mirror of
https://github.com/torvalds/linux.git
synced 2026-09-21 12:20:02 +02:00
d5e5cd3654
dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the
"emulated single-request FIFO" fast-path in dummy_queue() reuses for
small IN transfers: it copies the caller's request into it
(req->req = *_req) and queues it, treating list_empty(&fifo_req.queue)
as "the slot is free".
The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows
the standard pattern: list_del_init(&req->queue) unlinks the request,
then the lock is dropped and usb_gadget_giveback_request() invokes
req->complete(). But list_del_init() makes fifo_req.queue look empty
*before* the completion callback returns, so a concurrent dummy_queue()
on another CPU sees the slot as free, reuses fifo_req and runs
req->req = *_req -- overwriting req->complete while dummy_timer is
mid-calling it. The indirect call then jumps to a clobbered pointer,
causing a general protection fault / page fault in dummy_timer
(syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an
in-bounds memcpy on a live shared object, so KASAN cannot flag it.
Add a fifo_req_busy bit covering the shared request's whole lifetime:
set it in dummy_queue() when the FIFO fast-path takes fifo_req (making
it the fast-path guard, replacing the list_empty(&fifo_req.queue)
test), and clear it after the completion callback has returned, via a
dummy_giveback() helper used at all four gadget-request giveback
sites. The shared slot can no longer be reused until its completion
callback has finished.
Reported-by: syzbot+faf3a6cf579fc65591ca@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=faf3a6cf579fc65591ca
Fixes:
|
||
|---|---|---|
| .. | ||
| aspeed-vhub | ||
| bdc | ||
| cdns2 | ||
| amd5536udc_pci.c | ||
| amd5536udc.h | ||
| aspeed_udc.c | ||
| at91_udc.c | ||
| at91_udc.h | ||
| atmel_usba_udc.c | ||
| atmel_usba_udc.h | ||
| bcm63xx_udc.c | ||
| core.c | ||
| dummy_hcd.c | ||
| fsl_qe_udc.c | ||
| fsl_qe_udc.h | ||
| fsl_udc_core.c | ||
| fsl_usb2_udc.h | ||
| goku_udc.c | ||
| goku_udc.h | ||
| gr_udc.c | ||
| gr_udc.h | ||
| Kconfig | ||
| lpc32xx_udc.c | ||
| m66592-udc.c | ||
| m66592-udc.h | ||
| Makefile | ||
| max3420_udc.c | ||
| net2280.c | ||
| net2280.h | ||
| omap_udc.c | ||
| omap_udc.h | ||
| pch_udc.c | ||
| pxa25x_udc.c | ||
| pxa25x_udc.h | ||
| pxa27x_udc.c | ||
| pxa27x_udc.h | ||
| r8a66597-udc.c | ||
| r8a66597-udc.h | ||
| renesas_usb3.c | ||
| renesas_usbf.c | ||
| rzv2m_usb3drd.c | ||
| snps_udc_core.c | ||
| snps_udc_plat.c | ||
| tegra-xudc.c | ||
| trace.c | ||
| trace.h | ||
| udc-xilinx.c | ||