USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

In the Linux kernel, the following vulnerability has been resolved:

USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

The syzbot fuzzer found that the interrupt-URB completion callback in

the cdc-wdm driver was taking too long, and the driver's immediate

resubmission of interrupt URBs with -EPROTO status combined with the

dummy-hcd emulation to cause a CPU lockup:

cdc_wdm 1-1:1.0: nonzero urb status received: -71

cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes

watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625]

CPU#0 Utilization every 4s during lockup:

#1: 98% system, 0% softirq, 3% hardirq, 0% idle

#2: 98% system, 0% softirq, 3% hardirq, 0% idle

#3: 98% system, 0% softirq, 3% hardirq, 0% idle

#4: 98% system, 0% softirq, 3% hardirq, 0% idle

#5: 98% system, 1% softirq, 3% hardirq, 0% idle

Modules linked in:

irq event stamp: 73096

hardirqs last enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline]

hardirqs last enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994

hardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]

hardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551

softirqs last enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline]

softirqs last enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582

softirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588

CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024

Testing showed that the problem did not occur if the two error

messages -- the first two lines above -- were removed; apparently adding

material to the kernel log takes a surprisingly large amount of time.

In any case, the best approach for preventing these lockups and to

avoid spamming the log with thousands of error messages per second is

to ratelimit the two dev_err() calls. Therefore we replace them with

dev_err_ratelimited().