Re: [PATCH] usbip: fix vhci races in connection tear down

[Shuah Khan]

On 3/12/21 3:45 AM, Johan Hovold wrote:
> On Thu, Mar 11, 2021 at 07:27:37PM -0700, Shuah Khan wrote:
> > vhci_shutdown_connection() references connection state (tcp_socket,
> > tcp_rx, tcp_tx, sockfd) saved in usbpip_device without holding the
> > lock.
> >
> > Current connection tear down sequence:
> > Step 1: shutdown the socket
> > Step 2: stop rx thread and reset tcp_rx pointer
> > Step 3: stop tx thread and reset tcp_tx pointer
> > Step 4: Reset tcp_socket and sockfd
> >
> > There are several race windows between these steps. In addition, device
> > reset routine (vhci_device_reset) resets tcp_socket and sockfd holding
> > the lock.
> >
> > Fix these races:
> > - Introduce in_disconnect flag to ensure vhci_shutdown_connection() runs
> >    only once.
> > - Change attach_store() to initialize in_disconnect to false while
> >    initializing connection status (tcp_socket, tcp_rx, tcp_tx, sockfd)
> > - Change vhci_shutdown_connection() to check in_disconnect and bail
> >    out if disconnect is in progress.
> > - Change vhci_shutdown_connection() to
> >    -- hold lock to save connection state pointers and unlock.
> >    -- Shutdown the socket and stop threads.
> >    -- Hold lock to clear connection status and in_disconnect flag.
> > - Change vhci_device_reset() to reset tcp_socket and sockfd.
> >    if !in_disconnect
> >
> > Tested syzbot and the reproducer did not trigger any issue.
> >
> > Reported-and-tested-by: syzbot+a93fba6d384346a761e3@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Signed-off-by: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx>
> > ---
> >   drivers/usb/usbip/usbip_common.h |  1 +
> >   drivers/usb/usbip/vhci_hcd.c     | 55 +++++++++++++++++++++++---------
> >   drivers/usb/usbip/vhci_sysfs.c   |  4 +++
> >   3 files changed, 45 insertions(+), 15 deletions(-)
>
> > diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
> > index 3209b5ddd30c..c1917efe5737 100644
> > --- a/drivers/usb/usbip/vhci_hcd.c
> > +++ b/drivers/usb/usbip/vhci_hcd.c
> > @@ -1007,31 +1007,54 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
> >   static void vhci_shutdown_connection(struct usbip_device *ud)
> >   {
> >   	struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);
> > +	unsigned long flags;
> > +	struct socket *socket;
> > +	struct task_struct *tcp_rx = NULL;
> > +	struct task_struct *tcp_tx = NULL;
> > +	int sockfd = 0;
> > +
> > +	spin_lock_irqsave(&ud->lock, flags);
> > +	if (vdev->ud.in_disconnect) {
> > +		pr_info("%s: Disconnect in progress for sockfd %d\n",
> > +			__func__, ud->sockfd);
>
> Looks like you forgot to remove all you debug printks like this one
> before submitting.

Some printks were already in there and helped with debug. Yes I added
a few more when I submitted for syzbot testing.

I will clean them up i v2.

thanks,
-- Shuah