Am Dienstag, den 21.04.2020, 16:36 -0700 schrieb syzbot:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: e9010320 usb: cdns3: gadget: make a bunch of functions sta..
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=1263a930100000
> kernel config: https://syzkaller.appspot.com/x/.config?x=bd14feb44652cfaf
> dashboard link: https://syzkaller.appspot.com/bug?extid=cabfa4b5b05ff6be4ef0
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+cabfa4b5b05ff6be4ef0@xxxxxxxxxxxxxxxxxxxxxxxxx
#syz test: https://github.com/google/kasan.git e9010320
From 1c3b3f58608e2c75e0264a1b7eae21245d446d78 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@xxxxxxxx>
Date: Wed, 22 Apr 2020 13:49:55 +0200
Subject: [PATCH] go7007: add sanity checking and insanity checking
A malicious USB device may lack endpoints the driver assumes to exist
Accessing them leads to NULL pointer accesses. This patch introduces
sanity checking.
Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver")
---
drivers/media/usb/go7007/go7007-usb.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index f889c9d740cd..43b2f018df54 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1050,6 +1050,10 @@ static int go7007_usb_probe(struct usb_interface *intf,
int video_pipe, i, v_urb_len;
pr_debug("probing new GO7007 USB board\n");
+ if (!intf)
+ printk(KERN_ERR"Dave, will I dream?\n");
+ if (!usbdev)
+ printk(KERN_ERR"Shai Hulud!\n");
switch (id->driver_info) {
case GO7007_BOARDID_MATRIX_II:
@@ -1121,6 +1125,14 @@ static int go7007_usb_probe(struct usb_interface *intf,
return -ENOMEM;
}
+ /* sanity checks */
+ if (usb && usb->usbdev)
+ ep = usb->usbdev->ep_in[4];
+ else
+ ep = NULL;
+ if (!ep)
+ return -ENODEV;
+
usb->board = board;
usb->usbdev = usbdev;
usb_make_path(usbdev, go->bus_info, sizeof(go->bus_info));
@@ -1141,7 +1153,6 @@ static int go7007_usb_probe(struct usb_interface *intf,
if (usb->intr_urb->transfer_buffer == NULL)
goto allocfail;
- ep = usb->usbdev->ep_in[4];
if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
usb_fill_bulk_urb(usb->intr_urb, usb->usbdev,
usb_rcvbulkpipe(usb->usbdev, 4),
@@ -1263,9 +1274,13 @@ static int go7007_usb_probe(struct usb_interface *intf,
/* Allocate the URBs and buffers for receiving the video stream */
if (board->flags & GO7007_USB_EZUSB) {
+ if (!usb->usbdev->ep_in[6])
+ goto allocfail;
v_urb_len = 1024;
video_pipe = usb_rcvbulkpipe(usb->usbdev, 6);
} else {
+ if (!usb->usbdev->ep_in[1])
+ goto allocfail;
v_urb_len = 512;
video_pipe = usb_rcvbulkpipe(usb->usbdev, 1);
}
@@ -1285,6 +1300,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
/* Allocate the URBs and buffers for receiving the audio stream */
if ((board->flags & GO7007_USB_EZUSB) &&
(board->main_info.flags & GO7007_BOARD_HAS_AUDIO)) {
+ if (!usb->usbdev->ep_in[8])
+ goto allocfail;
for (i = 0; i < 8; ++i) {
usb->audio_urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
if (usb->audio_urbs[i] == NULL)
--
2.16.4
