Received: by 2002:a05:6358:111d:b0:dc:6189:e246 with SMTP id f29csp169082rwi; Sun, 30 Oct 2022 22:44:14 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6IJKo+4J8MFmYn4BL/jHpmB1xLXP+MqLGGqMgiG7TeLl7DwY7B7SIOdIoX3LOf+FmmsKu/ X-Received: by 2002:a17:90b:1c10:b0:213:1bb8:feb with SMTP id oc16-20020a17090b1c1000b002131bb80febmr29844958pjb.214.1667195054068; Sun, 30 Oct 2022 22:44:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667195054; cv=none; d=google.com; s=arc-20160816; b=XT56FR7PvSxwi0lWb2V+y+tor2JAA3CIoeBjlGJL+jpKVAoCOuto0xzd4OUykR9RET 8DC/3jwmr230gDmDbKuFcCpT8kMCvsQvFRZnXdCld8gvG6dL6gM+x2lCxv/Z3iFvcFvG oJ1L25NqBDJzex/5FCmfb+tkwg97HWJ2HvSEWnYfG/EQQZf/cwih2Wownc+CAitzH+GT GGsPEj0t0n2HdnALdeCc8u2mHeE+Q/j+UMxlJHMq1dh50XZBbi+49E+lmoX4Va3/rqpR UAMF0Yx0kF9jAbuLGCi2D58St0P9WYTeDsoDNMIzNpvbI8HbyXcS3BUADehOIMjy15Z+ H3iw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=/HZ6crvrNBTL6o/aXnYYfBzUet5Ca72Allf+X0NXNiw=; b=RfpJou0UDaBziM37oqcAFHS6y6PCsjhOHFf35SlpeCyXa/K8dPiI1a2J9/p3K6t2iy WyybqMSCxRHvRUS7zT5nooWrFVnBPdp+4QMCzBmtHvq/GQRI8QJF5IxYntQaeGEBeyVo QFcJCO8FV7Nz1lR+UUtAHv3EPAIFvO8fyliU9kmYMStefT8l7OUJVmcuEIl0eM8VoKWS 88FrctzNzviRJfWdIk3lqWIVTNUKw6MNMTTV/E2gXi29nBmwCpatk4hvhIixUsI3N61D YO1YP4wy0nHjitVkGmwiPiUS+nf6fGuke5SDHK20P9aNOTMix3svX89bl8gqcPQYWiHb 9w5Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=gtXgfOOE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i12-20020a170902cf0c00b001869c57b02bsi7904978plg.144.2022.10.30.22.44.01; Sun, 30 Oct 2022 22:44:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=gtXgfOOE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229682AbiJaEuT (ORCPT + 99 others); Mon, 31 Oct 2022 00:50:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59274 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229457AbiJaEuS (ORCPT ); Mon, 31 Oct 2022 00:50:18 -0400 Received: from mail-pj1-x102f.google.com (mail-pj1-x102f.google.com [IPv6:2607:f8b0:4864:20::102f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8954B95B5; Sun, 30 Oct 2022 21:50:15 -0700 (PDT) Received: by mail-pj1-x102f.google.com with SMTP id c15-20020a17090a1d0f00b0021365864446so9319482pjd.4; Sun, 30 Oct 2022 21:50:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=/HZ6crvrNBTL6o/aXnYYfBzUet5Ca72Allf+X0NXNiw=; b=gtXgfOOETY0QbgHWKjBz11xbn0px9egOMV/kBPSZhOaiDM4RRxoD7QvhI9STewMTmV EK7Fmwd9VkrA5ze2tHotTsoqIvxNQFiUCAGm6LRHlvWKsWsIu36ANx2M0CmhgnXSear7 GcZ18DkFZd2agAhE3WVxEcFh40rgdaDd+9wQV35rAg93Ntoqhdp+AeSId+swffyFjyO0 /ZP1UYdrHoZ2RDCPoy0f750CPZdY86CBYjYdzw3bnAaDzz15HBVT0nT8MG6sP0z3foov Cx9i/qBMfBxK1wGCd2xnI4DNTfIWWuqBWAXDixYzbuAEXjaJXtV4rajk98uWFQBARauN 22/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=/HZ6crvrNBTL6o/aXnYYfBzUet5Ca72Allf+X0NXNiw=; b=jDTZptCelkKymQgJkEVye1HwX3bWKAJ0EmmRt28nrXR88YDN0v0wMt5rwzBZlQ+r7n oO9bNKSk4NAdyLo4r7N6hIiX9692uTbRgXxb/C7/wMSIcntQ8hec8diqn6qhozdHhBQK RGdzRHr3TqNAW3xnOGXEnYuwkn2RrwiMZzmxov8D8kdAWEJPux7lUVQHaoLWfle1prto /il9OUAi4L0GVTH70PQndAStg/H4Zz3z8wy5nYjiJtBUenBg7Vm4AzNGaqiNouE3J3QB +KkdS7OIyH7lTmAy3yM0hmORH5aeff23aoDaEf4zDIzaYJsE8WorkxNlCBAYRn0IaURf fMJg== X-Gm-Message-State: ACrzQf3R33hqtHRT5t67JQjd8VzH/5V69o+T50c+052m7OW7PnSZSr4c EluMPlNyu14ESPJ7lKCDHOY= X-Received: by 2002:a17:902:c7c1:b0:186:b766:5dde with SMTP id r1-20020a170902c7c100b00186b7665ddemr12839009pla.93.1667191814821; Sun, 30 Oct 2022 21:50:14 -0700 (PDT) Received: from biggie ([103.230.148.186]) by smtp.gmail.com with ESMTPSA id c9-20020a170902d48900b00183e2a96414sm3445911plg.121.2022.10.30.21.50.