[PATCH] usbnet: fix race condition caused spinlock bad magic issue

[PATCH] usbnet: fix race condition caused spinlock bad magic issue

[wangbiao]

From: wang, biao <biao.wang@intel.com>
Date: Mon, 11 Nov 2013 10:23:40 +0800
Subject: [PATCH] usbnet: fix race condition caused spinlock bad magic issue

there is race between usbnet_terminate_urbs and usbnet_bh, when
unlink_wakeup used in usbnet_bh, it may be already freed and used by
other function as unlink_wakeup was a local var on stack.

btw, dev->wait should be judged again before use it as there is race
too.

Signed-off-by: wang, biao <biao.wang@intel.com>
---
 drivers/net/usb/usbnet.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 90a429b..22fc27f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -86,6 +86,7 @@ static const char driver_name [] = "usbnet";
 
 /* use ethtool to change the level for any given device */
 static int msg_level = -1;
+static wait_queue_head_t unlink_wakeup;
 module_param (msg_level, int, 0);
 MODULE_PARM_DESC (msg_level, "Override default message level");
 
@@ -761,7 +762,6 @@ EXPORT_SYMBOL_GPL(usbnet_unlink_rx_urbs);
 // precondition: never called in_interrupt
 static void usbnet_terminate_urbs(struct usbnet *dev)
 {
-	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(unlink_wakeup);
 	DECLARE_WAITQUEUE(wait, current);
 	int temp;
 
@@ -1448,8 +1448,10 @@ static void usbnet_bh (unsigned long param)
 
 	// waiting for all pending urbs to complete?
 	if (dev->wait) {
+		wait_queue_head_t *wait_d = dev->wait;
 		if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
-			wake_up (dev->wait);
+			if (wait_d)
+				wake_up(wait_d);
 		}
 
 	// or are we maybe short a few urbs?
@@ -1602,6 +1604,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 	init_timer (&dev->delay);
 	mutex_init (&dev->phy_mutex);
 	mutex_init(&dev->interrupt_mutex);
+	init_waitqueue_head(&unlink_wakeup);
 	dev->interrupt_count = 0;
 
 	dev->net = net;
-- 
1.7.0.4

Re: [PATCH] usbnet: fix race condition caused spinlock bad magic issue

[Oliver Neukum]

On Mon, 2013-11-11 at 11:08 +0800, wangbiao wrote:
> From: wang, biao <biao.wang@intel.com>
> Date: Mon, 11 Nov 2013 10:23:40 +0800
> Subject: [PATCH] usbnet: fix race condition caused spinlock bad magic issue
> 
> there is race between usbnet_terminate_urbs and usbnet_bh, when
> unlink_wakeup used in usbnet_bh, it may be already freed and used by
> other function as unlink_wakeup was a local var on stack.

Hi,

the debugging is good, but the fix is not good.

If you use a global variable, you can init the head
only once, that is on module load, not during probe()
Doing so can mess up operations with multiple modules
as a hotplug happens.

	Regards
		Oliver

Re: [PATCH] usbnet: fix race condition caused spinlock bad magic issue

[Ingo Molnar]

* wangbiao <biao.wang@intel.com> wrote:

> @@ -1448,8 +1448,10 @@ static void usbnet_bh (unsigned long param)
>  
>  	// waiting for all pending urbs to complete?
>  	if (dev->wait) {
> +		wait_queue_head_t *wait_d = dev->wait;
>  		if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
> -			wake_up (dev->wait);
> +			if (wait_d)
> +				wake_up(wait_d);
>  		}
>  
>  	// or are we maybe short a few urbs?

1)

Nit: the scope of 'wait_d' is unnecessarily broad, it could be moved to 
the block that uses it.

2)

Also, the changelog mentions that dev->wait can race - it would be nice to 
add to the changelog what exact synchronization mechanism protects 
usbnet_terminate_urbs() and usbnet_bh() from seeing/modifying that value 
at once - as the code was clearly written without such interaction in 
mind.

> @@ -1602,6 +1604,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
>  	init_timer (&dev->delay);
>  	mutex_init (&dev->phy_mutex);
>  	mutex_init(&dev->interrupt_mutex);
> +	init_waitqueue_head(&unlink_wakeup);

3)

Can that runtime initialization be avoided by using 
DECLARE_WAIT_QUEUE_HEAD()?

Thanks,

	Ingo