tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts

The usbtmc driver accepts timeout values specified by the user in an
ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
Since the user can specify arbitrarily long timeouts and
usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
instead to avoid the possibility of the user hanging a kernel thread
indefinitely.

Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Alan Stern and committed by
Greg Kroah-Hartman 7784caa4 41690996

+3 -3
+3 -3
drivers/usb/class/usbtmc.c
··· 727 727 buffer[1] = data->bTag; 728 728 buffer[2] = ~data->bTag; 729 729 730 - retval = usb_bulk_msg(data->usb_dev, 730 + retval = usb_bulk_msg_killable(data->usb_dev, 731 731 usb_sndbulkpipe(data->usb_dev, 732 732 data->bulk_out), 733 733 buffer, USBTMC_HEADER_SIZE, ··· 1347 1347 buffer[11] = 0; /* Reserved */ 1348 1348 1349 1349 /* Send bulk URB */ 1350 - retval = usb_bulk_msg(data->usb_dev, 1350 + retval = usb_bulk_msg_killable(data->usb_dev, 1351 1351 usb_sndbulkpipe(data->usb_dev, 1352 1352 data->bulk_out), 1353 1353 buffer, USBTMC_HEADER_SIZE, ··· 1419 1419 actual = 0; 1420 1420 1421 1421 /* Send bulk URB */ 1422 - retval = usb_bulk_msg(data->usb_dev, 1422 + retval = usb_bulk_msg_killable(data->usb_dev, 1423 1423 usb_rcvbulkpipe(data->usb_dev, 1424 1424 data->bulk_in), 1425 1425 buffer, bufsize, &actual,