[PATCH] usb: gadget: f_eem: use GFP_ATOMIC for echo response buffer

[Liu Chao]

eem_unwrap() is invoked from the URB completion callback (rx_complete)
in softirq/atomic context. The EEM echo command path allocates the
response buffer with kmalloc(skb2->len, GFP_KERNEL), which may sleep
and trigger "scheduling while atomic" or a panic. A malicious host can
reach this path by sending a bulk OUT transfer carrying an EEM command
header with bmEEMCmd=0.

Allocate the echo response buffer with GFP_ATOMIC, consistent with the
other allocations in this path (skb_clone, usb_ep_alloc_request,
usb_ep_queue). The subsequent ctx allocation has the same problem and
is fixed the same way.

Reviewed-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
---
 drivers/usb/gadget/function/f_eem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index edbbadad6..b42f25ffb 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -455,14 +455,14 @@ static int eem_unwrap(struct gether *port,
 					goto next;
 				}
 
-				req->buf = kmalloc(skb2->len, GFP_KERNEL);
+				req->buf = kmalloc(skb2->len, GFP_ATOMIC);
 				if (!req->buf) {
 					usb_ep_free_request(ep, req);
 					dev_kfree_skb_any(skb2);
 					goto next;
 				}
 
-				ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+				ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC);
 				if (!ctx) {
 					kfree(req->buf);
 					usb_ep_free_request(ep, req);
--
2.50.1