Files
linux/include/linux
Alan Stern c548b99e1c USB: core: Prevent nested device-reset calls
commit 9c6d778800 upstream.

Automatic kernel fuzzing revealed a recursive locking violation in
usb-storage:

============================================
WARNING: possible recursive locking detected
5.18.0 #3 Not tainted
--------------------------------------------
kworker/1:3/1205 is trying to acquire lock:
ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230

but task is already holding lock:
ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230

...

stack backtrace:
CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2988 [inline]
check_deadlock kernel/locking/lockdep.c:3031 [inline]
validate_chain kernel/locking/lockdep.c:3816 [inline]
__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053
lock_acquire kernel/locking/lockdep.c:5665 [inline]
lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747
usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109
r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622
usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:545 [inline]
device_remove+0x11f/0x170 drivers/base/dd.c:537
__device_release_driver drivers/base/dd.c:1222 [inline]
device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248
usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627
usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118
usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114

This turned out not to be an error in usb-storage but rather a nested
device reset attempt.  That is, as the rtl8712 driver was being
unbound from a composite device in preparation for an unrelated USB
reset (that driver does not have pre_reset or post_reset callbacks),
its ->remove routine called usb_reset_device() -- thus nesting one
reset call within another.

Performing a reset as part of disconnect processing is a questionable
practice at best.  However, the bug report points out that the USB
core does not have any protection against nested resets.  Adding a
reset_in_progress flag and testing it will prevent such errors in the
future.

Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6keN==voRbP0g@mail.gmail.com/
Cc: stable@vger.kernel.org
Reported-and-tested-by: Rondreis <linhaoguo86@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-08 12:28:07 +02:00
..
2021-07-21 19:54:21 -07:00
2021-02-02 00:16:57 +01:00
2021-09-20 12:43:34 +01:00
2021-08-29 14:47:42 +03:00
2022-08-25 11:40:05 +02:00
2022-08-17 14:23:11 +02:00
2021-05-06 19:24:11 -07:00
2021-04-14 16:30:30 +03:00
2022-08-31 17:16:34 +02:00
2021-05-24 21:13:05 -07:00
2021-08-16 10:50:32 -06:00
2021-02-26 09:41:03 -08:00
2021-04-08 16:04:20 -07:00
2021-08-26 16:52:03 -07:00
2021-12-14 10:57:11 +01:00
2022-07-07 17:53:26 +02:00
2021-11-25 09:48:41 +01:00
2021-07-20 09:20:49 -07:00
2021-09-07 21:17:28 +02:00
2021-03-22 03:57:39 +01:00
2021-08-26 15:32:28 -04:00
2021-07-27 11:00:36 +02:00
2021-09-06 07:20:56 -04:00
2021-04-12 15:04:23 +02:00
2021-06-25 19:57:01 -04:00
2021-07-26 15:09:44 +02:00
2021-07-27 20:11:45 +01:00
2021-07-27 20:11:44 +01:00
2021-09-03 09:58:13 -07:00
2021-02-11 13:24:44 -08:00
2021-08-05 11:46:42 +01:00
2021-04-30 11:20:40 -07:00
2022-04-13 20:59:03 +02:00
2021-07-27 17:05:06 +01:00
2021-07-27 09:29:15 +02:00
2022-08-17 14:24:08 +02:00
2021-06-01 10:29:21 +01:00
2021-02-26 09:41:03 -08:00
2022-07-23 12:53:57 +02:00
2021-11-18 19:15:51 +01:00
2022-07-12 16:35:08 +02:00
2021-05-12 20:11:17 +02:00
2021-06-17 13:09:27 -04:00
2021-06-15 17:46:57 +02:00
2021-06-29 10:53:53 -07:00
2021-07-01 11:06:05 -07:00
2022-06-09 10:23:32 +02:00
2021-09-17 13:52:17 +01:00
2021-02-26 09:40:59 -08:00
2021-02-03 19:05:50 +01:00
2021-06-16 17:20:40 -05:00
2021-07-06 10:37:46 -05:00
2021-06-07 14:11:47 -07:00
2022-07-02 16:41:17 +02:00
2021-08-18 22:08:24 +02:00
2021-09-02 21:38:56 +02:00
2021-10-07 16:51:57 +02:00
2021-08-17 17:50:51 +02:00
2021-03-18 12:58:27 -04:00
2022-07-12 16:35:08 +02:00
2021-05-10 16:03:35 -07:00
2021-08-06 13:41:48 -07:00
2021-08-19 09:02:55 +09:00
2021-06-24 15:49:32 +02:00
2021-11-21 13:44:12 +01:00
2021-07-01 11:06:03 -07:00
2021-07-27 12:17:21 +02:00
2022-07-29 17:25:32 +02:00
2021-07-27 12:12:08 +02:00
2021-02-13 17:17:53 +01:00
2021-09-08 15:32:35 -07:00
2021-03-30 17:06:49 -07:00
2021-02-09 12:15:07 +01:00
2021-08-11 06:44:24 -04:00
2021-03-30 13:42:33 -04:00
2021-02-08 22:58:55 +01:00