github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 07:03:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
2b00a51112
linux/drivers/usb/misc
History
Alan Stern df9ad14fcc USB: yurex: Fix bad gfp argument 
commit f176ede3a3 upstream.

The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:

do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xf6/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:231
 __warn.cold+0x20/0x50 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
 slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
 slab_alloc_node mm/slub.c:2816 [inline]
 slab_alloc mm/slub.c:2900 [inline]
 kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
 kmalloc include/linux/slab.h:554 [inline]
 dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495

This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.

Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03 11:24:29 +02:00
..
sisusbvga USB: sisusbvga: Fix a potential UB casued by left shifting a negative value 2020-09-03 11:24:22 +02:00
adutux.c USB: adutux: fix interface sanity check 2019-12-17 20:34:40 +01:00
appledisplay.c appledisplay: fix error handling in the scheduled work 2019-12-01 09:17:42 +01:00
chaoskey.c USB: chaoskey: fix error case of a timeout 2019-12-01 09:17:41 +01:00
cypress_cy7c63.c USB: move many drivers to use DEVICE_ATTR_RW 2018-01-24 08:49:51 +01:00
cytherm.c USB: misc: fix up some remaining DEVICE_ATTR() usages 2018-01-24 08:49:52 +01:00
ehset.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
emi26.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
emi62.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
ezusb.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
ftdi-elan.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
idmouse.c USB: idmouse: fix interface sanity checks 2019-12-17 20:34:38 +01:00
iowarrior.c USB: iowarrior: fix up report size handling for some devices 2020-08-11 15:32:30 +02:00
isight_firmware.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
Kconfig USB: rio500: Remove Rio 500 kernel driver 2019-10-17 13:44:47 -07:00
ldusb.c USB: ldusb: use unsigned size format specifiers 2019-11-12 19:21:08 +01:00
legousbtower.c USB: legousbtower: fix a signedness bug in tower_probe() 2019-11-06 13:06:12 +01:00
lvstest.c USB: lvtest: return proper error code in probe 2020-09-03 11:24:27 +02:00
Makefile USB: rio500: Remove Rio 500 kernel driver 2019-10-17 13:44:47 -07:00
trancevibrator.c USB: move many drivers to use DEVICE_ATTR_RW 2018-01-24 08:49:51 +01:00
usb_u132.h USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
usb251xb.c usb: usb251xb: fix to avoid potential NULL pointer dereference 2019-05-04 09:20:20 +02:00
usb3503.c usb: misc: usb3503: make sure reset is low for at least 100us 2018-01-11 18:39:52 +01:00
usb4604.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
usblcd.c USB: usblcd: fix I/O after disconnect 2019-10-17 13:45:04 -07:00
usbsevseg.c USB: misc: fix up some remaining DEVICE_ATTR() usages 2018-01-24 08:49:52 +01:00
usbtest.c usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect 2020-07-09 09:37:09 +02:00
uss720.c usb: misc: uss720: Fix two sleep-in-atomic-context bugs 2018-09-05 14:36:53 +02:00
yurex.c USB: yurex: Fix bad gfp argument 2020-09-03 11:24:29 +02:00