]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
USB: ldusb: fix ring-buffer locking
authorJohan Hovold <johan@kernel.org>
Tue, 22 Oct 2019 14:32:02 +0000 (16:32 +0200)
committerKhalid Elmously <khalid.elmously@canonical.com>
Wed, 13 Nov 2019 23:47:34 +0000 (18:47 -0500)
commitb488da6b8963d29f9e5dc1c08a3f9190bbdb7da3
tree09a72fa2547c0c57677ce3a1a5b2773f69c60e0f
parent40eea26b5312365b5c8a5d1125f635246c07834c
USB: ldusb: fix ring-buffer locking

BugLink: https://bugs.launchpad.net/bugs/1852492
commit d98ee2a19c3334e9343df3ce254b496f1fc428eb upstream.

The custom ring-buffer implementation was merged without any locking or
explicit memory barriers, but a spinlock was later added by commit
9d33efd9a791 ("USB: ldusb bugfix").

The lock did not cover the update of the tail index once the entry had
been processed, something which could lead to memory corruption on
weakly ordered architectures or due to compiler optimisations.

Specifically, a completion handler running on another CPU might observe
the incremented tail index and update the entry before ld_usb_read() is
done with it.

Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Fixes: 9d33efd9a791 ("USB: ldusb bugfix")
Cc: stable <stable@vger.kernel.org> # 2.6.13
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191022143203.5260-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
drivers/usb/misc/ldusb.c