Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction

Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>
> u_audio_get_playback_srate() unconditionally locks and reads
> uac->p_prm.lock/srate, but g_audio_setup() only initializes
> p_prm.lock when p_chmask is set. On a UAC2 instance configured
> without a playback direction, this results in acquiring a
> never spin_lock_init()'d lock when a GET_CUR sample rate
> request targets playback, triggering a lockdep "trying to
> register non-static key" warning.
>
> Reject the request with -EOPNOTSUPP when p_chmask is not set,
> before touching prm->lock.
>
> Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
> Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/usb/gadget/function/u_audio.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
> index e53f2927b539..ff811ea1e25a 100644
> --- a/drivers/usb/gadget/function/u_audio.c
> +++ b/drivers/usb/gadget/function/u_audio.c
> @@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
>  	struct uac_rtd_params *prm;
>  	unsigned long flags;
>  
> +	if (!audio_dev->params.p_chmask)
> +		return -EOPNOTSUPP;
> +
>  	prm = &uac->p_prm;
>  	spin_lock_irqsave(&prm->lock, flags);
>  	*val = prm->srate;
> -- 
> 2.43.0
>

[PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction

[Deepanshu Kartikey]

u_audio_get_playback_srate() unconditionally locks and reads
uac->p_prm.lock/srate, but g_audio_setup() only initializes
p_prm.lock when p_chmask is set. On a UAC2 instance configured
without a playback direction, this results in acquiring a
never spin_lock_init()'d lock when a GET_CUR sample rate
request targets playback, triggering a lockdep "trying to
register non-static key" warning.

Reject the request with -EOPNOTSUPP when p_chmask is not set,
before touching prm->lock.

Fixes: eb3a1ce6f5ed ("usb: gadget: u_audio: Add capture/playback srate getter")
Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/usb/gadget/function/u_audio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index e53f2927b539..ff811ea1e25a 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
 	struct uac_rtd_params *prm;
 	unsigned long flags;
 
+	if (!audio_dev->params.p_chmask)
+		return -EOPNOTSUPP;
+
 	prm = &uac->p_prm;
 	spin_lock_irqsave(&prm->lock, flags);
 	*val = prm->srate;
-- 
2.43.0

Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>
>
> u_audio_get_playback_srate() unconditionally locks and reads
> uac->p_prm.lock/srate, but g_audio_setup() only initializes
> p_prm.lock when p_chmask is set. On a UAC2 instance configured
> without a playback direction, this results in acquiring a
> never spin_lock_init()'d lock when a GET_CUR sample rate
> request targets playback, triggering a lockdep "trying to
> register non-static key" warning.
>
> Reject the request with -EOPNOTSUPP when p_chmask is not set,
> before touching prm->lock.
>
> Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
> Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/usb/gadget/function/u_audio.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
> index e53f2927b539..ff811ea1e25a 100644
> --- a/drivers/usb/gadget/function/u_audio.c
> +++ b/drivers/usb/gadget/function/u_audio.c
> @@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
>  	struct uac_rtd_params *prm;
>  	unsigned long flags;
>  
> +	if (!audio_dev->params.p_chmask)
> +		return -EOPNOTSUPP;
> +
>  	prm = &uac->p_prm;
>  	spin_lock_irqsave(&prm->lock, flags);
>  	*val = prm->srate;
> -- 
> 2.43.0
>