From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alan Stern <stern@rowland.harvard.edu>,
syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Subject: [PATCH 4.4 54/62] USB: yurex: Fix bad gfp argument
Date: Tue, 1 Sep 2020 17:10:37 +0200 [thread overview]
Message-ID: <20200901150923.460492636@linuxfoundation.org> (raw)
In-Reply-To: <20200901150920.697676718@linuxfoundation.org>
From: Alan Stern <stern@rowland.harvard.edu>
commit f176ede3a3bde5b398a6777a7f9ff091baa2d3ff upstream.
The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:
do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xf6/0x16e lib/dump_stack.c:118
panic+0x2aa/0x6e1 kernel/panic.c:231
__warn.cold+0x20/0x50 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
slab_alloc_node mm/slub.c:2816 [inline]
slab_alloc mm/slub.c:2900 [inline]
kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
kmalloc include/linux/slab.h:554 [inline]
dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495
This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.
Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/yurex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -510,7 +510,7 @@ static ssize_t yurex_write(struct file *
prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
dev->cntl_buffer[0]);
- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
+ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
if (retval >= 0)
timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
finish_wait(&dev->waitq, &wait);
next prev parent reply other threads:[~2020-09-01 17:18 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 01/62] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 02/62] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 03/62] ipvlan: fix device features Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 04/62] bonding: show saner speed for broadcast mode Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 05/62] bonding: fix a potential double-unregister Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 06/62] powerpc/pseries: Do not initiate shutdown when system is running on UPS Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 07/62] ALSA: pci: delete repeated words in comments Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 08/62] ASoC: tegra: Fix reference count leaks Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 09/62] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 10/62] scsi: target: tcmu: Fix crash on ARM during cmd completion Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 11/62] drm/amdkfd: Fix reference count leaks Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 12/62] drm/radeon: fix multiple reference count leak Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 13/62] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 14/62] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 15/62] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 16/62] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 17/62] scsi: lpfc: Fix shost refcount mismatch when deleting vport Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 18/62] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 19/62] PCI: Fix pci_create_slot() reference count leak Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 20/62] rtlwifi: rtl8192cu: Prevent leaking urb Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 21/62] mips/vdso: Fix resource leaks in genvdso.c Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 22/62] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 23/62] drm/nouveau: Fix reference count leak in nouveau_connector_detect Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 24/62] locking/lockdep: Fix overflow in presentation of average lock-time Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 25/62] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 26/62] ceph: fix potential mdsc use-after-free crash Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 27/62] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 28/62] EDAC/ie31200: Fallback if host bridge device is already initialized Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 29/62] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 30/62] powerpc/spufs: add CONFIG_COREDUMP dependency Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 31/62] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 32/62] Revert "ath10k: fix DMA related firmware crashes on multiple devices" Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 33/62] i2c: rcar: in slave mode, clear NACK earlier Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 34/62] jbd2: make sure jh have b_transaction set in refile/unfile_buffer Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 35/62] jbd2: abort journal if free a async write error metadata buffer Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 36/62] s390/cio: add cond_resched() in the slow_eval_known_fn() loop Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 37/62] scsi: ufs: Fix possible infinite loop in ufshcd_hold Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 38/62] net: gianfar: Add of_node_put() before goto statement Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 39/62] powerpc/perf: Fix soft lockups due to missed interrupt accounting Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 40/62] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 41/62] USB: lvtest: return proper error code in probe Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 42/62] vt: defer kfree() of vc_screenbuf in vc_do_resize() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 43/62] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 44/62] serial: samsung: Removes the IRQ not found warning Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 45/62] serial: pl011: Dont leak amba_ports entry on driver register error Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 46/62] serial: 8250: change lock order in serial8250_do_startup() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 47/62] writeback: Protect inode->i_io_list with inode->i_lock Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 48/62] writeback: Avoid skipping inode writeback Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 49/62] writeback: Fix sync livelock due to b_dirty_time processing Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
2020-09-29 13:13 ` Stefan Bader
2020-09-29 14:05 ` Jürgen Groß
2020-09-29 14:21 ` Stefan Bader
2020-09-30 8:52 ` Stefan Bader
2020-09-30 9:01 ` Jürgen Groß
2020-09-01 15:10 ` [PATCH 4.4 51/62] xhci: Do warm-reset when both CAS and XDEV_RESUME are set Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 52/62] PM: sleep: core: Fix the handling of pending runtime resume requests Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 53/62] device property: Fix the secondary firmware node handling in set_primary_fwnode() Greg Kroah-Hartman
2020-09-01 15:10 ` Greg Kroah-Hartman [this message]
2020-09-01 15:10 ` [PATCH 4.4 55/62] usb: uas: Add quirk for PNY Pro Elite Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 56/62] USB: quirks: Add no-lpm quirk for another Raydium touchscreen Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 57/62] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 58/62] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 59/62] usb: storage: Add unusual_uas entry for Sony PSZ drives Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 60/62] btrfs: check the right error variable in btrfs_del_dir_entries_in_log Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 61/62] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 62/62] ALSA: usb-audio: Update documentation comment for MS2109 quirk Greg Kroah-Hartman
2020-09-01 18:58 ` [PATCH 4.4 00/62] 4.4.235-rc1 review Guenter Roeck
2020-09-02 7:37 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200901150923.460492636@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).