linux-kernel - Re: [syzbot] [wireless?] [usb?] INFO: trying to register non-static key in skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240501000514.1552-1-hdanton@sina.com>
Date: Wed,  1 May 2024 08:05:14 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+2660b9135e6144ca41a5@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [wireless?] [usb?] INFO: trying to register non-static key in skb_dequeue (3)

On Tue, 30 Apr 2024 08:02:25 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    3f12222a4beb usb: dwc3: core: Fix compile warning on s390 ..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=118eeccf180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git  usb-testing

--- x/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ y/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -171,6 +171,7 @@ static int _rtl_usb_init_tx(struct ieee8
 	u32 i;
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
+	int err = 0;
 
 	rtlusb->max_bulk_out_size = IS_HIGH_SPEED_USB(rtlusb->udev)
 						    ? USB_HIGH_SPEED_BULK_SIZE
@@ -185,7 +186,8 @@ static int _rtl_usb_init_tx(struct ieee8
 		if (!ep_num) {
 			rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
 				"Invalid endpoint map setting!\n");
-			return -EINVAL;
+			err = -EINVAL;
+			break;
 		}
 	}
 
@@ -203,7 +205,7 @@ static int _rtl_usb_init_tx(struct ieee8
 		skb_queue_head_init(&rtlusb->tx_skb_queue[i]);
 		init_usb_anchor(&rtlusb->tx_pending[i]);
 	}
-	return 0;
+	return err;
 }
 
 static void _rtl_rx_work(struct tasklet_struct *t);
@@ -236,7 +238,7 @@ static int _rtl_usb_init(struct ieee8021
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_usb_priv *usb_priv = rtl_usbpriv(hw);
 	struct rtl_usb *rtlusb = rtl_usbdev(usb_priv);
-	int err;
+	int err, rc;
 	u8 epidx;
 	struct usb_interface	*usb_intf = rtlusb->intf;
 	u8 epnums = usb_intf->cur_altsetting->desc.bNumEndpoints;
@@ -286,7 +288,9 @@ static int _rtl_usb_init(struct ieee8021
 	/* usb endpoint mapping */
 	err = rtlpriv->cfg->usb_interface_cfg->usb_endpoint_mapping(hw);
 	rtlusb->usb_mq_to_hwq =  rtlpriv->cfg->usb_interface_cfg->usb_mq_to_hwq;
-	_rtl_usb_init_tx(hw);
+	rc = _rtl_usb_init_tx(hw);
+	if (!err)
+		err = rc;
 	_rtl_usb_init_rx(hw);
 	return err;
 }
--