2019-03-22 15:54:29

by Romain Izard

Subject: [PATCH] usb: cdc-acm: fix race during wakeup blocking TX traffic

When the kernel is compiled with preemption enabled, the URB completion
handler can run in parallel with the work responsible for waking up the
tty layer. If the URB handler sets the EVENT_TTY_WAKEUP bit during the
call to tty_port_tty_wakeup() to signal that there is room for additional
input, it will be cleared at the end of this call. As a result, TX traffic
on the upper layer will be blocked.

This can be seen with a kernel configured with CONFIG_PREEMPT, and a fast
modem connected with PPP running over a USB CDC-ACM port.

Use test_and_clear_bit() instead, which ensures that each wakeup requested
by the URB completion code will trigger a call to tty_port_tty_wakeup().

Fixes: 1aba579f3cf5 cdc-acm: handle read pipe errors
Signed-off-by: Romain Izard <[email protected]>
---
drivers/usb/class/cdc-acm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 739f8960811a..ec666eb4b7b4 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -558,10 +558,8 @@ static void acm_softint(struct work_struct *work)
clear_bit(EVENT_RX_STALL, &acm->flags);
}

- if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) {
+ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
tty_port_tty_wakeup(&acm->port);
- clear_bit(EVENT_TTY_WAKEUP, &acm->flags);
- }
}

/*
--
2.17.1

2019-03-26 10:14:54

by Oliver Neukum

Subject: Re: [PATCH] usb: cdc-acm: fix race during wakeup blocking TX traffic

On Fr, 2019-03-22 at 16:53 +0100, Romain Izard wrote:
> When the kernel is compiled with preemption enabled, the URB completion
> handler can run in parallel with the work responsible for waking up the
> tty layer. If the URB handler sets the EVENT_TTY_WAKEUP bit during the
> call to tty_port_tty_wakeup() to signal that there is room for additional
> input, it will be cleared at the end of this call. As a result, TX traffic
> on the upper layer will be blocked.

Good catch.

> This can be seen with a kernel configured with CONFIG_PREEMPT, and a fast
> modem connected with PPP running over a USB CDC-ACM port.
>
> Use test_and_clear_bit() instead, which ensures that each wakeup requested
> by the URB completion code will trigger a call to tty_port_tty_wakeup().
>
> Fixes: 1aba579f3cf5 cdc-acm: handle read pipe errors
> Signed-off-by: Romain Izard <[email protected]>
Acked-by: Oliver Neukum <[email protected]>
> ---
> drivers/usb/class/cdc-acm.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
> index 739f8960811a..ec666eb4b7b4 100644
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -558,10 +558,8 @@ static void acm_softint(struct work_struct *work)
> clear_bit(EVENT_RX_STALL, &acm->flags);
> }
>
> - if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) {
> + if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
> tty_port_tty_wakeup(&acm->port);
> - clear_bit(EVENT_TTY_WAKEUP, &acm->flags);
> - }
> }
>
> /*