On Thu, 28 Sep 2017, Andrey Konovalov wrote:
> Hi!
>
> I've got the following report while fuzzing the kernel with syzkaller.
>
> On commit dc972a67cc54585bd83ad811c4e9b6ab3dcd427e (4.14-rc2+).
>
> It seems that out pointer ends up being NULL and kernel crashes on
> access to out->desc.bEndpointAddress.
>
> gadgetfs: bound to dummy_udc driver
> usb 1-1: new full-speed USB device number 2 using dummy_hcd
> gadgetfs: connected
> gadgetfs: disconnected
> gadgetfs: connected
> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x81 has invalid
> maxpacket 2040, setting to 64
> usb 1-1: config 2 interface 0 altsetting 206 has an invalid endpoint
> with address 0xFF, skipping
> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x5 has an
> invalid bInterval 255, changing to 4
> usb 1-1: config 2 interface 0 has no altsetting 0
> usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0
> usb 1-1: New USB device strings: Mfr=0, Product=185, SerialNumber=1
> usb 1-1: Product: a
> usb 1-1: SerialNumber: a
> gadgetfs: configuration #2
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> Modules linked in:
> CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted
> 4.14.0-rc2-42664-gaf7d1481b3cb #297
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: usb_hub_wq hub_event
> task: ffff880064328000 task.stack: ffff880064398000
> RIP: 0010:get_endpoints drivers/usb/misc/usbtest.c:208
> RIP: 0010:usbtest_probe+0x114f/0x1ef0 drivers/usb/misc/usbtest.c:2706
This looks like a simple logic error.
Alan Stern
Index: usb-4.x/drivers/usb/misc/usbtest.c
===================================================================
--- usb-4.x.orig/drivers/usb/misc/usbtest.c
+++ usb-4.x/drivers/usb/misc/usbtest.c
@@ -202,12 +202,13 @@ found:
return tmp;
}
- if (in) {
+ if (in)
dev->in_pipe = usb_rcvbulkpipe(udev,
in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+ if (out)
dev->out_pipe = usb_sndbulkpipe(udev,
out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
- }
+
if (iso_in) {
dev->iso_in = &iso_in->desc;
dev->in_iso_pipe = usb_rcvisocpipe(udev,
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
