* [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue
@ 2024-02-02 18:59 Chenyuan Yang
2024-02-02 21:08 ` Greg KH
2024-03-13 15:17 ` Oliver Neukum
0 siblings, 2 replies; 3+ messages in thread
From: Chenyuan Yang @ 2024-02-02 18:59 UTC (permalink / raw)
To: gregkh, azeemshaikh38, ivan.orlov0322, benjamin.tissoires,
linux-usb
Cc: linux-kernel, syzkaller, Zijie Zhao
[-- Attachment #1: Type: text/plain, Size: 2848 bytes --]
Dear Linux Developers for F_printer,
We encountered "WARNING in usb_ep_queue" when testing the f_printer driver with
Syzkaller and our generated specifications.
I attached the report and C/syz reproducers for this crash.
```
------------[ cut here ]------------
WARNING: CPU: 1 PID: 10395 at drivers/usb/gadget/udc/core.c:295
usb_ep_queue+0xa0/0x300 linux/drivers/usb/gadget/udc/core.c:295
Modules linked in:
CPU: 1 PID: 10395 Comm: syz-executor364 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:usb_ep_queue+0xa0/0x300 linux/drivers/usb/gadget/udc/core.c:295
Code: 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 31 02 00 00 0f b6
5d 35 31 ff 89 de e8 da 51 08 fa 84 db 74 11 e8 01 56 08 fa 90 <0f> 0b
90 41 bd 94 ff ff ff eb 56 e8 f0 55 08 fa 48 8d 7d 10 48 b8
RSP: 0018:ffffc900075cfc00 EFLAGS: 00010093
RAX: 0000000000000000 RBX: 0000000000000081 RCX: ffffffff8786e5a6
RDX: ffff88801cd59e00 RSI: ffffffff8786e5af RDI: 0000000000000001
RBP: ffff8880173d80e0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000081 R11: 0000000000000000 R12: ffff888019236e10
R13: 0000000000000820 R14: 0000000000000000 R15: ffff888019236e58
FS: 000055555591d3c0(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020c55000 CR3: 0000000024d03000 CR4: 0000000000350ef0
Call Trace:
<TASK>
printer_write+0x650/0xf30 linux/drivers/usb/gadget/function/f_printer.c:669
vfs_write+0x2ae/0xd80 linux/fs/read_write.c:582
ksys_write+0x127/0x250 linux/fs/read_write.c:637
do_syscall_x64 linux/arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 linux/arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f1c4a60e3bd
Code: c3 e8 87 20 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd3d68a858 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f1c4a60e3bd
RDX: 000000000000004f RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007f1c4a663cd5 R09: 00007f1c4a663cd5
R10: 00237265746e6972 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd3d68aab8 R14: 00007ffd3d68a880 R15: 00007ffd3d68a870
</TASK>
```
It seems that the `WARN_ON_ONCE(!ep->enabled && ep->address)` in
usb_ep_queue (https://elixir.bootlin.com/linux/v6.7/source/drivers/usb/gadget/udc/core.c#L290),
which is invoked by `printer_write`
(https://elixir.bootlin.com/linux/v6.7/source/drivers/usb/gadget/function/f_printer.c#L669).
If you have any questions or require more information, please feel
free to contact us.
