[PATCH v3 0/2] usbip: usbip_host: remove legacy rebind_store in favor of drivers_probe

do_rebind, which sleeps normally gets a mutex lock. However, it does not
or should I say, cannot check for null udev between spin lock dropped in
rebind_store and entering do_rebind. This is a potential race window
already. So, even if we check for null udev under spinlock, we cannot do
it outside. Regarding do_rebind, it is called during stub_device_rebind,
but that function is called during module exit when all files are removed.
So, do_rebind is not designed to work in a concurrent environment in the
first place.

We have a safer function that can already do what do_rebind does,
drivers_probe. So, we use drivers_probe to rebind the device rather than
use rebind_store.

usbip tool references this function immediately after the device is unbound,
which is safe for the tool itself but since we opted for drivers_probe, fix
it by using drivers_probe rather than rebind_store after unbinding device
which is more safer.

Tested and working in both userspace via the tool and manually echoing
the busid in the related nodes. rebind node is still left active with a
warning to use drivers_probe upon encountering rebind_store.

Thanks,
Jeffin.

Signed-off-by: Jeffin Philip <[email protected]>
---
Changes in v3:
 - Removed rebind_store in favor of drivers_probe to eliminate race
   condition
Changes in v2:
 - Addressed concerns raised by the Greg KH in v1 discussion
   - Added usb_get_dev() to get a reference to udev preventing
     it from becoming null after the null check. Drop the reference
     after using it in do_rebind(). Did not fix the race.
v1:
 - Initial patch with a udev null check that returns -ENODEV if udev
   is null.
---

Jeffin Philip (2):
  usbip: usbip_host: fix null pointer dereference in rebind_store
  usbip: tools: replace faulty rebind_store with drivers_probe

 drivers/usb/usbip/stub_main.c      | 27 +--------------------------
 tools/usb/usbip/src/usbip_unbind.c |  7 +++----
 2 files changed, 4 insertions(+), 30 deletions(-)

--
2.55.0