Received-SPF: pass (google.com: domain of linux-kernel+bounces-101670-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Content-Type: multipart/mixed; boundary="------------bx0M9M0d0PX5GwoPpd9ybdav"
Message-ID: <1196d35e-46a0-4c96-8271-12becb932f06@suse.com>
Date: Wed, 13 Mar 2024 16:17:38 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [Linux Kernel Bug][usb/f_printer] WARNING in usb_ep_queue
Content-Language: en-US
To: Chenyuan Yang <chenyuan0y@gmail.com>, gregkh@linuxfoundation.org,
 azeemshaikh38@gmail.com, ivan.orlov0322@gmail.com,
 benjamin.tissoires@redhat.com, linux-usb@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, syzkaller@googlegroups.com,
 Zijie Zhao <zzjas98@gmail.com>
References: <CALGdzurBnMztPW1Q8mujfYaopVQ8MkSUXUvnAqJcLGu5ROSU4Q@mail.gmail.com>
From: Oliver Neukum <oneukum@suse.com>
In-Reply-To: <CALGdzurBnMztPW1Q8mujfYaopVQ8MkSUXUvnAqJcLGu5ROSU4Q@mail.gmail.com>

This is a multi-part message in MIME format.
--------------bx0M9M0d0PX5GwoPpd9ybdav
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 02.02.24 19:59, Chenyuan Yang wrote:
> Dear Linux Developers for F_printer,
> 
> We encountered "WARNING in usb_ep_queue" when testing the f_printer driver with
> Syzkaller and our generated specifications.
> 

Hi,

it is clear what happens, but at least to me it is not clear why we allow
a write() before we enable the endpoint. Anyway, does this fix the issue?

	Regards
		Oliver

--------------bx0M9M0d0PX5GwoPpd9ybdav
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-usb-f_printer-sanity-check-in-write.patch"
Content-Disposition: attachment;
 filename="0001-usb-f_printer-sanity-check-in-write.patch"
Content-Transfer-Encoding: base64

