OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/drivers/usb/misc
History
Alan Stern ad0bc424fc USB: yurex: Fix bad gfp argument 
commit f176ede3a3 upstream.

The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:

do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xf6/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:231
 __warn.cold+0x20/0x50 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
 slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
 slab_alloc_node mm/slub.c:2816 [inline]
 slab_alloc mm/slub.c:2900 [inline]
 kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
 kmalloc include/linux/slab.h:554 [inline]
 dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495

This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.

Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2020-09-03 11:27:07 +02:00
..
sisusbvga USB: sisusbvga: Fix a potential UB casued by left shifting a negative value 2020-09-03 11:26:48 +02:00
Kconfig USB: rio500: Remove Rio 500 kernel driver 2019-10-04 10:53:36 +02:00
Makefile USB: rio500: Remove Rio 500 kernel driver 2019-10-04 10:53:36 +02:00
adutux.c USB: adutux: fix interface sanity check 2019-12-17 19:55:47 +01:00
appledisplay.c appledisplay: fix error handling in the scheduled work 2019-11-29 10:10:25 +01:00
chaoskey.c USB: chaoskey: fix error case of a timeout 2019-11-29 10:10:24 +01:00
cypress_cy7c63.c USB: cypress_cy7c63: convert to use dev_groups 2019-08-09 07:55:44 +02:00
cytherm.c USB: cytherm: convert to use dev_groups 2019-08-09 07:55:44 +02:00
ehset.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
emi26.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
emi62.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
ezusb.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
ftdi-elan.c usb: ftdi-elan: fix possible condition with no effect (if == else) 2019-06-03 15:21:57 +02:00
idmouse.c USB: idmouse: fix interface sanity checks 2019-12-17 19:55:45 +01:00
iowarrior.c USB: iowarrior: fix up report size handling for some devices 2020-08-11 15:33:32 +02:00
isight_firmware.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
ldusb.c USB: ldusb: fix control-message timeout 2019-10-28 17:46:24 +01:00
legousbtower.c USB: legousbtower: fix a signedness bug in tower_probe() 2019-10-15 20:07:43 +02:00
lvstest.c USB: lvtest: return proper error code in probe 2020-09-03 11:27:02 +02:00
trancevibrator.c USB: trancevibrator: convert to use dev_groups 2019-08-09 07:55:45 +02:00
usb251xb.c usb: usb251xb: Reallow swap-dx-lanes to apply to the upstream port 2019-07-25 11:16:19 +02:00
usb3503.c usb: misc: usb3503: get optional clock by devm_clk_get_optional() 2019-04-19 14:24:25 +02:00
usb4604.c USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
usb_u132.h USB: misc: Remove redundant license text 2017-11-04 11:55:38 +01:00
usblcd.c USB: usblcd: use pr_err() 2019-10-04 11:11:08 +02:00
usbsevseg.c USB: usbsevseg: convert to use dev_groups 2019-08-09 07:55:45 +02:00
usbtest.c usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect 2020-07-09 09:37:50 +02:00
uss720.c usb: misc: uss720: Fix two sleep-in-atomic-context bugs 2018-09-05 14:36:53 +02:00
yurex.c USB: yurex: Fix bad gfp argument 2020-09-03 11:27:07 +02:00