shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 11:26:02 +09:00
Code Issues Packages Projects Releases Wiki Activity

ANDROID: usb: f_accessory: Fix teardown ordering in acc_release()

Browse Source 
acc_release() attempts to synchronise with acc_open() using an atomic
'open_excl' member in 'struct acc_dev'. Unfortunately, acc_release()
prematurely resets this atomic variable to zero, meaning there is a
potential race on 'dev->disconnected':

acc_open()				acc_release()
						atomic_xchg(open_excl), 0)
	atomic_xchg(open_excl, 1)
	dev->disconnected = 0;			dev->disconnected = 1;

Fix the race by ensuring that the 'disconnected' field is written
before clearing 'open_excl' in acc_release().

Bug: 173789633
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: Ib9a21f2305f6d70de3e760da62dbfdd66889200a
This commit is contained in:
Will Deacon
2020-12-15 15:48:22 +00:00
committed by Greg Kroah-Hartman
parent ee4706c18f
commit dafa1fd624
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/gadget/function/f_accessory.c
View File

@@ -889,13 +889,13 @@ static int acc_release(struct inode *ip, struct file *fp)
if (!dev)
return -ENOENT;
WARN_ON(!atomic_xchg(&dev->open_excl, 0));
/* indicate that we are disconnected
* still could be online so don't touch online flag
*/
dev->disconnected = 1;
fp->private_data = NULL;
WARN_ON(!atomic_xchg(&dev->open_excl, 0));
put_acc_dev(dev);
return 0;
}