RnJvbSAwMDA4Njk3YjhjZTM3M2EwMzc4MDU4YjYwZDFmMTQ5OGMzODIxMzMwIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBPbGl2ZXIgTmV1a3VtIDxvbmV1a3VtQHN1c2UuY29t
PgpEYXRlOiBXZWQsIDEzIE1hciAyMDI0IDE2OjE1OjU2ICswMTAwClN1YmplY3Q6IFtQQVRD
SF0gdXNiOiBmX3ByaW50ZXI6IHNhbml0eSBjaGVjayBpbiB3cml0ZQoKVXNlciBzcGFjZSBj
YW4gdHJpZ2dlciBhIHdyaXRlKCkgYmVmb3JlIHRoZSBlbmRwb2ludCBuZWVkZWQKZm9yIHRo
YXQgaXMgZW5hYmxlZC4gQ2hlY2sgZm9yIHRoYXQuCgpTaWduZWQtb2ZmLWJ5OiBPbGl2ZXIg
TmV1a3VtIDxvbmV1a3VtQHN1c2UuY29tPgotLS0KIGRyaXZlcnMvdXNiL2dhZGdldC9mdW5j
dGlvbi9mX3ByaW50ZXIuYyB8IDM3ICsrKysrKysrKysrKysrKystLS0tLS0tLS0KIDEgZmls
ZSBjaGFuZ2VkLCAyNCBpbnNlcnRpb25zKCspLCAxMyBkZWxldGlvbnMoLSkKCmRpZmYgLS1n
aXQgYS9kcml2ZXJzL3VzYi9nYWRnZXQvZnVuY3Rpb24vZl9wcmludGVyLmMgYi9kcml2ZXJz
L3VzYi9nYWRnZXQvZnVuY3Rpb24vZl9wcmludGVyLmMKaW5kZXggMDc2ZGQ0YzFiZTk2Li4x
ZTI2NmJhNjk3ZTggMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvdXNiL2dhZGdldC9mdW5jdGlvbi9m
X3ByaW50ZXIuYworKysgYi9kcml2ZXJzL3VzYi9nYWRnZXQvZnVuY3Rpb24vZl9wcmludGVy
LmMKQEAgLTU3Nyw2ICs1NzcsNyBAQCBwcmludGVyX3dyaXRlKHN0cnVjdCBmaWxlICpmZCwg
Y29uc3QgY2hhciBfX3VzZXIgKmJ1Ziwgc2l6ZV90IGxlbiwgbG9mZl90ICpwdHIpCiAJc2l6
ZV90CQkJYnl0ZXNfY29waWVkID0gMDsKIAlzdHJ1Y3QgdXNiX3JlcXVlc3QJKnJlcTsKIAlp
bnQJCQl2YWx1ZTsKKwlpbnQgZXJyID0gLUVOT0RFVjsKIAogCURCRyhkZXYsICJwcmludGVy
X3dyaXRlIHRyeWluZyB0byBzZW5kICVkIGJ5dGVzXG4iLCAoaW50KWxlbik7CiAKQEAgLTU4
NiwxMSArNTg3LDggQEAgcHJpbnRlcl93cml0ZShzdHJ1Y3QgZmlsZSAqZmQsIGNvbnN0IGNo
YXIgX191c2VyICpidWYsIHNpemVfdCBsZW4sIGxvZmZfdCAqcHRyKQogCW11dGV4X2xvY2so
JmRldi0+bG9ja19wcmludGVyX2lvKTsKIAlzcGluX2xvY2tfaXJxc2F2ZSgmZGV2LT5sb2Nr
LCBmbGFncyk7CiAKLQlpZiAoZGV2LT5pbnRlcmZhY2UgPCAwKSB7Ci0JCXNwaW5fdW5sb2Nr
X2lycXJlc3RvcmUoJmRldi0+bG9jaywgZmxhZ3MpOwotCQltdXRleF91bmxvY2soJmRldi0+
bG9ja19wcmludGVyX2lvKTsKLQkJcmV0dXJuIC1FTk9ERVY7Ci0JfQorCWlmIChkZXYtPmlu
dGVyZmFjZSA8IDApCisJCWdvdG8gZXJyb3Jfc3BpbjsKIAogCS8qIENoZWNrIGlmIGEgcHJp
bnRlciByZXNldCBoYXBwZW5zIHdoaWxlIHdlIGhhdmUgaW50ZXJydXB0cyBvbiAqLwogCWRl
di0+cmVzZXRfcHJpbnRlciA9IDA7CkBAIC02MDUsOCArNjAzLDggQEAgcHJpbnRlcl93cml0
ZShzdHJ1Y3QgZmlsZSAqZmQsIGNvbnN0IGNoYXIgX191c2VyICpidWYsIHNpemVfdCBsZW4s
IGxvZmZfdCAqcHRyKQogCQkgKiBhIE5PTi1CbG9ja2luZyBjYWxsIG9yIG5vdC4KIAkJICov
