertions(+), 32 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index f8abb9c68e62..04b4338b4ae1 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -892,30 +892,6 @@ static struct tty_driver *gs_tty_driver; static struct gscons_info gscons_info; static struct console gserial_cons; -static struct usb_request *gs_request_new(struct usb_ep *ep) -{ - struct usb_request *req = usb_ep_alloc_request(ep, GFP_ATOMIC); - if (!req) - return NULL; - - req->buf = kmalloc(ep->maxpacket, GFP_ATOMIC); - if (!req->buf) { - usb_ep_free_request(ep, req); - return NULL; - } - - return req; -} - -static void gs_request_free(struct usb_request *req, struct usb_ep *ep) -{ - if (!req) - return; - - kfree(req->buf); - usb_ep_free_request(ep, req); -} - static void gs_complete_out(struct usb_ep *ep, struct usb_request *req) { struct gscons_info *info = &gscons_info; @@ -954,15 +930,15 @@ static int gs_console_connect(int port_num) port = ports[port_num].port; ep = port->port_usb->in; + spin_lock(&info->con_lock); + info->console_req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC); if (!info->console_req) { - info->console_req = gs_request_new(ep); - if (!info->console_req) - return -ENOMEM; - info->console_req->complete = gs_complete_out; + spin_unlock(&info->con_lock); + return -ENOMEM; } + info->console_req->complete = gs_complete_out; info->port = port; - spin_lock(&info->con_lock); info->req_busy = 0; spin_unlock(&info->con_lock); pr_vdebug("port[%d] console connect!\n", port_num); @@ -972,10 +948,13 @@ static int gs_console_connect(int port_num) static void gs_console_disconnect(struct usb_ep *ep) { struct gscons_info *info = &gscons_info; - struct usb_request *req = info->console_req; - gs_request_free(req, ep); - info->console_req = NULL; + spin_lock(&info->con_lock); + if (info->console_req) { + gs_free_req(ep, info->console_req); + info->console_req = NULL; + } + spin_unlock(&info->con_lock); } static int gs_console_thread(void *data) From patchwork Wed Jul 3 16:35:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ladislav Michl X-Patchwork-Id: 11029867 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5074A13B1 for ; Wed, 3 Jul 2019 16:35:34 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3EC4F1FF73 for ; Wed, 3 Jul 2019 16:35:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 318352022C; Wed, 3 Jul 2019 16:35:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BE4081FF73 for ; Wed, 3 Jul 2019 16:35:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727027AbfGCQfd (ORCPT ); Wed, 3 Jul 2019 12:35:33 -0400 Received: from eddie.linux-mips.org ([148.251.95.138]:50426 "EHLO cvs.linux-mips.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726686AbfGCQfd (ORCPT ); Wed, 3 Jul 2019 12:35:33 -0400 Received: (from localhost user: 'ladis' uid#1021 fake: STDIN (ladis@eddie.linux-mips.org)) by eddie.linux-mips.org id S23992643AbfGCQfbs3lTC (ORCPT ); Wed, 3 Jul 2019 18:35:31 +0200 Date: Wed, 3 Jul 2019 18:35:30 +0200 From: Ladislav Michl To: linux-usb@vger.kernel.org Cc: Felipe Balbi , Greg Kroah-Hartman Subject: [PATCH 3/3] usb: gadget: u_serial: Use bool for req_busy Message-ID: <20190703163530.GD28579@lenoch> References: <20190703163355.GA28579@lenoch> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190703163355.GA28579@lenoch> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Let's make code more consistent by using bool for req_busy as it is done for similar variables in struct gs_port. Signed-off-by: Ladislav Michl --- drivers/usb/gadget/function/u_serial.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 04b4338b4ae1..130613751723 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -88,7 +88,7 @@ struct gscons_info { struct kfifo con_buf; /* protect the buf and busy flag */ spinlock_t con_lock; - int req_busy; + bool req_busy; struct usb_request *console_req; }; @@ -904,7 +904,7 @@ static void gs_complete_out(struct usb_ep *ep, struct usb_request *req) case 0: /* normal completion */ spin_lock(&info->con_lock); - info->req_busy = 0; + info->req_busy = false; spin_unlock(&info->con_lock); wake_up_process(info->console_thread); @@ -939,7 +939,6 @@ static int gs_console_connect(int port_num) info->console_req->complete = gs_complete_out; info->port = port; - info->req_busy = 0; spin_unlock(&info->con_lock); pr_vdebug("port[%d] console connect!\n", port_num); return 0; @@ -982,13 +981,13 @@ static int gs_console_thread(void *data) size = len; req->length = kfifo_out(&info->con_buf, req->buf, size); - info->req_busy = 1; + info->req_busy = true; spin_unlock_irq(&info->con_lock); status = usb_ep_queue(ep, req, GFP_ATOMIC); spin_lock_irq(&info->con_lock); if (status < 0) - info->req_busy = 0; + info->req_busy = false; } else { sched: spin_unlock_irq(&info->con_lock); @@ -1011,7 +1010,7 @@ static int gs_console_setup(struct console *co, char *options) info->port = NULL; info->console_req = NULL; - info->req_busy = 0; + info->req_busy = false; spin_lock_init(&info->con_lock); status = kfifo_alloc(&info->con_buf, GS_CONSOLE_BUF_SIZE, GFP_KERNEL);