Reported-by: Chenyuan Yang <chenyuan0y@gmail.com>
Best,
Chenyuan
[-- Attachment #2: repro.prog --]
[-- Type: application/octet-stream, Size: 833 bytes --]
# {Threaded:false Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = syz_open_dev$KGPT_g_printer(&(0x7f0000000080), 0x0, 0x80041)
write(r0, &(0x7f0000000000)="c2", 0xfffffdef)
write$binfmt_script(r0, &(0x7f00000000c0)={'#! ', './file0', [{0x20, '/dev/g_printer#\x00'}, {0x20, '/dev/g_printer#\x00'}, {0x20, '/dev/g_printer#\x00'}, {0x20, '/dev/g_printer#\x00'}]}, 0x4f)
r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400, 0x2)
ioctl$USBDEVFS_RESET(r1, 0x5514)
[-- Attachment #3: repro.c --]
[-- Type: application/octet-stream, Size: 4667 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
if (a0 == 0xc || a0 == 0xb) {
char buf[128];
sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
return open(buf, O_RDWR, 0);
} else {
char buf[1024];
char* hash;
strncpy(buf, (char*)a0, sizeof(buf) - 1);
buf[sizeof(buf) - 1] = 0;
while ((hash = strchr(buf, '#'))) {
*hash = '0' + (char)(a1 % 10);
a1 /= 10;
}
return open(buf, a2, 0);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
memcpy((void*)0x20000080, "/dev/g_printer#\000", 16);
res = -1;
res = syz_open_dev(/*dev=*/0x20000080, /*id=*/0 + procid*1, /*flags=*/0x80041);
if (res != -1)
r[0] = res;
memset((void*)0x20000000, 194, 1);
syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x20000000ul, /*count=*/0xfffffdeful);
memcpy((void*)0x200000c0, "#! ", 3);
memcpy((void*)0x200000c3, "./file0", 7);
*(uint8_t*)0x200000ca = 0x20;
memcpy((void*)0x200000cb, "/dev/g_printer#\000", 16);
*(uint8_t*)0x200000db = 0x20;
memcpy((void*)0x200000dc, "/dev/g_printer#\000", 16);
*(uint8_t*)0x200000ec = 0x20;
memcpy((void*)0x200000ed, "/dev/g_printer#\000", 16);
*(uint8_t*)0x200000fd = 0x20;
memcpy((void*)0x200000fe, "/dev/g_printer#\000", 16);
*(uint8_t*)0x2000010e = 0xa;
syscall(__NR_write, /*fd=*/r[0], /*data=*/0x200000c0ul, /*len=*/0x4ful);
memcpy((void*)0x20000040, "/dev/bus/usb/00#/00#\000", 21);
res = -1;
res = syz_open_dev(/*dev=*/0x20000040, /*id=*/0x400, /*flags=*/2);
if (res != -1)
r[1] = res;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x5514, 0);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
for (procid = 0; procid < 8; procid++) {
if (fork() == 0) {
loop();
}
}
sleep(1000000);
return 0;
}
[-- Attachment #4: repro.report --]
[-- Type: application/octet-stream, Size: 2170 bytes --]
------------[ cut here ]------------
WARNING: CPU: 1 PID: 10395 at drivers/usb/gadget/udc/core.c:295 usb_ep_queue+0xa0/0x300 linux/drivers/usb/gadget/udc/core.c:295
Modules linked in:
CPU: 1 PID: 10395 Comm: syz-executor364 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:usb_ep_queue+0xa0/0x300 linux/drivers/usb/gadget/udc/core.c:295
Code: 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 31 02 00 00 0f b6 5d 35 31 ff 89 de e8 da 51 08 fa 84 db 74 11 e8 01 56 08 fa 90 <0f> 0b 90 41 bd 94 ff ff ff eb 56 e8 f0 55 08 fa 48 8d 7d 10 48 b8
RSP: 0018:ffffc900075cfc00 EFLAGS: 00010093
RAX: 0000000000000000 RBX: 0000000000000081 RCX: ffffffff8786e5a6
RDX: ffff88801cd59e00 RSI: ffffffff8786e5af RDI: 0000000000000001
RBP: ffff8880173d80e0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000081 R11: 0000000000000000 R12: ffff888019236e10
R13: 0000000000000820 R14: 0000000000000000 R15: ffff888019236e58
FS: 000055555591d3c0(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020c55000 CR3: 0000000024d03000 CR4: 0000000000350ef0
Call Trace:
<TASK>
printer_write+0x650/0xf30 linux/drivers/usb/gadget/function/f_printer.c:669
vfs_write+0x2ae/0xd80 linux/fs/read_write.c:582
ksys_write+0x127/0x250 linux/fs/read_write.c:637
do_syscall_x64 linux/arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 linux/arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f1c4a60e3bd
Code: c3 e8 87 20 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd3d68a858 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f1c4a60e3bd
RDX: 000000000000004f RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007f1c4a663cd5 R09: 00007f1c4a663cd5
R10: 00237265746e6972 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd3d68aab8 R14: 00007ffd3d68a880 R15: 00007ffd3d68a870
</TASK>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue
2024-02-02 18:59 [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue Chenyuan Yang
@ 2024-02-02 21:08 ` Greg KH
2024-03-13 15:17 ` Oliver Neukum
1 sibling, 0 replies; 3+ messages in thread
From: Greg KH @ 2024-02-02 21:08 UTC (permalink / raw)
To: Chenyuan Yang
Cc: azeemshaikh38, ivan.orlov0322, benjamin.tissoires, linux-usb,
linux-kernel, syzkaller, Zijie Zhao
On Fri, Feb 02, 2024 at 12:59:31PM -0600, Chenyuan Yang wrote:
> Dear Linux Developers for F_printer,
>
> We encountered "WARNING in usb_ep_queue" when testing the f_printer driver with
> Syzkaller and our generated specifications.
