From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27CCAC10F13 for ; Tue, 16 Apr 2019 21:14:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E2E5620821 for ; Tue, 16 Apr 2019 21:14:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729300AbfDPVOk (ORCPT ); Tue, 16 Apr 2019 17:14:40 -0400 Received: from iolanthe.rowland.org ([192.131.102.54]:43688 "HELO iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1728052AbfDPVOj (ORCPT ); Tue, 16 Apr 2019 17:14:39 -0400 Received: (qmail 14034 invoked by uid 2102); 16 Apr 2019 17:14:38 -0400 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 16 Apr 2019 17:14:38 -0400 Date: Tue, 16 Apr 2019 17:14:38 -0400 (EDT) From: Alan Stern X-X-Sender: stern@iolanthe.rowland.org To: syzbot cc: andreyknvl@google.com, , , , , Subject: Re: INFO: task hung in usb_kill_urb In-Reply-To: <000000000000fb61d40586aa6a1e@google.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 16 Apr 2019, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger > crash: Slight fixup to the patch. Unsupported speeds aren't necessarily bogus, and what matters is the actual speed rather than the max_speed. Also, we want to be able to give back unlinked URBs even after a frame's total bandwidth has been exhausted. Alan Stern #syz test: https://github.com/google/kasan.git usb-fuzzer --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_ga struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); struct dummy *dum = dum_hcd->dum; - if (driver->max_speed == USB_SPEED_UNKNOWN) + switch (g->speed) { + /* All the speeds we support */ + case USB_SPEED_LOW: + case USB_SPEED_FULL: + case USB_SPEED_HIGH: + case USB_SPEED_SUPER: + break; + default: + dev_err(dummy_dev(dum_hcd), "Unsupported driver max speed %d\n", + driver->max_speed); return -EINVAL; + } /* * SLAVE side init ... the layer above hardware, which @@ -1784,7 +1794,7 @@ static void dummy_timer(struct timer_lis /* Bus speed is 500000 bytes/ms, so use a little less */ total = 490000; break; - default: + default: /* Can't happen */ dev_err(dummy_dev(dum_hcd), "bogus device speed\n"); return; } @@ -1828,7 +1838,7 @@ restart: /* Used up this frame's bandwidth? */ if (total <= 0) - break; + continue; /* find the gadget's ep for this request (if configured) */ address = usb_pipeendpoint (urb->pipe); From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: INFO: task