kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Alan Stern 7d85884576 USB: gadget: dummy-hcd: Fix "task hung" problem 
[ Upstream commit 5189df7b80 ]

The syzbot fuzzer has been encountering "task hung" problems ever
since the dummy-hcd driver was changed to use hrtimers instead of
regular timers.  It turns out that the problems are caused by a subtle
difference between the timer_pending() and hrtimer_active() APIs.

The changeover blindly replaced the first by the second.  However,
timer_pending() returns True when the timer is queued but not when its
callback is running, whereas hrtimer_active() returns True when the
hrtimer is queued _or_ its callback is running.  This difference
occasionally caused dummy_urb_enqueue() to think that the callback
routine had not yet started when in fact it was almost finished.  As a
result the hrtimer was not restarted, which made it impossible for the
driver to dequeue later the URB that was just enqueued.  This caused
usb_kill_urb() to hang, and things got worse from there.

Since hrtimers have no API for telling when they are queued and the
callback isn't running, the driver must keep track of this for itself.
That's what this patch does, adding a new "timer_pending" flag and
setting or clearing it at the appropriate times.

Reported-by: syzbot+f342ea16c9d06d80b585@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/6709234e.050a0220.3e960.0011.GAE@google.com/
Tested-by: syzbot+f342ea16c9d06d80b585@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: a7f3813e58 ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler")
Cc: Marcello Sylvester Bauer <sylv@sylv.io>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/2dab644e-ef87-4de8-ac9a-26f100b2c609@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-11-08 16:28:22 +01:00
..
function usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store 2024-11-01 01:58:26 +01:00
legacy usb: gadget: webcam: Make g_webcam loadable again 2024-01-25 15:35:53 -08:00
udc USB: gadget: dummy-hcd: Fix "task hung" problem 2024-11-08 16:28:22 +01:00
composite.c usb: gadget: composite: fix OS descriptors w_value logic 2024-05-17 12:02:28 +02:00
config.c usb: gadget: config: remove max speed check in usb_assign_descriptors() 2023-08-22 14:48:33 +02:00
configfs.c usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() 2024-07-18 13:21:19 +02:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: fix for a typo that conveys logically-inverted information. 2021-09-14 10:27:54 +02:00
functions.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
Kconfig usb: gadget: Add support for USB MIDI 2.0 function driver 2023-07-26 06:38:14 +02:00
Makefile usb: gadget: Makefile: remove ccflags-y 2022-03-18 12:56:08 +01:00
u_f.c usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
u_f.h USB: gadget: u_f: Unbreak offset calculation in VLAs 2020-08-27 09:25:06 +02:00
u_os_desc.h usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
usbstring.c usb: gadget: fix langid kernel-doc warning in usbstring.c 2020-07-09 10:13:07 +03:00