USB: prevent char device open/deregister race

This patch (as908) adds central protection in usbcore for the
prototypical race between opening and unregistering a char device.
The spinlock used to protect the minor-numbers array is replaced with
an rwsem, which can remain locked across a call to a driver's open()
method.  This guarantees that open() and deregister() will be mutually
exclusive.

The private locks currently used in several individual drivers for
this purpose are no longer necessary, and the patch removes them.  The
following USB drivers are affected: usblcd, idmouse, auerswald,
legousbtower, sisusbvga/sisusb, ldusb, adutux, iowarrior, and
usb-skeleton.

As a side effect of this change, usb_deregister_dev() must not be
called while holding a lock that is acquired by open().  Unfortunately
a number of drivers do this, but luckily the solution is simple: call
usb_deregister_dev() before acquiring the lock.

In addition to these changes (and their consequent code
simplifications), the patch fixes a use-after-free bug in adutux and a
race between open() and release() in iowarrior.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 4 insertions, 17 deletions

diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
index 12bad8a205a7..6e093c2aac2c 100644
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -51,7 +51,6 @@ struct usb_lcd {
 #define USB_LCD_CONCURRENT_WRITES       5
 
 static struct usb_driver lcd_driver;
-static DEFINE_MUTEX(usb_lcd_open_mutex);
 
 
 static void lcd_delete(struct kref *kref)
@@ -69,24 +68,19 @@ static int lcd_open(struct inode *inode, struct file *file)
         struct usb_lcd *dev;
         struct usb_interface *interface;
         int subminor;
-        int retval = 0;
 
         subminor = iminor(inode);
 
-        mutex_lock(&usb_lcd_open_mutex);
         interface = usb_find_interface(&lcd_driver, subminor);
         if (!interface) {
                 err ("USBLCD: %s - error, can't find device for minor %d",
                      __FUNCTION__, subminor);
-                retval = -ENODEV;
-                goto exit;
+                return -ENODEV;
         }
 
         dev = usb_get_intfdata(interface);
-        if (!dev) {
-                retval = -ENODEV;
-                goto exit;
-        }
+        if (!dev)
+                return -ENODEV;
 
         /* increment our usage count for the device */
         kref_get(&dev->kref);
@@ -94,9 +88,7 @@ static int lcd_open(struct inode *inode, struct file *file)
         /* save our object in the file's private structure */
         file->private_data = dev;
 
-exit:
-        mutex_unlock(&usb_lcd_open_mutex);
-        return retval;
+        return 0;
 }
 
 static int lcd_release(struct inode *inode, struct file *file)
@@ -363,17 +355,12 @@ static void lcd_disconnect(struct usb_interface *interface)
         struct usb_lcd *dev;
         int minor = interface->minor;
 
-        /* prevent skel_open() from racing skel_disconnect() */
-        mutex_lock(&usb_lcd_open_mutex);
-
         dev = usb_get_intfdata(interface);
         usb_set_intfdata(interface, NULL);
 
         /* give back our minor */
         usb_deregister_dev(interface, &lcd_class);
  
-        mutex_unlock(&usb_lcd_open_mutex);
-
         /* decrement our usage count */
         kref_put(&dev->kref, lcd_delete);