From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+e87ebe0f7913f71f2ea5@syzkaller.appspotmail.com,
Johan Hovold <johan@kernel.org>
Subject: [PATCH 4.9 29/45] USB: yurex: fix control-URB timeout handling
Date: Mon, 11 Jan 2021 14:01:07 +0100 [thread overview]
Message-ID: <20210111130035.052449158@linuxfoundation.org> (raw)
In-Reply-To: <20210111130033.676306636@linuxfoundation.org>
From: Johan Hovold <johan@kernel.org>
commit 372c93131998c0622304bed118322d2a04489e63 upstream.
Make sure to always cancel the control URB in write() so that it can be
reused after a timeout or spurious CMD_ACK.
Currently any further write requests after a timeout would fail after
triggering a WARN() in usb_submit_urb() when attempting to submit the
already active URB.
Reported-by: syzbot+e87ebe0f7913f71f2ea5@syzkaller.appspotmail.com
Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Cc: stable <stable@vger.kernel.org> # 2.6.37
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/yurex.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -507,6 +507,9 @@ static ssize_t yurex_write(struct file *
timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
finish_wait(&dev->waitq, &wait);
+ /* make sure URB is idle after timeout or (spurious) CMD_ACK */
+ usb_kill_urb(dev->cntl_urb);
+
mutex_unlock(&dev->io_mutex);
if (retval < 0) {
next prev parent reply other threads:[~2021-01-11 14:07 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-11 13:00 [PATCH 4.9 00/45] 4.9.251-rc1 review Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 01/45] kbuild: dont hardcode depmod path Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 02/45] workqueue: Kick a worker based on the actual activation of delayed works Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 03/45] lib/genalloc: fix the overflow when size is too big Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 04/45] depmod: handle the case of /sbin/depmod without /sbin in PATH Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 05/45] ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 06/45] atm: idt77252: call pci_disable_device() on error path Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 07/45] net: dcb: Validate netlink message in DCB handler Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 08/45] net/ncsi: Use real net-device for response handler Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 09/45] net: ethernet: Fix memleak in ethoc_probe Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 10/45] ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 11/45] net: hns: fix return value check in __lb_other_process() Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 12/45] net: hdlc_ppp: Fix issues when mod_timer is called while timer is running Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 13/45] CDC-NCM: remove "connected" log message Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 14/45] vhost_net: fix ubuf refcount incorrectly when sendmsg fails Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 15/45] net: sched: prevent invalid Scell_log shift count Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 16/45] virtio_net: Fix recursive call to cpus_read_lock() Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 17/45] scripts/gdb: make lx-dmesg command work (reliably) Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 18/45] scripts/gdb: lx-dmesg: cast log_buf to void* for addr fetch Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 19/45] scripts/gdb: lx-dmesg: use explicit encoding=utf8 errors=replace Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 20/45] scripts/gdb: fix lx-version string output Greg Kroah-Hartman
2021-01-11 13:00 ` [PATCH 4.9 21/45] video: hyperv_fb: Fix the mmap() regression for v5.4.y and older Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 22/45] usb: gadget: enable super speed plus Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 23/45] USB: cdc-acm: blacklist another IR Droid device Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 24/45] usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 25/45] USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 26/45] usb: uas: Add PNY USB Portable SSD to unusual_uas Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 27/45] USB: serial: iuu_phoenix: fix DMA from stack Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 28/45] USB: serial: option: add LongSung M5710 module support Greg Kroah-Hartman
2021-01-11 13:01 ` Greg Kroah-Hartman [this message]
2021-01-11 13:01 ` [PATCH 4.9 30/45] USB: usblp: fix DMA to stack Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 31/45] ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 32/45] usb: gadget: select CONFIG_CRC32 Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 33/45] usb: gadget: f_uac2: reset wMaxPacketSize Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 34/45] usb: gadget: function: printer: Fix a memory leak for interface descriptor Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 35/45] USB: gadget: legacy: fix return error code in acm_ms_bind() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 36/45] usb: gadget: Fix spinlock lockup on usb_function_deactivate Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 37/45] usb: gadget: configfs: Preserve function ordering after bind failure Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 38/45] usb: gadget: configfs: Fix use-after-free issue with udc_name Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 39/45] USB: serial: keyspan_pda: remove unused variable Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 40/45] x86/mm: Fix leak of pmd ptlock Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 41/45] ALSA: hda/conexant: add a new hda codec CX11970 Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 42/45] Revert "device property: Keep secondary firmware node secondary by type" Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 43/45] netfilter: ipset: fix shift-out-of-bounds in htable_bits() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 44/45] netfilter: xt_RATEEST: reject non-null terminated string from userspace Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 4.9 45/45] x86/mtrr: Correct the range check before performing MTRR type lookups Greg Kroah-Hartman
2021-01-11 15:33 ` [PATCH 4.9 00/45] 4.9.251-rc1 review Jon Hunter
2021-01-11 21:52 ` Guenter Roeck
2021-01-11 23:40 ` Shuah Khan
2021-01-12 8:16 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210111130035.052449158@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+e87ebe0f7913f71f2ea5@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.