linux-imx/drivers/usb
Alan Stern c1f10c6b89 USB: gadgetfs: Fix crash caused by inadequate synchronization
commit 520b72fc64 upstream.

The gadgetfs driver (drivers/usb/gadget/legacy/inode.c) was written
before the UDC and composite frameworks were adopted; it is a legacy
driver.  As such, it expects that once bound to a UDC controller, it
will not be unbound until it unregisters itself.

However, the UDC framework does unbind function drivers while they are
still registered.  When this happens, it can cause the gadgetfs driver
to misbehave or crash.  For example, userspace can cause a crash by
opening the device file and doing an ioctl call before setting up a
configuration (found by Andrey Konovalov using the syzkaller fuzzer).

This patch adds checks and synchronization to prevent these bad
behaviors.  It adds a udc_usage counter that the driver increments at
times when it is using a gadget interface without holding the private
spinlock.  The unbind routine waits for this counter to go to 0 before
returning, thereby ensuring that the UDC is no longer in use.

The patch also adds a check in the dev_ioctl() routine to make sure
the driver is bound to a UDC before dereferencing the gadget pointer,
and it makes destroy_ep_files() synchronize with the endpoint I/O
routines, to prevent the user from accessing an endpoint data
structure after it has been removed.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2:
 - Expand locked section in ep0_write() to match upstream
 - Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2018-01-01 20:50:51 +00:00
..
atm USB: cxacru: potential underflow in cxacru_cm_get_array() 2013-05-30 14:35:04 +01:00
c67x00 usb: Add module.h to drivers/usb consumers who really use it. 2011-10-31 19:31:25 -04:00
class USB: cdc-acm: add device-id for quirky printer 2017-11-11 13:34:23 +00:00
core usb: Increase quirk delay for USB devices 2018-01-01 20:50:49 +00:00
dwc3 usb: dwc3: gadget: make Set Endpoint Configuration macros safe 2017-07-18 18:38:30 +01:00
early USB: echi-dbgp: increase the controller wait time to come out of halt. 2012-08-10 00:25:07 +01:00
gadget USB: gadgetfs: Fix crash caused by inadequate synchronization 2018-01-01 20:50:51 +00:00
host usb: pci-quirks.c: Corrected timeout values used in handshake 2018-01-01 20:50:50 +00:00
image atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
misc usb: usbtest: fix NULL pointer dereference 2017-11-11 13:34:40 +00:00
mon usb: Add export.h for EXPORT_SYMBOL/THIS_MODULE where needed 2011-10-31 19:31:25 -04:00
musb usb: musb: tusb6010_omap: Do not reset the other direction's packet size 2017-09-15 18:30:45 +01:00
otg usb: Add export.h for EXPORT_SYMBOL/THIS_MODULE where needed 2011-10-31 19:31:25 -04:00
renesas_usbhs usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL 2017-11-11 13:34:24 +00:00
serial USB: serial: cp210x: add support for ELV TFD500 2018-01-01 20:50:50 +00:00
storage usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives 2018-01-01 20:50:51 +00:00
wusbcore USB: wusbcore: fix NULL-deref at probe 2017-07-18 18:38:32 +01:00
Kconfig Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2011-11-03 13:28:14 -07:00
Makefile usb: Provide usb_speed_string() function 2011-09-18 01:29:04 -07:00
README
usb-common.c usb: Provide usb_speed_string() function 2011-09-18 01:29:04 -07:00
usb-skeleton.c USB: use usb_endpoint_maxp() instead of le16_to_cpu() 2011-08-23 09:47:40 -07:00

To understand all the Linux-USB framework, you'll use these resources:

* This source code.  This is necessarily an evolving work, and
  includes kerneldoc that should help you get a current overview.
  ("make pdfdocs", and then look at "usb.pdf" for host side and
  "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
  more information.

* The USB 2.0 specification (from www.usb.org), with supplements
  such as those for USB OTG and the various device classes.
  The USB specification has a good overview chapter, and USB
  peripherals conform to the widely known "Chapter 9".

* Chip specifications for USB controllers.  Examples include
  host controllers (on PCs, servers, and more); peripheral
  controllers (in devices with Linux firmware, like printers or
  cell phones); and hard-wired peripherals like Ethernet adapters.

* Specifications for other protocols implemented by USB peripheral
  functions.  Some are vendor-specific; others are vendor-neutral
  but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in them.

core/ - This is for the core USB host code, including the usbfs files and the hub class driver ("khubd").

host/ - This is for USB host controller drivers. This includes UHCI, OHCI, EHCI, and others that might be used with more specialized "embedded" systems.

gadget/ - This is for USB peripheral controller drivers and the various gadget drivers which talk to them.

Individual USB driver directories. A new driver should be added to the first subdirectory in the list below that it fits into.

image/ - This is for still image drivers, like scanners or digital cameras. ../input/ - This is for any driver that uses the input subsystem, like keyboard, mice, touchscreens, tablets, etc. ../media/ - This is for multimedia drivers, like video cameras, radios, and any other drivers that talk to the v4l subsystem. ../net/ - This is for network drivers. serial/ - This is for USB to serial drivers. storage/ - This is for USB mass-storage drivers. class/ - This is for all USB device drivers that do not fit into any of the above categories, and work for a range of USB Class specified devices. misc/ - This is for all USB device drivers that do not fit into any of the above categories.