Race condition in /proc/bus/usb + hotplug
I am taking this thread to debian-devel. Please direct replies there, as
per the reply-to and mail-followup-to headers. Please remove debian-user
from any further replies.
Marco, Ukai-san, here is a short synopsis of the problem:
1. User hotplugs an USB camera device.
2. Kernel creates usbfs notes for the device, with generic onwership and
permissions (lsusb shows the camera on the listing)
3. hotplug usb.agent gets run and changes permissions and modes
4. lsusb cannot reach the camera anymore, and doesn't list it.
(2) and (3) above are a hideous race that needs to be fixed. It probably
could be used to gain limited, but still unauthorized access to mass-storage
devices for example (I didn't test).
On Mon, 03 Oct 2005, Sayantan Sur wrote:
> > Ah. This means hotplug is probably the one to blame for the race condition.
>
> Looks like it. Can you tell me what should I do to accurately describe
> (collect info) the race condition to the developers of gphoto2/usb
> drivers?
I have not examined the situation very deeply, but to me it smells like
something that is beyond a simple hotplug braindamage. This comment in
/etc/init.d/mountvirtfs supports this hunch:
# Usbfs/usbdevfs is used for USB related binaries/libraries.
# "usbfs" and "usbdevfs" are the exact same filesystem.
# "usbdevfs" was renamed to "usbfs" by linux usb developers,
# because people sometimes mistook it as a part of devfs. Usbfs
# will be superseded by other filesystems (e.g. sysfs), and when
# it becomes obsolete the mount action below should be removed.
In that case, the fix would probably be to get rid of usbfs completely... as
long as whatever is done in sysfs space is not just as broken. I am not
sure we are at a point where we can do it.
And the workaround would be to have the kernel create inodes in usbfs in an
inaccessible state for every non-root process, and later update that through
hotplug. mount(8) seems to indicate this is possible, by using
mount -t usbfs /proc/bus/usb -o devmode=0600,busmode=0500,listmode=0400
I will ask the udev and hotplug maintainers about the issue. In fact, I am
CCing them on this message. Depending on their answers, a bug against
package initscripts is in order...
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: