This patch series fixes the following problems founds in syzbot
fuzzing.
1. The first 3 patches fix usbip-host, vhci_hcd, vudc sub-drivers to
validate the passed in file descriptor is a stream socket. If the
file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg()
can't detect end of stream. Reported and fix suggested by Tetsuo Handa
2. All 3 sub-drivers use a common kthread_get_run() to create and
start threads. There are races in updating the local and shared status
in the current stub-up (usbip-host, vudc) and attach (vhci) sequences
resulting in crashes. These stem from starting rx and tx threads before
local and shared state is updated correctly to be in sync.
1. Doesn't handle kthread_create() error and saves invalid ptr in local
state that drives rx and tx threads. Reported and fix suggested by
Tetsuo Handa.
2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads
before updating usbip_device status to correct state. This opens up
a race condition between the threads and tear down sequences.
TODO: Once these fixes are in, kthread_get_run() macro can be removed
in a cleanup patch.
Credit goes to syzbot and Tetsuo Handa for finding and root-causing the
kthread_get_run() improper error handling problem and others. This is a
hard problem to find and debug since the races aren't seen in a normal
case. Fuzzing forces the race window to be small enough for the
kthread_get_run() error path bug and starting threads before updating the
local and shared state bug in the stub-up sequence.
Shuah Khan (6):
usbip: fix stub_dev to check for stream socket
usbip: fix vhci_hcd to check for stream socket
usbip: fix vudc to check for stream socket
usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
usbip: fix vhci_hcd attach_store() races leading to gpf
usbip: fix vudc usbip_sockfd_store races leading to gpf
drivers/usb/usbip/stub_dev.c | 42 ++++++++++++++++++++++++-----
drivers/usb/usbip/vhci_sysfs.c | 39 +++++++++++++++++++++++----
drivers/usb/usbip/vudc_sysfs.c | 49 +++++++++++++++++++++++++++++-----
3 files changed, 111 insertions(+), 19 deletions(-)
--
2.27.0
