On Tue, Apr 16, 2019 at 8:25 PM Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> wrote: > > On Tue, 16 Apr 2019, syzbot wrote: > > > Hello, > > > > syzbot has tested the proposed patch but the reproducer still triggered > > crash: > > INFO: task hung in usb_kill_urb > > Okay, I think I found the problem. dummy-hcd doesn't check for > unsupported speeds until it is too late. Andrey, what values does your > usb-fuzzer gadget driver set for its max_speed field? It's passed from userspace without any validation :( I'll fix this! Thanks for looking into it! I wonder why other people saw this hang as well, they didn't use the dummy hcd module for sure. I guess there are might be other reasons. > > Anyway, if I'm right then this patch should fix the bug. > > Alan Stern > > #syz test: https://github.com/google/kasan.git usb-fuzzer > > --- a/drivers/usb/gadget/udc/dummy_hcd.c > +++ b/drivers/usb/gadget/udc/dummy_hcd.c > @@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_ga > struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); > struct dummy *dum = dum_hcd->dum; > > - if (driver->max_speed == USB_SPEED_UNKNOWN) > + switch (driver->max_speed) { > + /* All the speeds we support */ > + case USB_SPEED_LOW: > + case USB_SPEED_FULL: > + case USB_SPEED_HIGH: > + case USB_SPEED_SUPER: > + break; > + default: > + dev_err(dummy_dev(dum_hcd), "bogus driver max_speed %d\n", > + driver->max_speed); > return -EINVAL; > + } > > /* > * SLAVE side init ... the layer above hardware, which > @@ -1785,7 +1795,8 @@ static void dummy_timer(struct timer_lis > total = 490000; > break; > default: > - dev_err(dummy_dev(dum_hcd), "bogus device speed\n"); > + dev_err(dummy_dev(dum_hcd), "bogus device speed %d\n", > + dum->gadget.speed); > return; > } > > >
