Re: INFO: task hung in usb_kill_urb
From: Andrey Konovalov
Date: Wed Apr 17 2019 - 07:16:43 EST
On Tue, Apr 16, 2019 at 8:25 PM Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Tue, 16 Apr 2019, syzbot wrote:
>
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer still triggered
> > crash:
> > INFO: task hung in usb_kill_urb
>
> Okay, I think I found the problem. dummy-hcd doesn't check for
> unsupported speeds until it is too late. Andrey, what values does your
> usb-fuzzer gadget driver set for its max_speed field?
It's passed from userspace without any validation :( I'll fix this!
Thanks for looking into it!
I wonder why other people saw this hang as well, they didn't use the
dummy hcd module for sure. I guess there are might be other reasons.
>
> Anyway, if I'm right then this patch should fix the bug.
>
> Alan Stern
>
> #syz test: https://github.com/google/kasan.git usb-fuzzer
>
> --- a/drivers/usb/gadget/udc/dummy_hcd.c
> +++ b/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_ga
> struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g);
> struct dummy *dum = dum_hcd->dum;
>
> - if (driver->max_speed == USB_SPEED_UNKNOWN)
> + switch (driver->max_speed) {
> + /* All the speeds we support */
> + case USB_SPEED_LOW:
> + case USB_SPEED_FULL:
> + case USB_SPEED_HIGH:
> + case USB_SPEED_SUPER:
> + break;
> + default:
> + dev_err(dummy_dev(dum_hcd), "bogus driver max_speed %d\n",
> + driver->max_speed);
> return -EINVAL;
> + }
>
> /*
> * SLAVE side init ... the layer above hardware, which
> @@ -1785,7 +1795,8 @@ static void dummy_timer(struct timer_lis
> total = 490000;
> break;
> default:
> - dev_err(dummy_dev(dum_hcd), "bogus device speed\n");
> + dev_err(dummy_dev(dum_hcd), "bogus device speed %d\n",
> + dum->gadget.speed);
> return;
> }
>
>
>