CiAJCWlmIChmZC0+Zl9mbGFncyAmIChPX05PTkJMT0NLfE9fTkRFTEFZKSkgewotCQkJbXV0
ZXhfdW5sb2NrKCZkZXYtPmxvY2tfcHJpbnRlcl9pbyk7Ci0JCQlyZXR1cm4gLUVBR0FJTjsK
KwkJCWVyciA9IC1FQUdBSU47CisJCQlnb3RvIGVycm9yX211dGV4OwogCQl9CiAKIAkJLyog
U2xlZXAgdW50aWwgYSB3cml0ZSBidWZmZXIgaXMgYXZhaWxhYmxlICovCkBAIC02NTcsOSAr
NjU1LDE3IEBAIHByaW50ZXJfd3JpdGUoc3RydWN0IGZpbGUgKmZkLCBjb25zdCBjaGFyIF9f
dXNlciAqYnVmLCBzaXplX3QgbGVuLCBsb2ZmX3QgKnB0cikKIAkJLyogV2UndmUgZGlzY29u
bmVjdGVkIG9yIHJlc2V0IHNvIGZyZWUgdGhlIHJlcSBhbmQgYnVmZmVyICovCiAJCWlmIChk
ZXYtPnJlc2V0X3ByaW50ZXIpIHsKIAkJCWxpc3RfYWRkKCZyZXEtPmxpc3QsICZkZXYtPnR4
X3JlcXMpOwotCQkJc3Bpbl91bmxvY2tfaXJxcmVzdG9yZSgmZGV2LT5sb2NrLCBmbGFncyk7
Ci0JCQltdXRleF91bmxvY2soJmRldi0+bG9ja19wcmludGVyX2lvKTsKLQkJCXJldHVybiAt
RUFHQUlOOworCQkJZXJyID0gLUVBR0FJTjsKKwkJCWdvdG8gZXJyb3Jfc3BpbjsKKwkJfQor
CisJCS8qCisJCSAqIFdlIGNhbm5vdCBndWFyYW50ZWUgdXNlciBzcGFjZSBpcyB1c2luZyB0
aGUgQVBJIG5pY2VseQorCQkgKiBUaGlzIGNoZWNrIG5lZWRzIHRvIGJlIGR1cGxpY2F0ZWQK
KwkJICovCisJCWlmICghZGV2LT5pbl9lcC0+ZW5hYmxlZCAmJiBkZXYtPmluX2VwLT5hZGRy
ZXNzKSB7CisJCQllcnIgPSAtRVNIVVRET1dOOworCQkJZ290byBlcnJvcl9zcGluOwogCQl9
CiAKIAkJbGlzdF9hZGQoJnJlcS0+bGlzdCwgJmRldi0+dHhfcmVxc19hY3RpdmUpOwpAQCAt
NjcwLDkgKzY3Niw4IEBAIHByaW50ZXJfd3JpdGUoc3RydWN0IGZpbGUgKmZkLCBjb25zdCBj
aGFyIF9fdXNlciAqYnVmLCBzaXplX3QgbGVuLCBsb2ZmX3QgKnB0cikKIAkJc3Bpbl9sb2Nr
KCZkZXYtPmxvY2spOwogCQlpZiAodmFsdWUpIHsKIAkJCWxpc3RfbW92ZSgmcmVxLT5saXN0
LCAmZGV2LT50eF9yZXFzKTsKLQkJCXNwaW5fdW5sb2NrX2lycXJlc3RvcmUoJmRldi0+bG9j
aywgZmxhZ3MpOwotCQkJbXV0ZXhfdW5sb2NrKCZkZXYtPmxvY2tfcHJpbnRlcl9pbyk7Ci0J
CQlyZXR1cm4gLUVBR0FJTjsKKwkJCWVyciA9IC1FQUdBSU47CisJCQlnb3RvIGVycm9yX3Nw
aW47CiAJCX0KIAl9CiAKQEAgLTY4NSw2ICs2OTAsMTIgQEAgcHJpbnRlcl93cml0ZShzdHJ1
Y3QgZmlsZSAqZmQsIGNvbnN0IGNoYXIgX191c2VyICpidWYsIHNpemVfdCBsZW4sIGxvZmZf
dCAqcHRyKQogCQlyZXR1cm4gYnl0ZXNfY29waWVkOwogCWVsc2UKIAkJcmV0dXJuIC1FQUdB
SU47CisKK2Vycm9yX3NwaW46CisJc3Bpbl91bmxvY2tfaXJxcmVzdG9yZSgmZGV2LT5sb2Nr
LCBmbGFncyk7CitlcnJvcl9tdXRleDoKKwltdXRleF91bmxvY2soJmRldi0+bG9ja19wcmlu
dGVyX2lvKTsKKwlyZXR1cm4gZXJyOwogfQogCiBzdGF0aWMgaW50Ci0tIAoyLjQ0LjAKCg==


--------------bx0M9M0d0PX5GwoPpd9ybdav--