linux/drivers/usb/usbip
Lizhi Xu 015200bb77 usbip: Fix locking bug in RT-enabled kernels
[ Upstream commit 09bf21bf52 ]

Interrupts are disabled before entering usb_hcd_giveback_urb().
A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
acquired with disabled interrupts.

Save the interrupt status and restore it after usb_hcd_giveback_urb().

syz reported:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
Call Trace:
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
 spin_lock include/linux/spinlock_rt.h:44 [inline]
 mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
 mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
 usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
 __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
 vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818

Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-08 10:14:11 +01:00
..
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
stub.h usbip: Implement SG support to vhci-hcd and stub driver 2019-09-03 16:00:38 +02:00
stub_dev.c USB: usbip: fix stub_dev hub disconnect 2023-10-08 07:49:17 +02:00
stub_main.c USB: core: Use device_driver directly in struct usb_driver and usb_device_driver 2024-01-04 16:06:32 +01:00
stub_rx.c usbip: Don't submit special requests twice 2024-06-04 15:40:56 +02:00
stub_tx.c usbip: clean up an indentation issue 2019-10-04 14:09:42 +02:00
usbip_common.c Treewide: Stop corrupting socket's task_frag 2022-12-19 17:28:49 -08:00
usbip_common.h kthread: add kthread_stop_put 2023-10-04 10:41:57 -07:00
usbip_event.c usb: Remove redundant 'flush_workqueue()' calls 2021-11-17 14:36:57 +01:00
vhci.h USB: usbip: Remove redundant license text 2017-11-07 15:45:01 +01:00
vhci_hcd.c usbip: Fix locking bug in RT-enabled kernels 2026-01-08 10:14:11 +01:00
vhci_rx.c kcov, usbip: collect coverage from vhci_rx_loop 2020-12-28 15:48:36 +01:00
vhci_sysfs.c usbip: Add USB_SPEED_SUPER_PLUS as valid arg 2024-07-31 10:41:41 +02:00
vhci_tx.c usbip: Fix free of unallocated memory in vhci tx 2019-10-28 17:51:06 +01:00
vudc.h USB: usbip: vudc: Convert to platform remove callback returning void 2023-11-22 12:02:53 +00:00
vudc_dev.c USB: usbip: vudc: Convert to platform remove callback returning void 2023-11-22 12:02:53 +00:00
vudc_main.c USB: usbip: vudc: Convert to platform remove callback returning void 2023-11-22 12:02:53 +00:00
vudc_rx.c usb/usbip: Fix v_recv_cmd_submit() to use PIPE_BULK define 2022-11-11 10:28:42 +01:00
vudc_sysfs.c usbip: vudc: Convert snprintf() to sysfs_emit() 2022-10-22 13:20:49 +02:00
vudc_transfer.c usbip: Use fallthrough pseudo-keyword 2020-07-09 18:06:35 +02:00
vudc_tx.c usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer 2018-01-04 17:07:27 +01:00