CVE-2021-47582

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Make doproccontrol() and doprocbulk() killable

The USBDEVFSCONTROL and USBDEVFSBULK ioctls invoke usbstartwait_urb(), which contains an uninterruptible wait with a user-specified timeout value. If timeout value is very large and the device being accessed does not respond in a reasonable amount of time, the kernel will complain about "Task X blocked for more than N seconds", as found in testing by syzbot:

INFO: task syz-executor.0:8700 blocked for more than 143 seconds. Not tainted 5.14.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:syz-executor.0 state:D stack:23192 pid: 8700 ppid: 8455 flags:0x00004004 Call Trace: contextswitch kernel/sched/core.c:4681 [inline] _schedule+0xc07/0x11f0 kernel/sched/core.c:5938 schedule+0x14b/0x210 kernel/sched/core.c:6017 scheduletimeout+0x98/0x2f0 kernel/time/timer.c:1857 dowaitforcommon+0x2da/0x480 kernel/sched/completion.c:85 _waitforcommon kernel/sched/completion.c:106 [inline] waitforcommon kernel/sched/completion.c:117 [inline] waitforcompletiontimeout+0x46/0x60 kernel/sched/completion.c:157 usbstartwaiturb+0x167/0x550 drivers/usb/core/message.c:63 doprocbulk+0x978/0x1080 drivers/usb/core/devio.c:1236 procbulk drivers/usb/core/devio.c:1273 [inline] usbdevdoioctl drivers/usb/core/devio.c:2547 [inline] usbdevioctl+0x3441/0x6b10 drivers/usb/core/devio.c:2713 ...

To fix this problem, this patch replaces usbfs's calls to usbcontrolmsg() and usbbulkmsg() with special-purpose code that does essentially the same thing (as recommended in the comment for usbstartwaiturb()), except that it always uses a killable wait and it uses GFPKERNEL rather than GFP_NOIO.