Re: [PATCH] usb-gadget-ether: Prevent oops caused by error interrupt race

David Brownell
2007-09-21T22:08:52Z

On Thursday 20 September 2007, Thomas Gleixner wrote:
> From: Benedikt Spranger <bene@linutronix.de>
>
> An USB error interrupt (e.g. disconnect) nukes the pending requests for
> an ethernet gadget device asynchronously. This can race against
> eth_start_xmit(), where we end up dereferencing the list head itself.
>
> The nuke code is serialized against eth_start_xmit via dev->req_lock,
> but we need to check the list for empty first instead of unconditionally
> accessing dev->tx_reqs.next.

Looks OK, although the comments are confusingly incorrect which
made it hard to see what this was doing:

- There is no "nuke()" method in this driver, even comments
don't use that term.

- When "nuke" is used in the gadget stack, it means the way
that controller drivers scrub out a queue of live requests
queued to an endpoint ... *NOT* recycling memory that sits
on a freelist, which is what's involved here.

- Disconnect is *NOT* an error, it's a routine occurrence
which can happen at essentially any time.

If you update the patch and comments accordingly, ACK.

> This is a long standing bug, which should be fixed in stable as well.
>
> Signed-off-by: Benedikt Spranger <bene@linutronix.de>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
>
> diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
> index 593e235..f1d7c82 100644
> --- a/drivers/usb/gadget/ether.c
> +++ b/drivers/usb/gadget/ether.c
> @@ -1989,8 +1989,20 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
> }
>
> spin_lock_irqsave(&dev->req_lock, flags);
> + /*
> + * dev->tx_reqs may be empty due to an error interrupt which

Please reword: "may be empty because disconnecting an
active device cleans out this freelist".

> + * nuked all requests.
> + */
> + if (list_empty(&dev->tx_reqs)) {
> + netif_stop_queue(net);
> + spin_unlock_irqrestore(&dev->req_lock, flags);
> + return 1;
> + }
> +
> req = container_of (dev->tx_reqs.next, struct usb_request, list);
> list_del (&req->list);
> +
> + /* last request in list: stop queue */
> if (list_empty (&dev->tx_reqs))
> netif_stop_queue (net);
> spin_unlock_irqrestore(&dev->req_lock, flags);
>
>