Re: [PATCH 6/6] usbip: vhci_hcd: reject URBs from stale usb_device after port re-attach

[sashiko-bot@kernel.org]

> After vhci_shutdown_connection() runs, event_handler() immediately
> calls vhci_device_reset(), setting vdev->ud.status to VDEV_ST_NULL and
> clearing vdev->udev before usb_hub_wq finishes running usb_disconnect()
> on the detached usb_device.
> 
> If attach_store() attaches a new connection to the same rhport before
> usb_hub_wq disconnects the old usb_device, vdev->ud.tcp_socket becomes
> non-NULL and vdev->ud.status becomes VDEV_ST_NOTASSIGNED. Because
> vhci_urb_enqueue() maps urb->dev->portnum to vdev without verifying that
> urb->dev matches vdev->udev, URBs submitted on the old usb_device pass
> the connection state checks and get sent to the new remote device (or,
> if a concurrent USBDEVFS_RESET resets the old usb_device to address 0,
> overwrite vdev->udev).
> 
> Serialize vdev->udev clearing in vhci_device_reset() under vhci->lock
> and ud->lock (dropping old usb_device and socket references outside the
> spinlocks in both vhci_device_reset() and vhci_urb_enqueue()), and
> reject URBs in vhci_urb_enqueue() when urb->dev != vdev->udev and either
> usb_pipedevice(urb->pipe) != 0 or urb->dev is already registered
> (device_is_registered(&urb->dev->dev)). During initial enumeration and
> PORT_INIT_TRIES retries in hub_port_connect(), each candidate usb_device
> is unregistered until usb_new_device() runs after hub_port_init() has
> assigned vdev->udev, whereas an already-registered usb_device resetting
> via usb_reset_device() is only valid when urb->dev == vdev->udev.
> 
> Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Gemini
> Signed-off-by: Raul E Rangel <rrangel@chromium.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021150704.3129446-1-rrangel@chromium.org?part=6