raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-29 05:23:37 +00:00
Code Issues Projects Releases Wiki Activity
Files
495f2f1b53d7ae8e5a2d4fa311bc1587e4e46caa
linux/drivers
History
Alan Stern 495f2f1b53 USB: yurex: Fix bad gfp argument 
commit f176ede3a3 upstream.

The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:

do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xf6/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:231
 __warn.cold+0x20/0x50 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
 slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
 slab_alloc_node mm/slub.c:2816 [inline]
 slab_alloc mm/slub.c:2900 [inline]
 kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
 kmalloc include/linux/slab.h:554 [inline]
 dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495

This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.

Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03 11:29:47 +02:00
..
accessibility
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
acpi
libnvdimm: Validate command family indices
2020-08-21 13:15:03 +02:00
amba
ARM: tegra: Replace zero-length array with flexible-array
2020-06-15 23:08:28 -05:00
android
binder: Prevent context manager from incrementing ref 0
2020-08-11 15:48:09 +02:00
ata
Merge tag 'libata-5.8-2020-06-19' of git://git.kernel.dk/linux-block
2020-06-19 13:09:40 -07:00
atm
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
2020-07-30 17:35:53 -07:00
auxdisplay
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
base
device property: Fix the secondary firmware node handling in set_primary_fwnode()
2020-09-03 11:29:44 +02:00
bcma
…
block
block: loop: set discard granularity and alignment for block device backed loop
2020-09-03 11:29:39 +02:00
bluetooth
Bluetooth: hci_qca: Stop collecting memdump again for command timeout during SSR
2020-08-19 08:26:47 +02:00
bus
bus: ti-sysc: Add missing quirk flags for usb_host_hs
2020-08-19 08:26:16 +02:00
cdrom
…
char
tpm: Unify the mismatching TPM space buffer sizes
2020-08-19 08:27:01 +02:00
clk
clk: bcm2835: Do not use prediv with bcm2711's PLLs
2020-08-21 13:15:13 +02:00
clocksource
Merge tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
2020-07-25 13:27:12 -07:00
connector
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
counter
counter: 104-quad-8: Add lock guards - filter clock prescaler
2020-06-14 14:46:52 +01:00
cpufreq
cpufreq: intel_pstate: Fix EPP setting via sysfs in active mode
2020-09-03 11:29:26 +02:00
cpuidle
cpuidle: Rearrange s2idle-specific idle state entry code
2020-06-25 13:52:53 +02:00
crypto
crypto: caam - Remove broken arc4 support
2020-08-21 13:15:08 +02:00
dax
…
dca
…
devfreq
PM / devfreq: Fix the wrong end with semicolon
2020-09-03 11:29:26 +02:00
dio
maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2020-06-17 10:57:41 -07:00
dma
dmaengine: idxd: fix PCI_MSI build errors
2020-09-03 11:29:24 +02:00
dma-buf
dma-buf: fix dma-fence-chain out of order test
2020-08-19 08:26:30 +02:00
edac
EDAC/ie31200: Fallback if host bridge device is already initialized
2020-09-03 11:29:22 +02:00
eisa
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
extcon
…
firewire
firewire: ohci: Replace zero-length array with flexible-array
2020-06-15 23:08:31 -05:00
firmware
efi/libstub: Handle unterminated cmdline
2020-08-26 11:49:19 +02:00
fpga
fpga: dfl: fix bug in port reset handshake
2020-07-13 22:11:17 -07:00
fsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gnss
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gpio
gpio: don't use same lockdep class for all devm_gpiochip_add_data users
2020-08-19 08:26:55 +02:00
gpu
drm/amd/pm: correct the thermal alert temperature limit settings
2020-09-03 11:29:47 +02:00
greybus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hid
HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
2020-09-03 11:29:39 +02:00
hsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hv
Drivers: hv: Change flag to write log level in panic msg to false
2020-06-29 10:30:35 +00:00
hwmon
hwmon: (gsc-hwmon) Scale temperature to millidegrees
2020-09-03 11:29:38 +02:00
hwspinlock
…
hwtracing
coresight: etm4x: Fix save/restore during cpu idle
2020-08-19 08:26:40 +02:00
i2c
i2c: rcar: in slave mode, clear NACK earlier
2020-09-03 11:29:28 +02:00
i3c
…
ide
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
idle
…
iio
iio: imu: st_lsm6dsx: reset hw ts after resume
2020-08-21 13:14:53 +02:00
infiniband
Revert "RDMA/hns: Reserve one sge in order to avoid local length error"
2020-08-26 11:49:16 +02:00
input
Input: psmouse - add a newline when printing 'proto' by sysfs
2020-08-26 11:49:05 +02:00
interconnect
interconnect: msm8916: Fix buswidth of pcnoc_s nodes
2020-07-23 10:45:24 +02:00
iommu
dma-pool: fix coherent pool allocations for IOMMU mappings
2020-09-03 11:29:34 +02:00
ipack
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
irqchip
irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
2020-09-03 11:29:44 +02:00
isdn
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
leds
leds: core: Flush scheduled work for system suspend
2020-08-19 08:26:33 +02:00
lightnvm
…
macintosh
macintosh/via-macii: Access autopoll_devs when inside lock
