Commit 7784caa4 authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman
Browse files

USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts 



The usbtmc driver accepts timeout values specified by the user in an
ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
Since the user can specify arbitrarily long timeouts and
usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
instead to avoid the possibility of the user hanging a kernel thread
indefinitely.

Reported-by: default avatar <syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t


Tested-by: default avatar <syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com>
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Fixes: 048c6d88 ("usb: usbtmc: Add ioctls to set/get usb timeout")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 41690996

drivers/usb/class/usbtmc.c

+3 −3
Original line number Diff line number Diff line
@@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struct usbtmc_file_data *file_data) 
	buffer[1] = data->bTag;

	buffer[2] = ~data->bTag;



	retval = usb_bulk_msg(data->usb_dev,

	retval = usb_bulk_msg_killable(data->usb_dev,

			      usb_sndbulkpipe(data->usb_dev,

					      data->bulk_out),

			      buffer, USBTMC_HEADER_SIZE,
@@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_file_data *file_data, 
	buffer[11] = 0; /* Reserved */



	/* Send bulk URB */

	retval = usb_bulk_msg(data->usb_dev,

	retval = usb_bulk_msg_killable(data->usb_dev,

			      usb_sndbulkpipe(data->usb_dev,

					      data->bulk_out),

			      buffer, USBTMC_HEADER_SIZE,
@@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf, 
	actual = 0;



	/* Send bulk URB */

	retval = usb_bulk_msg(data->usb_dev,

	retval = usb_bulk_msg_killable(data->usb_dev,

			      usb_rcvbulkpipe(data->usb_dev,

					      data->bulk_in),

			      buffer, bufsize, &actual,