>
> I attached the report and C/syz reproducers for this crash.
>
> ```
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 10395 at drivers/usb/gadget/udc/core.c:295
> usb_ep_queue+0xa0/0x300 linux/drivers/usb/gadget/udc/core.c:295
> Modules linked in:
> CPU: 1 PID: 10395 Comm: syz-executor364 Not tainted 6.6.0-gd2f51b3516da #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:usb_ep_queue+0xa0/0x300 linux/drivers/usb/gadget/udc/core.c:295
> Code: 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 31 02 00 00 0f b6
> 5d 35 31 ff 89 de e8 da 51 08 fa 84 db 74 11 e8 01 56 08 fa 90 <0f> 0b
> 90 41 bd 94 ff ff ff eb 56 e8 f0 55 08 fa 48 8d 7d 10 48 b8
> RSP: 0018:ffffc900075cfc00 EFLAGS: 00010093
> RAX: 0000000000000000 RBX: 0000000000000081 RCX: ffffffff8786e5a6
> RDX: ffff88801cd59e00 RSI: ffffffff8786e5af RDI: 0000000000000001
> RBP: ffff8880173d80e0 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000081 R11: 0000000000000000 R12: ffff888019236e10
> R13: 0000000000000820 R14: 0000000000000000 R15: ffff888019236e58
> FS: 000055555591d3c0(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000020c55000 CR3: 0000000024d03000 CR4: 0000000000350ef0
> Call Trace:
> <TASK>
> printer_write+0x650/0xf30 linux/drivers/usb/gadget/function/f_printer.c:669
> vfs_write+0x2ae/0xd80 linux/fs/read_write.c:582
> ksys_write+0x127/0x250 linux/fs/read_write.c:637
> do_syscall_x64 linux/arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x40/0x110 linux/arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
> RIP: 0033:0x7f1c4a60e3bd
> Code: c3 e8 87 20 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd3d68a858 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f1c4a60e3bd
> RDX: 000000000000004f RSI: 00000000200000c0 RDI: 0000000000000003
> RBP: 0000000000000000 R08: 00007f1c4a663cd5 R09: 00007f1c4a663cd5
> R10: 00237265746e6972 R11: 0000000000000246 R12: 0000000000000001
> R13: 00007ffd3d68aab8 R14: 00007ffd3d68a880 R15: 00007ffd3d68a870
> </TASK>
> ```
>
> It seems that the `WARN_ON_ONCE(!ep->enabled && ep->address)` in
> usb_ep_queue (https://elixir.bootlin.com/linux/v6.7/source/drivers/usb/gadget/udc/core.c#L290),
> which is invoked by `printer_write`
> (https://elixir.bootlin.com/linux/v6.7/source/drivers/usb/gadget/function/f_printer.c#L669).
>
> If you have any questions or require more information, please feel
> free to contact us.