2020-08-19 08:26:45 +02:00
mailbox
…
mcb
…
md
md-cluster: Fix potential error pointer dereference in resize_bitmaps()
2020-08-21 13:15:15 +02:00
media
media: i2c: imx290: fix reset GPIO pin handling
2020-09-03 11:29:23 +02:00
memory
memory: samsung: exynos5422-dmc: Do not ignore return code of regmap_read()
2020-08-19 08:26:17 +02:00
memstick
…
message
scsi: mptfusion: Don't use GFP_ATOMIC for larger DMA allocations
2020-06-26 22:51:53 -04:00
mfd
mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs
2020-09-03 11:29:16 +02:00
misc
habanalabs: Fix memory corruption in debugfs
2020-09-03 11:29:28 +02:00
mmc
mmc: sdhci-of-arasan: fix timings allocation code
2020-09-03 11:29:24 +02:00
most
staging: most: avoid null pointer dereference when iface is null
2020-08-19 08:26:27 +02:00
mtd
ubi: fastmap: Free fastmap next anchor peb during detach
2020-08-21 13:15:13 +02:00
mux
…
net
net: gianfar: Add of_node_put() before goto statement
2020-09-03 11:29:37 +02:00
nfc
nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
2020-07-20 18:31:33 -07:00
ntb
…
nubus
…
nvdimm
libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr
2020-08-21 13:15:14 +02:00
nvme
nvme: multipath: round-robin: fix single non-optimized path case
2020-09-03 11:29:28 +02:00
nvmem
nvmem: sprd: Fix return value of sprd_efuse_probe()
2020-08-19 08:26:48 +02:00
of
of/address: check for invalid range.cpu_addr
2020-08-26 11:49:13 +02:00
opp
opp: Put opp table in dev_pm_opp_set_rate() if _set_opp_bw() fails
2020-08-26 11:49:00 +02:00
oprofile
oprofile: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-19 08:27:07 +02:00
parport
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pci
PCI: qcom: Add missing reset for ipq806x
2020-09-03 11:29:25 +02:00
pcmcia
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
perf
drivers/perf: Prevent forced unbinding of PMU drivers
2020-07-17 10:51:44 +01:00
phy
phy: armada-38x: fix NETA lockup when repeatedly switching speeds
2020-08-19 08:26:41 +02:00
pinctrl
pinctrl: mediatek: fix build for tristate changes
2020-09-03 11:29:25 +02:00
platform
platform/chrome: cros_ec_sensorhub: Fix EC timestamp overflow
2020-09-03 11:29:16 +02:00
pnp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
power
power: supply: check if calc_soc succeeded in pm860x_init_battery
2020-08-19 08:26:46 +02:00
powercap
Merge tag 'kbuild-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2020-06-13 13:29:16 -07:00
pps
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ps3
…
ptp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pwm
pwm: bcm-iproc: handle clk_get_rate() return
2020-08-21 13:15:12 +02:00
rapidio
rapidio: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
ras
…
regulator
regulator: fix memory leak on error path of regulator_register()
2020-08-19 08:26:10 +02:00
remoteproc
remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load
2020-08-21 13:15:03 +02:00
reset
reset: intel: fix a compile warning about REG_OFFSET redefined
2020-08-19 08:26:09 +02:00
rpmsg
…
rtc
rtc: goldfish: Enable interrupt in set_alarm() when necessary
2020-08-26 11:49:04 +02:00
s390
s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-03 11:29:34 +02:00
sbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
scsi
Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
2020-09-03 11:29:36 +02:00
sfi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
sh
…
siox
…
slimbus
…
soc
soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
2020-08-19 08:26:14 +02:00
soundwire
soundwire: intel: fix memory leak with devm_kasprintf
2020-06-22 17:15:20 +05:30
spi
spi: stm32: always perform registers configuration prior to transfer
2020-09-03 11:29:31 +02:00
spmi
…
ssb
…
staging
staging: rts5208: fix memleaks on error handling paths in probe
2020-09-03 11:29:16 +02:00
target
scsi: target: Fix xcopy sess release leak
2020-09-03 11:29:18 +02:00
tc
…
tee
…
thermal
thermal: int340x: processor_thermal: fix: update Jasper Lake PCI id
2020-08-19 08:26:43 +02:00
thunderbolt
thunderbolt: Fix path indices used in USB3 tunnel discovery
2020-06-25 15:45:30 +03:00
tty
serial: 8250: change lock order in serial8250_do_startup()
2020-09-03 11:29:41 +02:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-03 10:52:02 +02:00
usb
USB: yurex: Fix bad gfp argument
2020-09-03 11:29:47 +02:00
vdpa
vdpa: ifcvf: free config irq in ifcvf_free_irq()
2020-09-03 11:29:29 +02:00
vfio
vfio/type1: Add proper error unwind for vfio_iommu_replay()
2020-08-26 11:49:13 +02:00
vhost
vhost/scsi: fix up req type endian-ness
2020-07-29 13:24:30 -04:00
video
fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-03 11:29:40 +02:00
virt
virt: vbox: Fix guest capabilities mask check
2020-07-10 13:40:19 +02:00
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 11:49:07 +02:00
visorbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
vlynq
…
vme
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
w1
w1: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
watchdog
watchdog: rti-wdt: balance pm runtime enable calls
2020-08-21 13:15:15 +02:00
xen
XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-03 11:29:42 +02:00
zorro
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
Kconfig
…
Makefile
…