Files
linux/include/linux
Alan Stern abe3cfb7a7 USB: core: Prevent nested device-reset calls
commit 9c6d778800 upstream.

Automatic kernel fuzzing revealed a recursive locking violation in
usb-storage:

============================================
WARNING: possible recursive locking detected
5.18.0 #3 Not tainted
--------------------------------------------
kworker/1:3/1205 is trying to acquire lock:
ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230

but task is already holding lock:
ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230

...

stack backtrace:
CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2988 [inline]
check_deadlock kernel/locking/lockdep.c:3031 [inline]
validate_chain kernel/locking/lockdep.c:3816 [inline]
__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109
r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622
usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:545 [inline]
device_remove+0x11f/0x170 drivers/base/dd.c:537
__device_release_driver drivers/base/dd.c:1222 [inline]
device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248
usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627
usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118
usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114

This turned out not to be an error in usb-storage but rather a nested
device reset attempt.  That is, as the rtl8712 driver was being
unbound from a composite device in preparation for an unrelated USB
reset (that driver does not have pre_reset or post_reset callbacks),
its ->remove routine called usb_reset_device() -- thus nesting one
reset call within another.

Performing a reset as part of disconnect processing is a questionable
practice at best.  However, the bug report points out that the USB
core does not have any protection against nested resets.  Adding a
reset_in_progress flag and testing it will prevent such errors in the
future.

Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6keN==voRbP0g@mail.gmail.com/
Cc: stable@vger.kernel.org
Reported-and-tested-by: Rondreis <linhaoguo86@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 11:11:40 +02:00
..
2019-12-11 09:12:38 +01:00
2019-11-12 11:43:29 -05:00
2022-08-21 15:16:16 +02:00
2020-06-25 22:25:13 -07:00
2020-06-16 14:19:57 +02:00
2020-05-24 20:48:11 +02:00
2020-09-21 15:00:40 -07:00
2020-10-02 15:00:49 -07:00
2020-10-16 17:21:51 +02:00
2022-07-07 17:52:17 +02:00
2020-03-09 11:12:19 +01:00
2019-12-03 11:20:37 +01:00
2020-06-16 19:25:20 +02:00
2020-08-12 20:42:08 +02:00
2020-06-17 00:07:38 +02:00
2022-09-05 10:28:58 +02:00
2020-03-06 11:06:15 +01:00
2020-07-24 17:12:41 -07:00
2020-08-04 21:02:38 -04:00
2019-10-04 12:31:46 -07:00
2019-10-15 13:34:25 +02:00
2020-09-16 08:54:53 -05:00
2022-04-13 21:00:56 +02:00
2020-05-18 10:30:21 +01:00
2020-08-26 12:41:56 +02:00
2020-11-19 22:38:29 -05:00
2020-10-13 18:38:32 -07:00
2019-12-04 19:44:14 -08:00
2020-06-02 15:15:46 +01:00
2019-12-11 09:12:38 +01:00
2021-03-04 11:37:59 +01:00
2022-08-21 15:16:08 +02:00
2020-09-04 09:25:20 -07:00
2021-02-07 15:37:17 +01:00
2021-11-18 14:03:37 +01:00
2020-05-08 18:18:11 +01:00
2020-05-08 00:12:42 +02:00
2020-05-28 10:31:09 +02:00
2020-03-06 11:56:59 +01:00
2022-08-21 15:15:21 +02:00
2020-09-04 12:46:07 +01:00
2021-06-30 08:47:26 -04:00
2020-08-27 16:06:47 -04:00
2019-08-14 15:30:35 +02:00
2019-11-14 19:06:47 -08:00
2020-10-07 14:28:39 -04:00
2020-05-09 13:57:12 +02:00
2020-07-01 10:49:02 +02:00
2021-09-03 10:09:21 +02:00
2020-07-23 17:34:18 +10:00
2020-05-15 13:51:28 -07:00
2020-08-31 12:52:33 -07:00
2021-03-30 14:32:05 +02:00
2020-10-18 09:27:10 -07:00
2020-05-09 13:57:12 +02:00
2020-08-18 17:06:15 +02:00
2020-08-07 11:33:24 -07:00
2020-09-26 22:55:05 -04:00
2021-05-07 11:04:32 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:31 +02:00
2020-07-04 09:35:36 -05:00
2020-09-10 14:03:31 -07:00
2020-08-01 11:28:17 +02:00
2020-04-01 12:06:26 -04:00
2020-10-05 13:21:49 +02:00