From ab7cd8c76cb47f1bda0ad964d309b4efce81b5e9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 15 Dec 2009 07:47:28 -0800 Subject: [PATCH 1/2] Revert "USB: Close usb_find_interface race" This reverts commit a2582bd478c13c574d4c16ef1209d333f2a25935. It turned out to be buggy and broke USB printers from working. Cc: Russ Dill Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/usb.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 4e2c6df8d3c..932f68e6ad1 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -167,17 +167,24 @@ struct usb_host_interface *usb_altnum_to_altsetting( } EXPORT_SYMBOL_GPL(usb_altnum_to_altsetting); +struct find_interface_arg { + int minor; + struct usb_interface *interface; +}; + static int __find_interface(struct device *dev, void *data) { - int *minor = data; + struct find_interface_arg *arg = data; struct usb_interface *intf; if (!is_usb_interface(dev)) return 0; intf = to_usb_interface(dev); - if (intf->minor != -1 && intf->minor == *minor) + if (intf->minor != -1 && intf->minor == arg->minor) { + arg->interface = intf; return 1; + } return 0; } @@ -186,20 +193,21 @@ static int __find_interface(struct device *dev, void *data) * @drv: the driver whose current configuration is considered * @minor: the minor number of the desired device * - * This walks the bus device list and returns a pointer to the interface + * This walks the driver device list and returns a pointer to the interface * with the matching minor. Note, this only works for devices that share the * USB major number. */ struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor) { - struct device *dev; + struct find_interface_arg argb; + int retval; - dev = bus_find_device(&usb_bus_type, NULL, &minor, __find_interface); - - /* Drop reference count from bus_find_device */ - put_device(dev); - - return dev ? to_usb_interface(dev) : NULL; + argb.minor = minor; + argb.interface = NULL; + /* eat the error, it will be in argb.interface */ + retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb, + __find_interface); + return argb.interface; } EXPORT_SYMBOL_GPL(usb_find_interface); From c2d284ee04ab6f6718de2ddcf1b43160e046c41d Mon Sep 17 00:00:00 2001 From: Russ Dill Date: Mon, 14 Dec 2009 21:45:35 -0700 Subject: [PATCH 2/2] USB: Close usb_find_interface race v3 USB drivers that create character devices call usb_register_dev in their probe function. This associates the usb_interface device with that minor number and creates the character device and announces it to the world. However, the driver's probe function is called before the new usb_interface is added to the driver's klist_devices. This is a problem because userspace will respond to the character device creation announcement by opening the character device. The driver's open function will the call usb_find_interface to find the usb_interface associated with that minor number. usb_find_interface will walk the driver's list of devices and find the usb_interface with the matching minor number. Because the announcement happens before the usb_interface is added to the driver's klist_devices, a race condition exists. A straightforward fix is to walk the list of devices on usb_bus_type instead since the device is added to that list before the announcement occurs. bus_find_device calls get_device to bump the reference count on the found device. It is arguable that the reference count should be dropped by the caller of usb_find_interface instead of usb_find_interface, however, the current users of usb_find_interface do not expect this. The original version of this patch only matched against minor number instead of driver and minor number. This version matches against both. Signed-off-by: Russ Dill Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/usb.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 932f68e6ad1..d86276c639c 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -169,7 +169,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetting); struct find_interface_arg { int minor; - struct usb_interface *interface; + struct device_driver *drv; }; static int __find_interface(struct device *dev, void *data) @@ -180,12 +180,10 @@ static int __find_interface(struct device *dev, void *data) if (!is_usb_interface(dev)) return 0; + if (dev->driver != arg->drv) + return 0; intf = to_usb_interface(dev); - if (intf->minor != -1 && intf->minor == arg->minor) { - arg->interface = intf; - return 1; - } - return 0; + return intf->minor == arg->minor; } /** @@ -193,21 +191,24 @@ static int __find_interface(struct device *dev, void *data) * @drv: the driver whose current configuration is considered * @minor: the minor number of the desired device * - * This walks the driver device list and returns a pointer to the interface - * with the matching minor. Note, this only works for devices that share the - * USB major number. + * This walks the bus device list and returns a pointer to the interface + * with the matching minor and driver. Note, this only works for devices + * that share the USB major number. */ struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor) { struct find_interface_arg argb; - int retval; + struct device *dev; argb.minor = minor; - argb.interface = NULL; - /* eat the error, it will be in argb.interface */ - retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb, - __find_interface); - return argb.interface; + argb.drv = &drv->drvwrap.driver; + + dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface); + + /* Drop reference count from bus_find_device */ + put_device(dev); + + return dev ? to_usb_interface(dev) : NULL; } EXPORT_SYMBOL_GPL(usb_find_interface);