linux/drivers/usb
Alan Stern 543d7784b0 USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED
There is a race in the hub driver between hub_disconnect() and
recursively_mark_NOTATTACHED().  This race can be triggered if the
driver is unbound from a device at the same time as the bus's root hub
is removed.  When the race occurs, it can cause an oops:

BUG: unable to handle kernel NULL pointer dereference at 0000015c
IP: [<c16d5fb0>] recursively_mark_NOTATTACHED+0x20/0x60
Call Trace:
 [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
 [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
 [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
 [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
 [<c16d6082>] usb_set_device_state+0x92/0x120
 [<c16d862b>] usb_disconnect+0x2b/0x1a0
 [<c16dd4c0>] usb_remove_hcd+0xb0/0x160
 [<c19ca846>] ? _raw_spin_unlock_irqrestore+0x26/0x50
 [<c1704efc>] ehci_mid_remove+0x1c/0x30
 [<c1704f26>] ehci_mid_stop_host+0x16/0x30
 [<c16f7698>] penwell_otg_work+0xd28/0x3520
 [<c19c945b>] ? __schedule+0x39b/0x7f0
 [<c19cdb9d>] ? sub_preempt_count+0x3d/0x50
 [<c125e97d>] process_one_work+0x11d/0x3d0
 [<c19c7f4d>] ? mutex_unlock+0xd/0x10
 [<c125e0e5>] ? manage_workers.isra.24+0x1b5/0x270
 [<c125f009>] worker_thread+0xf9/0x320
 [<c19ca846>] ? _raw_spin_unlock_irqrestore+0x26/0x50
 [<c125ef10>] ? rescuer_thread+0x2b0/0x2b0
 [<c1264ac4>] kthread+0x94/0xa0
 [<c19d0f77>] ret_from_kernel_thread+0x1b/0x28
 [<c1264a30>] ? kthread_create_on_node+0xc0/0xc0

One problem is that recursively_mark_NOTATTACHED() uses the intfdata
value and hub->hdev->maxchild while hub_disconnect() is clearing them.
Another problem is that it uses hub->ports[i] while the port device is
being released.

To fix this race, we need to hold the device_state_lock while
hub_disconnect() changes the values.  (Note that usb_disconnect()
and hub_port_connect_change() already acquire this lock at similar
critical times during a USB device's life cycle.)  We also need to
remove the port devices after maxchild has been set to 0, instead of
before.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: "Du, Changbin" <changbinx.du@intel.com>
Tested-by: "Du, Changbin" <changbinx.du@intel.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-07 09:30:48 -08:00
..
atm Usb: atm: usbatm: fixed a pointer variable format issue 2013-12-08 18:01:56 -08:00
c67x00 USB: c67x00: remove CONFIG_USB_DEBUG dependancy 2013-12-20 11:46:19 -08:00
chipidea USB: chipidea: add guard macro to ci_hdrc_imx.h 2014-01-03 12:37:57 -08:00
class Merge 3.13-rc5 into usb-next 2013-12-24 10:18:03 -08:00
core USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED 2014-01-07 09:30:48 -08:00
dwc3 Merge 3.13-rc5 into usb-next 2013-12-24 10:18:03 -08:00
early USB: ehci-dbgp: drop dead code. 2013-09-26 16:25:21 -07:00
gadget usb: gadget: at91_udc: fix build warning 2013-12-23 19:28:17 -06:00
host USB: fix: ohci-at91 mismerge build error 2014-01-07 09:30:48 -08:00
image USB: regroup all depends on USB within an if USB block 2013-04-09 16:49:07 -07:00
misc USB: misc: idmouse: correct spelling mistake in error string 2014-01-03 12:39:31 -08:00
mon USB: regroup all depends on USB within an if USB block 2013-04-09 16:49:07 -07:00
musb USB: musb: correct spelling mistakes in comment and error string 2014-01-03 12:39:31 -08:00
phy usb: changes for v3.14 merge window 2014-01-03 12:15:10 -08:00
renesas_usbhs usb: changes for v3.14 merge window 2014-01-03 12:15:10 -08:00
serial USB: oti6858: switch to generic TIOCMIWAIT implementation 2014-01-03 12:42:24 -08:00
storage USB: Nokia 502 is an unusual device 2014-01-03 12:40:22 -08:00
wusbcore usb: wusbcore: add debug prints to reservation and channel change 2013-12-20 12:06:46 -08:00
Kconfig usb: musb: Rework USB and USB_GADGET dependency 2013-12-23 10:28:56 -06:00
Makefile usb: patches for v3.12 merge window 2013-08-13 15:28:01 -07:00
README
usb-common.c usb: common: introduce of_usb_get_maximum_speed() 2013-07-29 13:56:46 +03:00
usb-skeleton.c USB: usb-skeleton.c: add retry for nonblocking read 2013-07-25 12:01:13 -07:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("khubd").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.