Commit d98ee2a1 authored Oct 22, 2019 by Johan Hovold Committed by Greg Kroah-Hartman Oct 28, 2019

USB: ldusb: fix ring-buffer locking



The custom ring-buffer implementation was merged without any locking or
explicit memory barriers, but a spinlock was later added by commit
9d33efd9 ("USB: ldusb bugfix").

The lock did not cover the update of the tail index once the entry had
been processed, something which could lead to memory corruption on
weakly ordered architectures or due to compiler optimisations.

Specifically, a completion handler running on another CPU might observe
the incremented tail index and update the entry before ld_usb_read() is
done with it.

Fixes: 2824bd25 ("[PATCH] USB: add ldusb driver")
Fixes: 9d33efd9 ("USB: ldusb bugfix")
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191022143203.5260-2-johan@kernel.org


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent d482c7bb

drivers/usb/misc/ldusb.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -495,11 +495,11 @@ static ssize_t ld_usb_read(struct file file, char __user buffer, size_t count,
		retval = -EFAULT;
		goto unlock_exit;
		}
		dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size;

		retval = bytes_to_read;

		spin_lock_irq(&dev->rbsl);
		dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size;

		if (dev->buffer_overflow) {
		dev->buffer_overflow = 0;
		spin_unlock_irq(&dev->rbsl);

Admin message