From: Alan Stern <stern@rowland.harvard.edu>
To: syzbot <syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com>
Cc: andreyknvl@google.com, <gregkh@linuxfoundation.org>,
<kai.heng.feng@canonical.com>, <linux-kernel@vger.kernel.org>,
<linux-usb@vger.kernel.org>, <mans@mansr.com>, <oneukum@suse.com>,
<syzkaller-bugs@googlegroups.com>
Subject: Re: general protection fault in usb_set_interface
Date: Tue, 17 Sep 2019 11:53:59 -0400 (EDT) [thread overview]
Message-ID: <Pine.LNX.4.44L0.1909171152520.1590-100000@iolanthe.rowland.org> (raw)
In-Reply-To: <000000000000a9f2870592c15dd3@google.com>
On Tue, 17 Sep 2019, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer still triggered
> crash:
> possible deadlock in vidioc_querycap
>
> ============================================
> WARNING: possible recursive locking detected
> 5.3.0-rc7+ #0 Not tainted
> --------------------------------------------
> v4l_id/3016 is trying to acquire lock:
> 0000000069c3004e (&usbvision->v4l2_lock){+.+.}, at:
> vidioc_querycap+0x62/0x3b0 drivers/media/usb/usbvision/usbvision-video.c:456
>
> but task is already holding lock:
> 0000000069c3004e (&usbvision->v4l2_lock){+.+.}, at:
> __video_do_ioctl+0x3ba/0xba0 drivers/media/v4l2-core/v4l2-ioctl.c:2846
Heh. That's what comes of trying to patch a driver when you aren't an
expert on it already.
Okay, the lock is already held at this point so we don't need to
acquire it.
Alan Stern
#syz test: https://github.com/google/kasan.git f0df5c1b
drivers/media/usb/usbvision/usbvision-video.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
Index: usb-devel/drivers/media/usb/usbvision/usbvision-video.c
===================================================================
--- usb-devel.orig/drivers/media/usb/usbvision/usbvision-video.c
+++ usb-devel/drivers/media/usb/usbvision/usbvision-video.c
@@ -453,6 +453,9 @@ static int vidioc_querycap(struct file *
{
struct usb_usbvision *usbvision = video_drvdata(file);
+ if (!usbvision->dev)
+ return -ENODEV;
+
strscpy(vc->driver, "USBVision", sizeof(vc->driver));
strscpy(vc->card,
usbvision_device_data[usbvision->dev_model].model_string,
@@ -1111,7 +1114,8 @@ static int usbvision_radio_close(struct
mutex_lock(&usbvision->v4l2_lock);
/* Set packet size to 0 */
usbvision->iface_alt = 0;
- usb_set_interface(usbvision->dev, usbvision->iface,
+ if (usbvision->dev)
+ usb_set_interface(usbvision->dev, usbvision->iface,
usbvision->iface_alt);
usbvision_audio_off(usbvision);
next prev parent reply other threads:[~2019-09-17 15:54 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-16 13:29 general protection fault in usb_set_interface syzbot
2019-09-16 20:51 ` Alan Stern
2019-09-16 21:03 ` syzbot
2019-09-17 15:16 ` Alan Stern
2019-09-17 15:28 ` syzbot
2019-09-17 15:53 ` Alan Stern [this message]
2019-09-17 16:06 ` syzbot
2019-09-17 17:36 ` Alan Stern
2019-09-17 18:08 ` Alan Stern
2019-09-17 18:15 ` syzbot
2019-09-17 18:31 ` Alan Stern
2019-09-17 18:43 ` syzbot
2019-09-18 18:57 ` Alan Stern
2019-09-19 15:19 ` Andrey Konovalov
2019-12-13 12:15 ` Andrey Konovalov
2019-12-13 12:16 ` syzbot
2019-12-13 12:19 ` Andrey Konovalov
2019-12-13 19:51 ` Alan Stern
2019-12-16 14:59 ` Andrey Konovalov
2019-12-16 15:05 ` Alan Stern
2019-12-16 15:24 ` Andrey Konovalov
2019-12-17 13:17 ` Dmitry Vyukov
2019-12-10 20:17 Re: KASAN: use-after-free Read in usbvision_v4l2_open Alan Stern
2019-12-12 16:52 ` general protection fault in usb_set_interface Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.1909171152520.1590-100000@iolanthe.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=andreyknvl@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kai.heng.feng@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mans@mansr.com \
--cc=oneukum@suse.com \
--cc=syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).