lkml.org 
[lkml]   [2019]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: INFO: task hung in usb_kill_urb
On Tue, 16 Apr 2019, syzbot wrote:

> Hello,
>
> syzbot has tested the proposed patch but the reproducer still triggered
> crash:
> INFO: task hung in usb_kill_urb

Okay, I think I found the problem. dummy-hcd doesn't check for
unsupported speeds until it is too late. Andrey, what values does your
usb-fuzzer gadget driver set for its max_speed field?

Anyway, if I'm right then this patch should fix the bug.

Alan Stern

#syz test: https://github.com/google/kasan.git usb-fuzzer

--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_ga
struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g);
struct dummy *dum = dum_hcd->dum;

- if (driver->max_speed == USB_SPEED_UNKNOWN)
+ switch (driver->max_speed) {
+ /* All the speeds we support */
+ case USB_SPEED_LOW:
+ case USB_SPEED_FULL:
+ case USB_SPEED_HIGH:
+ case USB_SPEED_SUPER:
+ break;
+ default:
+ dev_err(dummy_dev(dum_hcd), "bogus driver max_speed %d\n",
+ driver->max_speed);
return -EINVAL;
+ }

/*
* SLAVE side init ... the layer above hardware, which
@@ -1785,7 +1795,8 @@ static void dummy_timer(struct timer_lis
total = 490000;
break;
default:
- dev_err(dummy_dev(dum_hcd), "bogus device speed\n");
+ dev_err(dummy_dev(dum_hcd), "bogus device speed %d\n",
+ dum->gadget.speed);
return;
}


\
 
 \ /
  Last update: 2019-04-16 20:26    [W:0.102 / U:3.644 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site