Do you have a proposed patch that fixes this issue? That's the simplest
way to get this resolved and to get credit for making the fix.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue
2024-02-02 18:59 [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue Chenyuan Yang
2024-02-02 21:08 ` Greg KH
@ 2024-03-13 15:17 ` Oliver Neukum
1 sibling, 0 replies; 3+ messages in thread
From: Oliver Neukum @ 2024-03-13 15:17 UTC (permalink / raw)
To: Chenyuan Yang, gregkh, azeemshaikh38, ivan.orlov0322,
benjamin.tissoires, linux-usb
Cc: linux-kernel, syzkaller, Zijie Zhao
[-- Attachment #1: Type: text/plain, Size: 386 bytes --]
On 02.02.24 19:59, Chenyuan Yang wrote:
> Dear Linux Developers for F_printer,
>
> We encountered "WARNING in usb_ep_queue" when testing the f_printer driver with
> Syzkaller and our generated specifications.
>
Hi,
it is clear what happens, but at least to me it is not clear why we allow
a write() before we enable the endpoint. Anyway, does this fix the issue?
Regards
Oliver
[-- Attachment #2: 0001-usb-f_printer-sanity-check-in-write.patch --]
[-- Type: text/x-patch, Size: 3076 bytes --]
From 0008697b8ce373a0378058b60d1f1498c3821330 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 13 Mar 2024 16:15:56 +0100
Subject: [PATCH] usb: f_printer: sanity check in write
User space can trigger a write() before the endpoint needed
for that is enabled. Check for that.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/usb/gadget/function/f_printer.c | 37 ++++++++++++++++---------
1 file changed, 24 insertions(+), 13 deletions(-)
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 076dd4c1be96..1e266ba697e8 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -577,6 +577,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
size_t bytes_copied = 0;
struct usb_request *req;
int value;
+ int err = -ENODEV;
DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
@@ -586,11 +587,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
mutex_lock(&dev->lock_printer_io);
spin_lock_irqsave(&dev->lock, flags);
- if (dev->interface < 0) {
- spin_unlock_irqrestore(&dev->lock, flags);
- mutex_unlock(&dev->lock_printer_io);
- return -ENODEV;
- }
+ if (dev->interface < 0)
+ goto error_spin;
/* Check if a printer reset happens while we have interrupts on */
dev->reset_printer = 0;
@@ -605,8 +603,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
* a NON-Blocking call or not.
*/
if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
- mutex_unlock(&dev->lock_printer_io);
- return -EAGAIN;
+ err = -EAGAIN;
+ goto error_mutex;
}
/* Sleep until a write buffer is available */
@@ -657,9 +655,17 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
/* We've disconnected or reset so free the req and buffer */
if (dev->reset_printer) {
list_add(&req->list, &dev->tx_reqs);
- spin_unlock_irqrestore(&dev->lock, flags);
- mutex_unlock(&dev->lock_printer_io);
- return -EAGAIN;
+ err = -EAGAIN;
+ goto error_spin;
+ }
+
+ /*
+ * We cannot guarantee user space is using the API nicely
+ * This check needs to be duplicated
+ */
+ if (!dev->in_ep->enabled && dev->in_ep->address) {
+ err = -ESHUTDOWN;
+ goto error_spin;
}
list_add(&req->list, &dev->tx_reqs_active);
@@ -670,9 +676,8 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
spin_lock(&dev->lock);
if (value) {
list_move(&req->list, &dev->tx_reqs);
- spin_unlock_irqrestore(&dev->lock, flags);
- mutex_unlock(&dev->lock_printer_io);
- return -EAGAIN;
+ err = -EAGAIN;
+ goto error_spin;
}
}
@@ -685,6 +690,12 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
return bytes_copied;
else
return -EAGAIN;
+
+error_spin:
+ spin_unlock_irqrestore(&dev->lock, flags);
+error_mutex:
+ mutex_unlock(&dev->lock_printer_io);
+ return err;
}
static int
--
2.44.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-03-13 15:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-02 18:59 [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue Chenyuan Yang
2024-02-02 21:08 ` Greg KH
2024-03-13 15:17 ` Oliver Neukum
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox