Skip to main content

Browse the archive

Revision 00d6058ac93048b525b86fa48b413dcb87ac2728 authored by Ian Abbott on 26 June 2006, 10:44:22 UTC, committed by Greg Kroah-Hartman on 12 July 2006, 23:03:22 UTC 
[PATCH] USB serial visor: fix race in open/close
 
The anti user-DoS mechanism in the USB serial 'visor' driver can fail in
the following way:

visor_open: priv->outstanding_urbs = 0
visor_write: ++priv->outstanding_urbs
visor_close:
visor_open: priv->outstanding_urbs = 0
visor_write_bulk_callback: --priv->outstanding_urbs

So priv->outstanding_urbs ends up as (unsigned long)(-1).  Not good!

I haven't seen this happen with the visor driver as I don't have the
hardware, but I have seen it while testing a patch to implement the same
functionality in the ftdi_sio driver (patch not yet submitted).

The fix is pretty simple: don't reinitialize outstanding_urbs in
visor_open.  (Again, I haven't tested the fix in visor, but I have
tested it in ftdi_sio.)

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1 parent 5650b4d
Raw File
mutex-debug.h 
/*
 * Mutexes: blocking mutual exclusion locks
 *
 * started by Ingo Molnar:
 *
 *  Copyright (C) 2004, 2005, 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
 *
 * This file contains mutex debugging related internal declarations,
 * prototypes and inline functions, for the CONFIG_DEBUG_MUTEXES case.
 * More details are in kernel/mutex-debug.c.
 */

/*
 * This must be called with lock->wait_lock held.
 */
extern void
debug_mutex_set_owner(struct mutex *lock, struct thread_info *new_owner);

static inline void debug_mutex_clear_owner(struct mutex *lock)
{
	lock->owner = NULL;
}

extern void debug_mutex_lock_common(struct mutex *lock,
				    struct mutex_waiter *waiter);
extern void debug_mutex_wake_waiter(struct mutex *lock,
				    struct mutex_waiter *waiter);
extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
extern void debug_mutex_add_waiter(struct mutex *lock,
				   struct mutex_waiter *waiter,
				   struct thread_info *ti);
extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
				struct thread_info *ti);
extern void debug_mutex_unlock(struct mutex *lock);
extern void debug_mutex_init(struct mutex *lock, const char *name,
			     struct lock_class_key *key);

#define spin_lock_mutex(lock, flags)			\
	do {						\
		struct mutex *l = container_of(lock, struct mutex, wait_lock); \
							\
		DEBUG_LOCKS_WARN_ON(in_interrupt());	\
		local_irq_save(flags);			\
		__raw_spin_lock(&(lock)->raw_lock);	\
		DEBUG_LOCKS_WARN_ON(l->magic != l);	\
	} while (0)

#define spin_unlock_mutex(lock, flags)			\
	do {						\
		__raw_spin_unlock(&(lock)->raw_lock);	\
		local_irq_restore(flags);		\
		preempt_check_resched();		\
	} while (0)
back to top