On Thu, Mar 20, 2025 at 02:35:23PM +0100, Oliver Neukum wrote: > > > On 20.03.25 05:39, 白烁冉 wrote: > > Dear Maintainers, > > > > When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (94th)was triggered. > > > > Hi, > > is there a way to use the syzkaller for testing a patch? > > Regards > Oliver > From 03d78ca8c47c8c888df7c7ae2c7109825799d236 Mon Sep 17 00:00:00 2001 > From: Oliver Neukum <oneukum@xxxxxxxx> > Date: Thu, 20 Mar 2025 14:29:17 +0100 > Subject: [PATCH] USB: cm109: fix race between restarting and close > > cm109_input_close() can race with cm109_restore_state() > Hence cm109_submit_buzz_toggle() needs to check > the shutdown flag > > Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx> > --- > drivers/input/misc/cm109.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c > index 0cfe5d4a573c..8ae62b5e45f6 100644 > --- a/drivers/input/misc/cm109.c > +++ b/drivers/input/misc/cm109.c > @@ -348,6 +348,8 @@ static void cm109_submit_buzz_toggle(struct cm109_dev *dev) > else > dev->ctl_data->byte[HID_OR0] &= ~BUZZER_ON; > > + if (dev->shutdown) > + return; This test must itself be subject to the same race, right? There needs to be some kind of synchronization between the two tasks (i.e., a mutex, spinlock, or something similar). Alan Stern > error = usb_submit_urb(dev->urb_ctl, GFP_ATOMIC); > if (error) > dev_err(&dev->intf->dev, > -- > 2.48.1
