Page MenuHome GnuPG

a race condition between intr_cb call back and libusb_free_transfer in do_close_reader
Closed, ResolvedPublic

Description

For the reader of VENDOR_SCD, ->powered_off may be set in foreground.
This makes a race condition between intr_cb call back and libusb_free_transfer in do_close_reader,
which might cause segv.

Event Timeline

gniibe changed the task status from Open to Testing.Nov 5 2020, 8:24 AM
gniibe added a project: gnupg.
gniibe edited projects, added Testing, gnupg (gpg22); removed gnupg.

For SPR532, we need following.

  • We can't assume (like other card readers with interrupt transfer support) intr_cb is called when no-card is detected for SPR532.
    • When card is removed during the communication, SPR532 never emit the interrupt transfer.
  • Normally, card removal is detected by intr_cb.
  • The card removal should be able to be detected by scd_update_reader_status_file, too
    • No need of periodical call to scd_update_reader_status_file
      • Only when a communication error, we call scd_update_reader_status_file to see the card status by apdu_get_status
      • When no card is detected, close the reader from scd_update_reader_status

And on close of the reader,

  • it cancels the handle->transfer of intr_cb if ->power_off is not yet set (by intr_cb).
  • ^-- no race here any more with the change
    • before the change, it goes to libusb_free_transfer then intr_cb which accesses freed object.