Possible race condition in usb_hid

[lainy]

While looking through the code I found a possible race condition in usbd_hid.c:

void usb_hid_recieve_callback(uint8_t ep)
{
    fifo_hidmsg_add(hidmsg_buf);
    memset(hidmsg_buf,0,64);
    USBD_LL_PrepareReceive(&Solo_USBD_Device,
            HID_ENDPOINT,
            hidmsg_buf,
            HID_PACKET_SIZE);
}

The above fifo_hidmsg_add is ultimately called from USB_IRQHandler which seems to run directly from interrupt context (see startup_stm32l432xx.s).
However, as best I can tell (FIFO functions defined here), neither fifo_hidmsg_add nor fifo_hidmsg_take (or its usage in the code) are guarding against interrupts.

Posting as an issue because I do not believe this represents a security vulnerability, but if a HID request comes in while fifo_hidmsg_take is running, I suspect it will bork the FIFO state.

[szszszsz]

Hi!
Thank you for the report! Looks interesting - will check it next week.

[szszszsz]

Indeed it seems, that _add could be fired while executing _take. Added IRQ global handling. To be tested.