mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-13 22:25:03 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/usb
History
Alan Stern f176ede3a3 USB: yurex: Fix bad gfp argument 
The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:

do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xf6/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:231
 __warn.cold+0x20/0x50 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
 slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
 slab_alloc_node mm/slub.c:2816 [inline]
 slab_alloc mm/slub.c:2900 [inline]
 kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
 kmalloc include/linux/slab.h:554 [inline]
 dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495

This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.

Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-18 11:48:57 +02:00
..
atm usb: Use fallthrough pseudo-keyword 2020-07-10 08:55:17 +02:00
c67x00 Linux 5.8-rc6 2020-07-20 09:41:30 +02:00
cdns3 usb: cdns3: convert to devm_platform_ioremap_resource_byname 2020-07-29 16:49:37 +02:00
chipidea ENDIAN issue fix and one query controller role API is introduced. 2020-07-29 13:57:09 +02:00
class media updates for v5.9-rc1 2020-08-07 13:00:53 -07:00
common usb: common: usb-conn-gpio: Register charger 2020-07-30 08:45:24 +02:00
core USB: Simplify USB ID table match 2020-07-29 16:48:02 +02:00
dwc2 Revert "usb: dwc2: override PHY input signals with usb role switch support" 2020-07-27 15:34:15 +02:00
dwc3 usb: dwc3: convert to devm_platform_ioremap_resource_byname 2020-07-29 16:49:37 +02:00
early usb: early: xhci-dbc: File headers are not good candidates for kerneldoc 2020-07-09 17:19:59 +02:00
gadget USB/Thunderbolt patches for 5.9-rc1 2020-08-05 12:13:10 -07:00
host USB/Thunderbolt patches for 5.9-rc1 2020-08-05 12:13:10 -07:00
image usb: Use fallthrough pseudo-keyword 2020-07-10 08:55:17 +02:00
isp1760 usb: Use fallthrough pseudo-keyword 2020-07-10 08:55:17 +02:00
misc USB: yurex: Fix bad gfp argument 2020-08-18 11:48:57 +02:00
mon
mtu3 usb: mtu3: simplify mtu3_req_complete() 2020-07-29 16:53:59 +02:00
musb USB/Thunderbolt patches for 5.9-rc1 2020-08-05 12:13:10 -07:00
phy usb: phy: am335x: convert to devm_platform_ioremap_resource_byname 2020-07-29 16:49:37 +02:00
renesas_usbhs usb: Use fallthrough pseudo-keyword 2020-07-10 08:55:17 +02:00
roles usb: roles: Switch on role-switch uevent reporting 2020-05-13 14:20:49 +02:00
serial USB-serial updates for 5.9-rc1 2020-07-28 17:33:10 +02:00
storage USB/Thunderbolt patches for 5.9-rc1 2020-08-05 12:13:10 -07:00
typec usb: typec: tcpm: Add WARN_ON ensure we are not trying to send 2 VDM packets at the same time 2020-07-29 14:11:05 +02:00
usbip usbip: Use fallthrough pseudo-keyword 2020-07-09 18:06:35 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile
usb-skeleton.c