hung in usb_kill_urb From: Alan Stern Message-Id: Date: Tue, 16 Apr 2019 17:14:38 -0400 (EDT) To: syzbot Cc: andreyknvl@google.com, gregkh@linuxfoundation.org, gustavo@embeddedor.com, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com List-ID: T24gVHVlLCAxNiBBcHIgMjAxOSwgc3l6Ym90IHdyb3RlOgoKPiBIZWxsbywKPiAKPiBzeXpib3Qg aGFzIHRlc3RlZCB0aGUgcHJvcG9zZWQgcGF0Y2ggYW5kIHRoZSByZXByb2R1Y2VyIGRpZCBub3Qg dHJpZ2dlciAgCj4gY3Jhc2g6CgpTbGlnaHQgZml4dXAgdG8gdGhlIHBhdGNoLiAgVW5zdXBwb3J0 ZWQgc3BlZWRzIGFyZW4ndCBuZWNlc3NhcmlseSAKYm9ndXMsIGFuZCB3aGF0IG1hdHRlcnMgaXMg dGhlIGFjdHVhbCBzcGVlZCByYXRoZXIgdGhhbiB0aGUgbWF4X3NwZWVkLgpBbHNvLCB3ZSB3YW50 IHRvIGJlIGFibGUgdG8gZ2l2ZSBiYWNrIHVubGlua2VkIFVSQnMgZXZlbiBhZnRlciBhIApmcmFt ZSdzIHRvdGFsIGJhbmR3aWR0aCBoYXMgYmVlbiBleGhhdXN0ZWQuCgpBbGFuIFN0ZXJuCgojc3l6 IHRlc3Q6IGh0dHBzOi8vZ2l0aHViLmNvbS9nb29nbGUva2FzYW4uZ2l0IHVzYi1mdXp6ZXIKCi0t LSBhL2RyaXZlcnMvdXNiL2dhZGdldC91ZGMvZHVtbXlfaGNkLmMKKysrIGIvZHJpdmVycy91c2Iv Z2FkZ2V0L3VkYy9kdW1teV9oY2QuYwpAQCAtOTc5LDggKzk3OSwxOCBAQCBzdGF0aWMgaW50IGR1 bW15X3VkY19zdGFydChzdHJ1Y3QgdXNiX2dhCiAJc3RydWN0IGR1bW15X2hjZAkqZHVtX2hjZCA9 IGdhZGdldF90b19kdW1teV9oY2QoZyk7CiAJc3RydWN0IGR1bW15CQkqZHVtID0gZHVtX2hjZC0+ ZHVtOwogCi0JaWYgKGRyaXZlci0+bWF4X3NwZWVkID09IFVTQl9TUEVFRF9VTktOT1dOKQorCXN3 aXRjaCAoZy0+c3BlZWQpIHsKKwkvKiBBbGwgdGhlIHNwZWVkcyB3ZSBzdXBwb3J0ICovCisJY2Fz ZSBVU0JfU1BFRURfTE9XOgorCWNhc2UgVVNCX1NQRUVEX0ZVTEw6CisJY2FzZSBVU0JfU1BFRURf SElHSDoKKwljYXNlIFVTQl9TUEVFRF9TVVBFUjoKKwkJYnJlYWs7CisJZGVmYXVsdDoKKwkJZGV2 X2VycihkdW1teV9kZXYoZHVtX2hjZCksICJVbnN1cHBvcnRlZCBkcml2ZXIgbWF4IHNwZWVkICVk XG4iLAorCQkJCWRyaXZlci0+bWF4X3NwZWVkKTsKIAkJcmV0dXJuIC1FSU5WQUw7CisJfQogCiAJ LyoKIAkgKiBTTEFWRSBzaWRlIGluaXQgLi4uIHRoZSBsYXllciBhYm92ZSBoYXJkd2FyZSwgd2hp Y2gKQEAgLTE3ODQsNyArMTc5NCw3IEBAIHN0YXRpYyB2b2lkIGR1bW15X3RpbWVyKHN0cnVjdCB0 aW1lcl9saXMKIAkJLyogQnVzIHNwZWVkIGlzIDUwMDAwMCBieXRlcy9tcywgc28gdXNlIGEgbGl0 dGxlIGxlc3MgKi8KIAkJdG90YWwgPSA0OTAwMDA7CiAJCWJyZWFrOwotCWRlZmF1bHQ6CisJZGVm YXVsdDoJLyogQ2FuJ3QgaGFwcGVuICovCiAJCWRldl9lcnIoZHVtbXlfZGV2KGR1bV9oY2QpLCAi Ym9ndXMgZGV2aWNlIHNwZWVkXG4iKTsKIAkJcmV0dXJuOwogCX0KQEAgLTE4MjgsNyArMTgzOCw3 IEBAIHJlc3RhcnQ6CiAKIAkJLyogVXNlZCB1cCB0aGlzIGZyYW1lJ3MgYmFuZHdpZHRoPyAqLwog CQlpZiAodG90YWwgPD0gMCkKLQkJCWJyZWFrOworCQkJY29udGludWU7CiAKIAkJLyogZmluZCB0 aGUgZ2FkZ2V0J3MgZXAgZm9yIHRoaXMgcmVxdWVzdCAoaWYgY29uZmlndXJlZCkgKi8KIAkJYWRk cmVzcyA9IHVzYl9waXBlZW5kcG9pbnQgKHVyYi0+cGlwZSk7Cg==