tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usbip: Fix locking bug in RT-enabled kernels

Interrupts are disabled before entering usb_hcd_giveback_urb().
A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
acquired with disabled interrupts.

Save the interrupt status and restore it after usb_hcd_giveback_urb().

syz reported:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:44 [inline]
mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
__usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818

Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Lizhi Xu and committed by
Greg Kroah-Hartman 09bf21bf 6e26324d

+3 -3
+3 -3
drivers/usb/usbip/vhci_hcd.c
··· 831 831 no_need_xmit: 832 832 usb_hcd_unlink_urb_from_ep(hcd, urb); 833 833 no_need_unlink: 834 - spin_unlock_irqrestore(&vhci->lock, flags); 835 834 if (!ret) { 836 835 /* usb_hcd_giveback_urb() should be called with 837 836 * irqs disabled 838 837 */ 839 - local_irq_disable(); 838 + spin_unlock(&vhci->lock); 840 839 usb_hcd_giveback_urb(hcd, urb, urb->status); 841 - local_irq_enable(); 840 + spin_lock(&vhci->lock); 842 841 } 842 + spin_unlock_irqrestore(&vhci->lock, flags); 843 843 return ret; 844 844 } 845 845