USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts

The usbtmc driver accepts timeout values specified by the user in an
ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
Since the user can specify arbitrarily long timeouts and
usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
instead to avoid the possibility of the user hanging a kernel thread
indefinitely.

Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 2526a0e03cdebcb2cd25dae4e30519a643b333fd..d39bbfd7fd18a91b24237cd99b881c36a5e4cc98 100644 (file)
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struct usbtmc_file_data *file_data)
        buffer[1] = data->bTag;
        buffer[2] = ~data->bTag;
 
-       retval = usb_bulk_msg(data->usb_dev,
+       retval = usb_bulk_msg_killable(data->usb_dev,
                              usb_sndbulkpipe(data->usb_dev,
                                              data->bulk_out),
                              buffer, USBTMC_HEADER_SIZE,
@@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_file_data *file_data,
        buffer[11] = 0; /* Reserved */
 
        /* Send bulk URB */
-       retval = usb_bulk_msg(data->usb_dev,
+       retval = usb_bulk_msg_killable(data->usb_dev,
                              usb_sndbulkpipe(data->usb_dev,
                                              data->bulk_out),
                              buffer, USBTMC_HEADER_SIZE,
@@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf,
        actual = 0;
 
        /* Send bulk URB */
-       retval = usb_bulk_msg(data->usb_dev,
+       retval = usb_bulk_msg_killable(data->usb_dev,
                              usb_rcvbulkpipe(data->usb_dev,
                                              data->bulk_in),
                              buffer, bufsize, &actual,