system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-20 19:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/usb/misc
History
Alan Stern f176ede3a3 USB: yurex: Fix bad gfp argument 
The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:

do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xf6/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:231
 __warn.cold+0x20/0x50 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
 slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
 slab_alloc_node mm/slub.c:2816 [inline]
 slab_alloc mm/slub.c:2900 [inline]
 kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
 kmalloc include/linux/slab.h:554 [inline]
 dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495

This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.

Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-18 11:48:57 +02:00
..
sisusbvga TTY/Serial patches for 5.9-rc1 2020-08-06 14:56:11 -07:00
adutux.c usb: misc: adutux: Demote obvious misuse of kerneldoc to standard comment blocks 2020-07-09 16:46:57 +02:00
apple-mfi-fastcharge.c USB: apple-mfi-fastcharge: fix endianess issue in probe 2020-02-13 05:07:10 -08:00
appledisplay.c usb: appledisplay: remove needless check before usb_free_coherent() 2020-07-21 13:41:58 +02:00
chaoskey.c USB: chaoskey: fix error case of a timeout 2019-11-11 14:29:39 +01:00
cypress_cy7c63.c USB: cypress_cy7c63: convert to use dev_groups 2019-08-09 07:55:44 +02:00
cytherm.c USB: cytherm: convert to use dev_groups 2019-08-09 07:55:44 +02:00
ehset.c USB: ch9: add "USB_" prefix in front of TEST defines 2020-06-24 15:01:24 +02:00
emi26.c
emi62.c
ezusb.c
ftdi-elan.c usb: ftdi-elan: move a couple of statements to next line 2019-10-04 14:09:42 +02:00
idmouse.c USB: idmouse: fix interface sanity checks 2019-12-10 13:11:22 +01:00
iowarrior.c USB: iowarrior: fix up report size handling for some devices 2020-07-27 13:19:58 +02:00
isight_firmware.c
Kconfig USB: Replace HTTP links with HTTPS ones 2020-07-21 13:41:57 +02:00
ldusb.c usb: misc: ldusb: Demote obvious misuse of kerneldoc to standard comment blocks 2020-07-09 16:47:00 +02:00
legousbtower.c usb: misc: legousbtower: Demote function header which is clearly not kerneldoc 2020-07-09 17:19:56 +02:00
lvstest.c USB: lvstest: convert to use dev_groups 2019-08-09 07:55:44 +02:00
Makefile USB: Add driver to control USB fast charge for iOS devices 2020-02-12 11:01:55 -08:00
trancevibrator.c USB: trancevibrator: convert to use dev_groups 2019-08-09 07:55:45 +02:00
usb251xb.c usb: usb251xb: fix regulator probe and error handling 2020-03-04 10:56:26 +01:00
usb3503.c usb: usb3503: Convert to use GPIO descriptors 2019-12-30 20:40:19 +01:00
usb4604.c
usb_u132.h USB: misc: Use the correct style for SPDX License Identifier 2020-04-16 14:32:47 +02:00
usblcd.c USB: usblcd: use pr_err() 2019-10-04 11:11:08 +02:00
usbsevseg.c USB: usbsevseg: convert to use dev_groups 2019-08-09 07:55:45 +02:00
usbtest.c usb: usbtest: reduce stack usage in test_queue 2020-07-21 13:41:57 +02:00
uss720.c
yurex.c USB: yurex: Fix bad gfp argument 2020-08-18 11:48:57 +02:00