Skip to content

Commit

Permalink
vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
Browse files Browse the repository at this point in the history
uhub(4) will set up the intrxfer and query the current state at its
leisure -- no need to treat racing with it as a failure.

(If there's some reason the caller needs to know about this state,
then (a) there should be a comment explaining why, and (b) the
assertion in vhci_fd_close needs to change.)

Should fix a host of syzbot crashes that were all tripping over the
same assertion but with different gobbledegook on the console --
here's all the ones I found in a quick skim of the front page:

Reported-by: syzbot+58b183ac688d656e1bfd@syzkaller.appspotmail.com
Reported-by: syzbot+e7b0e904184aa2c18224@syzkaller.appspotmail.com
Reported-by: syzbot+476b25a0a3655f3565d6@syzkaller.appspotmail.com
Reported-by: syzbot+e5b69892daf87a7464f2@syzkaller.appspotmail.com
Reported-by: syzbot+db7f0bc71c33a488d0fc@syzkaller.appspotmail.com
Reported-by: syzbot+71d0e82df292c56739da@syzkaller.appspotmail.com
Reported-by: syzbot+dbfaad061b2c909d6332@syzkaller.appspotmail.com
Reported-by: syzbot+d8b90cead59b887fee64@syzkaller.appspotmail.com
Reported-by: syzbot+ea147adc4461acb9f491@syzkaller.appspotmail.com
Reported-by: syzbot+cb7239776d4f51c39ca3@syzkaller.appspotmail.com
Reported-by: syzbot+ffbae2dd4d4a0196b026@syzkaller.appspotmail.com
Reported-by: syzbot+95d4852ea931f775cf35@syzkaller.appspotmail.com
Reported-by: syzbot+3236a5e1bc356909b322@syzkaller.appspotmail.com
Reported-by: syzbot+f5ac32d58eab38bce263@syzkaller.appspotmail.com
Reported-by: syzbot+beb9643da72188117748@syzkaller.appspotmail.com
Reported-by: syzbot+896191203695ba350566@syzkaller.appspotmail.com
Reported-by: syzbot+7c175b48b2682cc329a5@syzkaller.appspotmail.com
Reported-by: syzbot+caa5bc391d36d75335ea@syzkaller.appspotmail.com
Reported-by: syzbot+9fe6d4c43fa10f9e4dfa@syzkaller.appspotmail.com
Reported-by: syzbot+ae9ae663386e72d171b3@syzkaller.appspotmail.com
Reported-by: syzbot+a0c3a5c2f7af91e44c17@syzkaller.appspotmail.com
Reported-by: syzbot+3c157b017d0cafa7aea9@syzkaller.appspotmail.com
Reported-by: syzbot+1e05efbbf2d7df821bfd@syzkaller.appspotmail.com
Reported-by: syzbot+999f20b408f61e22f4e0@syzkaller.appspotmail.com
Reported-by: syzbot+22d227370f78b3a34442@syzkaller.appspotmail.com
Reported-by: syzbot+33760fa9b95349460293@syzkaller.appspotmail.com
Reported-by: syzbot+75d865aafbc9ebadb0f6@syzkaller.appspotmail.com
Reported-by: syzbot+3ddff5cb80bc0c9ac635@syzkaller.appspotmail.com
Reported-by: syzbot+0f942570160d533d892d@syzkaller.appspotmail.com
  • Loading branch information
riastradh authored and riastradh committed Mar 12, 2022
1 parent d1647d9 commit 8934564
Showing 1 changed file with 5 additions and 7 deletions.
12 changes: 5 additions & 7 deletions sys/dev/usb/vhci.c
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* $NetBSD: vhci.c,v 1.25 2022/03/03 06:12:11 riastradh Exp $ */
/* $NetBSD: vhci.c,v 1.26 2022/03/12 15:30:42 riastradh Exp $ */

/*
* Copyright (c) 2019-2020 The NetBSD Foundation, Inc.
Expand Down Expand Up @@ -30,7 +30,7 @@
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: vhci.c,v 1.25 2022/03/03 06:12:11 riastradh Exp $");
__KERNEL_RCSID(0, "$NetBSD: vhci.c,v 1.26 2022/03/12 15:30:42 riastradh Exp $");

#ifdef _KERNEL_OPT
#include "opt_usb.h"
Expand Down Expand Up @@ -787,7 +787,6 @@ vhci_usb_attach(vhci_fd_t *vfd)
vhci_port_t *port;
struct usbd_xfer *xfer;
u_char *p;
int ret = 0;

port = &sc->sc_port[vfd->port];

Expand All @@ -802,7 +801,6 @@ vhci_usb_attach(vhci_fd_t *vfd)
xfer = sc->sc_intrxfer;

if (xfer == NULL) {
ret = ENOBUFS;
goto done;
}
KASSERT(xfer->ux_status == USBD_IN_PROGRESS);
Expand All @@ -821,7 +819,7 @@ vhci_usb_attach(vhci_fd_t *vfd)

done:
mutex_exit(&sc->sc_lock);
return ret;
return 0;
}

static void
Expand Down Expand Up @@ -886,8 +884,7 @@ vhci_usb_detach(vhci_fd_t *vfd)

xfer = sc->sc_intrxfer;
if (xfer == NULL) {
mutex_exit(&sc->sc_lock);
return ENOBUFS;
goto done;
}
KASSERT(xfer->ux_status == USBD_IN_PROGRESS);

Expand All @@ -910,6 +907,7 @@ vhci_usb_detach(vhci_fd_t *vfd)
vhci_port_flush(sc, port);

mutex_exit(&port->lock);
done:
mutex_exit(&sc->sc_lock);
return 0;
}
Expand Down

0 comments on commit 8934564

Please sign in to comment.