Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | Date | Tue, 23 Apr 2019 12:46:48 -0400 (EDT) | From | Alan Stern <> | Subject | Re: general protection fault in __dev_printk |
| |
On Tue, 23 Apr 2019, syzbot wrote:
> Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger > crash: > > Reported-and-tested-by: > syzbot+2eb9121678bdb36e6d57@syzkaller.appspotmail.com > > Tested on: > > commit: d34f9519 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan/tree/usb-fuzzer > kernel config: https://syzkaller.appspot.com/x/.config?x=c73d1bb5aeaeae20 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > patch: https://syzkaller.appspot.com/x/patch.diff?x=15909780a00000 > > Note: testing is done by a robot and is best-effort only.
Okay, here's the original patch again, with the error message #if-ed out. Maybe those messages are slowing down dummy-hcd enough that the yurex_disconnect() routine never gets a chance to run. Although to tell the truth, I don't see how that could happen.
Alan Stern
#syz test: https://github.com/google/kasan.git usb-fuzzer
--- a/drivers/usb/misc/yurex.c +++ b/drivers/usb/misc/yurex.c @@ -143,8 +143,10 @@ static void yurex_interrupt(struct urb * /* The device is terminated, clean up */ return; default: +#if 0 dev_err(&dev->interface->dev, "%s - unknown status received: %d\n", __func__, status); +#endif goto exit; } @@ -314,6 +316,7 @@ static void yurex_disconnect(struct usb_ usb_deregister_dev(interface, &yurex_class); /* prevent more I/O from starting */ + usb_poison_urb(dev->urb); mutex_lock(&dev->io_mutex); dev->interface = NULL; mutex_unlock(&dev->io_mutex);
| ![\](/images/icornerr.gif) |