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 30 Oct 2022 21:50:14 -0700 (PDT) Date: Mon, 31 Oct 2022 10:20:09 +0530 From: Gautam Menghani To: sean@mess.org, mchehab@kernel.org Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+0c3cb6dc05fbbdc3ad66@syzkaller.appspotmail.com Subject: Re: [PATCH] drivers/media/rc: Fix a race condition in send_packet() Message-ID: References: <20221019050214.107448-1-gautammenghani201@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221019050214.107448-1-gautammenghani201@gmail.com> X-Spam-Status: No, score=-1.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_ENVFROM_END_DIGIT, FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Oct 19, 2022 at 10:32:14AM +0530, Gautam Menghani wrote: > The function send_packet() has a race condition as follows: > func send_packet() > { > // do work > call usb_submit_urb() > mutex_unlock() > wait_for_event_interruptible() <-- lock gone > mutex_lock() > } > > func vfd_write() > { > mutex_lock() > call send_packet() <- prev call is not completed > mutex_unlock() > } > > When the mutex is unlocked and the function send_packet() waits for the > call to complete, vfd_write() can start another call, which leads to the > "URB submitted while active" warning in usb_submit_urb(). > Fix this by removing the mutex_unlock() call in send_packet() and using > mutex_lock_interruptible(). > > Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") > Link: https://syzkaller.appspot.com/bug?id=e378e6a51fbe6c5cc43e34f131cc9a315ef0337e > Reported-by: syzbot+0c3cb6dc05fbbdc3ad66@syzkaller.appspotmail.com > > Signed-off-by: Gautam Menghani > --- > drivers/media/rc/imon.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c > index 735b925da998..91d8056666ec 100644 > --- a/drivers/media/rc/imon.c > +++ b/drivers/media/rc/imon.c > @@ -646,15 +646,14 @@ static int send_packet(struct imon_context *ictx) > pr_err_ratelimited("error submitting urb(%d)\n", retval); > } else { > /* Wait for transmission to complete (or abort) */ > - mutex_unlock(&ictx->lock); > retval = wait_for_completion_interruptible( > &ictx->tx.finished); > if (retval) { > usb_kill_urb(ictx->tx_urb); > pr_err_ratelimited("task interrupted\n"); > } > - mutex_lock(&ictx->lock); > > + ictx->tx.busy = false; > retval = ictx->tx.status; > if (retval) > pr_err_ratelimited("packet tx failed (%d)\n", retval); > @@ -955,7 +954,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, > if (ictx->disconnected) > return -ENODEV; > > - mutex_lock(&ictx->lock); > + if (mutex_lock_interruptible(&ictx->lock)) > + return -ERESTARTSYS; > > if (!ictx->dev_present_intf0) { > pr_err_ratelimited("no iMON device present\n"); > -- > 2.34.1 > Hi, Please review the above fix and let me know if any changes are required. Thanks, Gautam