Commit 9de2c43a authored by Pete Zaitcev's avatar Pete Zaitcev Committed by Greg Kroah-Hartman
Browse files

USB: usblp: fix a hang in poll() if disconnected 



Apparently an application that opens a device and calls select()
on it, will hang if the decice is disconnected. It's a little
surprising that we had this bug for 15 years, but apparently
nobody ever uses select() with a printer: only write() and read(),
and those work fine. Well, you can also select() with a timeout.

The fix is modeled after devio.c. A few other drivers check the
condition first, then do not add the wait queue in case the
device is disconnected. We doubt that's completely race-free.
So, this patch adds the process first, then locks properly
and checks for the disconnect.

Reviewed-by: default avatarZqiang <qiang.zhang@windriver.com>
Signed-off-by: default avatarPete Zaitcev <zaitcev@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210303221053.1cf3313e@suzdal.zaitcev.lan


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 414c20df

drivers/usb/class/usblp.c

+12 −4
Original line number Diff line number Diff line
@@ -494,16 +494,24 @@ static int usblp_release(struct inode *inode, struct file *file) 
/* No kernel lock - fine */

static __poll_t usblp_poll(struct file *file, struct poll_table_struct *wait)

{

	__poll_t ret;

	struct usblp *usblp = file->private_data;

	__poll_t ret = 0;

	unsigned long flags;



	struct usblp *usblp = file->private_data;

	/* Should we check file->f_mode & FMODE_WRITE before poll_wait()? */

	poll_wait(file, &usblp->rwait, wait);

	poll_wait(file, &usblp->wwait, wait);



	mutex_lock(&usblp->mut);

	if (!usblp->present)

		ret |= EPOLLHUP;

	mutex_unlock(&usblp->mut);



	spin_lock_irqsave(&usblp->lock, flags);

	ret = ((usblp->bidir && usblp->rcomplete) ? EPOLLIN  | EPOLLRDNORM : 0) |

	   ((usblp->no_paper || usblp->wcomplete) ? EPOLLOUT | EPOLLWRNORM : 0);

	if (usblp->bidir && usblp->rcomplete)

		ret |= EPOLLIN  | EPOLLRDNORM;

	if (usblp->no_paper || usblp->wcomplete)

		ret |= EPOLLOUT | EPOLLWRNORM;

	spin_unlock_irqrestore(&usblp->lock, flags);

	return ret;

}