linux.git/drivers/usb/misc, branch v5.4-rc2

USB: rio500: Fix lockdep violation

2019-09-03T18:18:18+00:00

The syzbot fuzzer found a lockdep violation in the rio500 driver:

	======================================================
	WARNING: possible circular locking dependency detected
	5.3.0-rc2+ #23 Not tainted
	------------------------------------------------------
	syz-executor.2/20386 is trying to acquire lock:
	00000000772249c6 (rio500_mutex){+.+.}, at: open_rio+0x16/0xc0
	drivers/usb/misc/rio500.c:64

	but task is already holding lock:
	00000000d3e8f4b9 (minor_rwsem){++++}, at: usb_open+0x23/0x270
	drivers/usb/core/file.c:39

	which lock already depends on the new lock.

The problem is that the driver's open_rio() routine is called while
the usbcore's minor_rwsem is locked for reading, and it acquires the
rio500_mutex; whereas conversely, probe_rio() and disconnect_rio()
first acquire the rio500_mutex and then call usb_register_dev() or
usb_deregister_dev(), which lock minor_rwsem for writing.

The correct ordering of acquisition should be: minor_rwsem first, then
rio500_mutex (since the locking in open_rio() cannot be changed).
Thus, the probe and disconnect routines should avoid holding
rio500_mutex while doing their registration and deregistration.

This patch adjusts the code in those two routines to do just that.  It
also relies on the fact that the probe and disconnect routines are
protected by the device mutex, so the initial test of rio->present
needs no extra locking.

Reported-by: syzbot+7bbcbe9c9ff0cd49592a@syzkaller.appspotmail.com
Signed-off-by: Alan Stern 
Fixes: d710734b0677 ("USB: rio500: simplify locking")
Acked-by: Oliver Neukum 
CC: 

Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1908081329240.1319-100000@iolanthe.rowland.org
Signed-off-by: Greg Kroah-Hartman

USB: rio500: simplify locking

2019-09-03T18:18:18+00:00

Admitting that there can be only one device allows us to drop any
pretense about locking one device or a table of devices.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

Merge 5.3-rc4 into usb-next

2019-08-12T05:42:51+00:00

We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

USB: usbsevseg: convert to use dev_groups

2019-08-09T05:55:45+00:00

USB drivers now support the ability for the driver core to handle the
creation and removal of device-specific sysfs files in a race-free
manner.  Take advantage of that by converting the driver to use this by
moving the sysfs attributes into a group and assigning the dev_groups
pointer to it.

Link: https://lore.kernel.org/r/20190806144502.17792-12-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

USB: trancevibrator: convert to use dev_groups

2019-08-09T05:55:45+00:00

USB drivers now support the ability for the driver core to handle the
creation and removal of device-specific sysfs files in a race-free
manner.  Take advantage of that by converting the driver to use this by
moving the sysfs attributes into a group and assigning the dev_groups
pointer to it.

Cc: Ding Xiang 
Link: https://lore.kernel.org/r/20190806144502.17792-11-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

USB: cytherm: convert to use dev_groups

2019-08-09T05:55:44+00:00

USB drivers now support the ability for the driver core to handle the
creation and removal of device-specific sysfs files in a race-free
manner.  Take advantage of that by converting the driver to use this by
moving the sysfs attributes into a group and assigning the dev_groups
pointer to it.

Link: https://lore.kernel.org/r/20190806144502.17792-9-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

USB: cypress_cy7c63: convert to use dev_groups

2019-08-09T05:55:44+00:00

USB drivers now support the ability for the driver core to handle the
creation and removal of device-specific sysfs files in a race-free
manner.  Take advantage of that by converting the driver to use this by
moving the sysfs attributes into a group and assigning the dev_groups
pointer to it.

Link: https://lore.kernel.org/r/20190806144502.17792-8-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

USB: lvstest: convert to use dev_groups

2019-08-09T05:55:44+00:00

USB drivers now support the ability for the driver core to handle the
creation and removal of device-specific sysfs files in a race-free
manner.  Take advantage of that by converting the driver to use this by
moving the sysfs attributes into a group and assigning the dev_groups
pointer to it.

Link: https://lore.kernel.org/r/20190806144502.17792-10-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

usb: iowarrior: fix deadlock on disconnect

2019-08-08T10:43:18+00:00

We have to drop the mutex before we close() upon disconnect()
as close() needs the lock. This is safe to do by dropping the
mutex as intfdata is already set to NULL, so open() will fail.

Fixes: 03f36e885fc26 ("USB: open disconnect race in iowarrior")
Reported-by: syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com
Cc: stable 
Signed-off-by: Oliver Neukum 
Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman

Revert "USB: rio500: simplify locking"

2019-08-08T10:43:18+00:00

This reverts commit d710734b06770814de2bfa2819420fb5df7f3a81.
This simplification causes a deadlock.

Reported-by: syzbot+7bbcbe9c9ff0cd49592a@syzkaller.appspotmail.com
Fixes: d710734b0677 ("USB: rio500: simplify locking")
Cc: stable 
Signed-off-by: Oliver Neukum 
Link: https://lore.kernel.org/r/20190808092854.23519-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman