Commit ae8709b2 authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman
Browse files

USB: core: Make do_proc_control() and do_proc_bulk() killable 



The USBDEVFS_CONTROL and USBDEVFS_BULK ioctls invoke
usb_start_wait_urb(), which contains an uninterruptible wait with a
user-specified timeout value.  If timeout value is very large and the
device being accessed does not respond in a reasonable amount of time,
the kernel will complain about "Task X blocked for more than N
seconds", as found in testing by syzbot:

INFO: task syz-executor.0:8700 blocked for more than 143 seconds.
      Not tainted 5.14.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:23192 pid: 8700 ppid:  8455 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4681 [inline]
 __schedule+0xc07/0x11f0 kernel/sched/core.c:5938
 schedule+0x14b/0x210 kernel/sched/core.c:6017
 schedule_timeout+0x98/0x2f0 kernel/time/timer.c:1857
 do_wait_for_common+0x2da/0x480 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion_timeout+0x46/0x60 kernel/sched/completion.c:157
 usb_start_wait_urb+0x167/0x550 drivers/usb/core/message.c:63
 do_proc_bulk+0x978/0x1080 drivers/usb/core/devio.c:1236
 proc_bulk drivers/usb/core/devio.c:1273 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2547 [inline]
 usbdev_ioctl+0x3441/0x6b10 drivers/usb/core/devio.c:2713
...

To fix this problem, this patch replaces usbfs's calls to
usb_control_msg() and usb_bulk_msg() with special-purpose code that
does essentially the same thing (as recommended in the comment for
usb_start_wait_urb()), except that it always uses a killable wait and
it uses GFP_KERNEL rather than GFP_NOIO.

Reported-and-tested-by: default avatar <syzbot+ada0f7d3d9fd2016d927@syzkaller.appspotmail.com>
Suggested-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20210903175312.GA468440@rowland.harvard.edu


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7042b101

drivers/usb/core/devio.c

+111 −33
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include <linux/usb.h>

#include <linux/usbdevice_fs.h>

#include <linux/usb/hcd.h>	/* for usbcore internals */

#include <linux/usb/quirks.h>

#include <linux/cdev.h>

#include <linux/notifier.h>

#include <linux/security.h>
@@ -1102,14 +1103,55 @@ static int usbdev_release(struct inode *inode, struct file *file) 
	return 0;

}



static void usbfs_blocking_completion(struct urb *urb)

{

	complete((struct completion *) urb->context);

}



/*

 * Much like usb_start_wait_urb, but returns status separately from

 * actual_length and uses a killable wait.

 */

static int usbfs_start_wait_urb(struct urb *urb, int timeout,

		unsigned int *actlen)

{

	DECLARE_COMPLETION_ONSTACK(ctx);

	unsigned long expire;

	int rc;



	urb->context = &ctx;

	urb->complete = usbfs_blocking_completion;

	*actlen = 0;

	rc = usb_submit_urb(urb, GFP_KERNEL);

	if (unlikely(rc))

		return rc;



	expire = (timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT);

	rc = wait_for_completion_killable_timeout(&ctx, expire);

	if (rc <= 0) {

		usb_kill_urb(urb);

		*actlen = urb->actual_length;

		if (urb->status != -ENOENT)

			;	/* Completed before it was killed */

		else if (rc < 0)

			return -EINTR;

		else

			return -ETIMEDOUT;

	}

	*actlen = urb->actual_length;

	return urb->status;

}



static int do_proc_control(struct usb_dev_state *ps,

		struct usbdevfs_ctrltransfer *ctrl)

{

	struct usb_device *dev = ps->dev;

	unsigned int tmo;

	unsigned char *tbuf;

	unsigned wLength;

	unsigned int wLength, actlen;

	int i, pipe, ret;

	struct urb *urb = NULL;

	struct usb_ctrlrequest *dr = NULL;



	ret = check_ctrlrecip(ps, ctrl->bRequestType, ctrl->bRequest,

			      ctrl->wIndex);
@@ -1122,51 +1164,63 @@ static int do_proc_control(struct usb_dev_state *ps, 
			sizeof(struct usb_ctrlrequest));

	if (ret)

		return ret;

	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);

	if (!tbuf) {



	ret = -ENOMEM;

	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);

	if (!tbuf)

		goto done;

	}

	urb = usb_alloc_urb(0, GFP_NOIO);

	if (!urb)

		goto done;

	dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);

	if (!dr)

		goto done;



	dr->bRequestType = ctrl->bRequestType;

	dr->bRequest = ctrl->bRequest;

	dr->wValue = cpu_to_le16(ctrl->wValue);

	dr->wIndex = cpu_to_le16(ctrl->wIndex);

	dr->wLength = cpu_to_le16(ctrl->wLength);



	tmo = ctrl->timeout;

	snoop(&dev->dev, "control urb: bRequestType=%02x "

		"bRequest=%02x wValue=%04x "

		"wIndex=%04x wLength=%04x\n",

		ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,

		ctrl->wIndex, ctrl->wLength);

	if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {



	if ((ctrl->bRequestType & USB_DIR_IN) && wLength) {

		pipe = usb_rcvctrlpipe(dev, 0);

		snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);

		usb_fill_control_urb(urb, dev, pipe, (unsigned char *) dr, tbuf,

				wLength, NULL, NULL);

		snoop_urb(dev, NULL, pipe, wLength, tmo, SUBMIT, NULL, 0);



		usb_unlock_device(dev);

		i = usb_control_msg(dev, pipe, ctrl->bRequest,

				    ctrl->bRequestType, ctrl->wValue, ctrl->wIndex,

				    tbuf, ctrl->wLength, tmo);

		i = usbfs_start_wait_urb(urb, tmo, &actlen);

		usb_lock_device(dev);

		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,

			  tbuf, max(i, 0));

		if ((i > 0) && ctrl->wLength) {

			if (copy_to_user(ctrl->data, tbuf, i)) {

		snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, tbuf, actlen);

		if (!i && actlen) {

			if (copy_to_user(ctrl->data, tbuf, actlen)) {

				ret = -EFAULT;

				goto done;

				goto recv_fault;

			}

		}

	} else {

		if (ctrl->wLength) {

			if (copy_from_user(tbuf, ctrl->data, ctrl->wLength)) {

		if (wLength) {

			if (copy_from_user(tbuf, ctrl->data, wLength)) {

				ret = -EFAULT;

				goto done;

			}

		}

		pipe = usb_sndctrlpipe(dev, 0);

		snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT,

			tbuf, ctrl->wLength);

		usb_fill_control_urb(urb, dev, pipe, (unsigned char *) dr, tbuf,

				wLength, NULL, NULL);

		snoop_urb(dev, NULL, pipe, wLength, tmo, SUBMIT, tbuf, wLength);



		usb_unlock_device(dev);

		i = usb_control_msg(dev, pipe, ctrl->bRequest,

				    ctrl->bRequestType, ctrl->wValue, ctrl->wIndex,

				    tbuf, ctrl->wLength, tmo);

		i = usbfs_start_wait_urb(urb, tmo, &actlen);

		usb_lock_device(dev);

		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);

		snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, NULL, 0);

	}

	if (i < 0 && i != -EPIPE) {

		dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
@@ -1174,8 +1228,15 @@ static int do_proc_control(struct usb_dev_state *ps, 
			   current->comm, ctrl->bRequestType, ctrl->bRequest,

			   ctrl->wLength, i);

	}

	ret = i;

	ret = (i < 0 ? i : actlen);



 recv_fault:

	/* Linger a bit, prior to the next control message. */

	if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)

		msleep(200);

 done:

	kfree(dr);

	usb_free_urb(urb);

	free_page((unsigned long) tbuf);

	usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +

			sizeof(struct usb_ctrlrequest));
@@ -1195,10 +1256,11 @@ static int do_proc_bulk(struct usb_dev_state *ps, 
		struct usbdevfs_bulktransfer *bulk)

{

	struct usb_device *dev = ps->dev;

	unsigned int tmo, len1, pipe;

	int len2;

	unsigned int tmo, len1, len2, pipe;

	unsigned char *tbuf;

	int i, ret;

	struct urb *urb = NULL;

	struct usb_host_endpoint *ep;



	ret = findintfep(ps->dev, bulk->ep);

	if (ret < 0)
@@ -1206,14 +1268,17 @@ static int do_proc_bulk(struct usb_dev_state *ps, 
	ret = checkintf(ps, ret);

	if (ret)

		return ret;



	len1 = bulk->len;

	if (len1 < 0 || len1 >= (INT_MAX - sizeof(struct urb)))

		return -EINVAL;



	if (bulk->ep & USB_DIR_IN)

		pipe = usb_rcvbulkpipe(dev, bulk->ep & 0x7f);

	else

		pipe = usb_sndbulkpipe(dev, bulk->ep & 0x7f);

	if (!usb_maxpacket(dev, pipe, !(bulk->ep & USB_DIR_IN)))

		return -EINVAL;

	len1 = bulk->len;

	if (len1 >= (INT_MAX - sizeof(struct urb)))

	ep = usb_pipe_endpoint(dev, pipe);

	if (!ep || !usb_endpoint_maxp(&ep->desc))

		return -EINVAL;

	ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));

	if (ret)
@@ -1223,17 +1288,29 @@ static int do_proc_bulk(struct usb_dev_state *ps, 
	 * len1 can be almost arbitrarily large.  Don't WARN if it's

	 * too big, just fail the request.

	 */

	tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN);

	if (!tbuf) {

	ret = -ENOMEM;

	tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN);

	if (!tbuf)

		goto done;

	urb = usb_alloc_urb(0, GFP_KERNEL);

	if (!urb)

		goto done;



	if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==

			USB_ENDPOINT_XFER_INT) {

		pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);

		usb_fill_int_urb(urb, dev, pipe, tbuf, len1,

				NULL, NULL, ep->desc.bInterval);

	} else {

		usb_fill_bulk_urb(urb, dev, pipe, tbuf, len1, NULL, NULL);

	}



	tmo = bulk->timeout;

	if (bulk->ep & 0x80) {

		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);



		usb_unlock_device(dev);

		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);

		i = usbfs_start_wait_urb(urb, tmo, &len2);

		usb_lock_device(dev);

		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
@@ -1253,12 +1330,13 @@ static int do_proc_bulk(struct usb_dev_state *ps, 
		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);



		usb_unlock_device(dev);

		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);

		i = usbfs_start_wait_urb(urb, tmo, &len2);

		usb_lock_device(dev);

		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);

	}

	ret = (i < 0 ? i : len2);

 done:

	usb_free_urb(urb);

	kfree(tbuf);

	usbfs_decrease_memory_usage(len1 + sizeof(struct urb));

	return ret;