lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <Pine.LNX.4.44L0.1904161421530.1605-100000@iolanthe.rowland.org> Date: Tue, 16 Apr 2019 14:25:51 -0400 (EDT) From: Alan Stern <stern@...land.harvard.edu> To: syzbot <syzbot+d919b0f29d7b5a4994b9@...kaller.appspotmail.com> cc: andreyknvl@...gle.com, <gregkh@...uxfoundation.org>, <gustavo@...eddedor.com>, <linux-kernel@...r.kernel.org>, <linux-usb@...r.kernel.org>, <syzkaller-bugs@...glegroups.com> Subject: Re: INFO: task hung in usb_kill_urb On Tue, 16 Apr 2019, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered > crash: > INFO: task hung in usb_kill_urb Okay, I think I found the problem. dummy-hcd doesn't check for unsupported speeds until it is too late. Andrey, what values does your usb-fuzzer gadget driver set for its max_speed field? Anyway, if I'm right then this patch should fix the bug. Alan Stern #syz test: https://github.com/google/kasan.git usb-fuzzer --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_ga struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); struct dummy *dum = dum_hcd->dum; - if (driver->max_speed == USB_SPEED_UNKNOWN) + switch (driver->max_speed) { + /* All the speeds we support */ + case USB_SPEED_LOW: + case USB_SPEED_FULL: + case USB_SPEED_HIGH: + case USB_SPEED_SUPER: + break; + default: + dev_err(dummy_dev(dum_hcd), "bogus driver max_speed %d\n", + driver->max_speed); return -EINVAL; + } /* * SLAVE side init ... the layer above hardware, which @@ -1785,7 +1795,8 @@ static void dummy_timer(struct timer_lis total = 490000; break; default: - dev_err(dummy_dev(dum_hcd), "bogus device speed\n"); + dev_err(dummy_dev(dum_hcd), "bogus device speed %d\n", + dum->gadget.speed); return; }
Powered by blists - more mailing lists