diff options
| author | Phong Tran <[email protected]> | 2019-07-24 02:06:01 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2019-07-25 08:40:03 +0000 |
| commit | f90bf1ece48a736097ea224430578fe586a9544c (patch) | |
| tree | 9369c00fa99983854055a996604fa73395b6ae53 /tools/perf/scripts/python/check-perf-trace.py | |
| parent | usb/hcd: Fix a NULL vs IS_ERR() bug in usb_hcd_setup_local_mem() (diff) | |
| download | kernel-f90bf1ece48a736097ea224430578fe586a9544c.tar.gz kernel-f90bf1ece48a736097ea224430578fe586a9544c.zip | |
usb: wusbcore: fix unbalanced get/put cluster_id
syzboot reported that
https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef
There is not consitency parameter in cluste_id_get/put calling.
In case of getting the id with result is failure, the wusbhc->cluster_id
will not be updated and this can not be used for wusb_cluster_id_put().
Tested report
https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ
Reproduce and gdb got the details:
139 addr = wusb_cluster_id_get();
(gdb) n
140 if (addr == 0)
(gdb) print addr
$1 = 254 '\376'
(gdb) n
142 result = __hwahc_set_cluster_id(hwahc, addr);
(gdb) print result
$2 = -71
(gdb) break wusb_cluster_id_put
Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384.
(gdb) s
Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384
384 id = 0xff - id;
(gdb) n
385 BUG_ON(id >= CLUSTER_IDS);
(gdb) print id
$3 = 255 '\377'
Reported-by: [email protected]
Signed-off-by: Phong Tran <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/check-perf-trace.py')
0 files changed, 0 insertions, 0 deletions
