On Tue, Oct 24, 2017 at 4:59 PM, Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote: > Hi! > > While fuzzing the kernel with syzkaller I've been getting kernel hangs > within the asix driver. > > On commit 6cff0a118f23b98c604a3604ea9de11338e24fbe (4.14-rc6+). > > As far as I can tell the issue is that asix_phy_reset() doesn't > enforce proper timeout. > > asix_phy_reset() calls asix_mdio_read() in a loop 5000 times with 100 > us delay, which gives 500 ms of sleeping time, but it doesn't account > for the time while asix_mdio_read() executes. asix_mdio_read() in > turns contains another loop for 30 iterations with a sleep for 1 ms > (and does a bunch of stuff besides that). As a result asix_mdio_read() > takes ~80 ms in my setup. This results in at least 5000 * 80 ms = 400 > seconds of delay in addition to those insignificant 500 ms. > > Hang stack trace: > > [<ffffffff8297c34e>] usb_start_wait_urb+0xfe/0x220 drivers/usb/core/message.c:61 > [< inline >] usb_internal_control_msg drivers/usb/core/message.c:100 > [<ffffffff8297c735>] usb_control_msg+0x2c5/0x3a0 drivers/usb/core/message.c:151 > [<ffffffff8290efad>] __usbnet_read_cmd+0xcd/0x180 drivers/net/usb/usbnet.c:1986 > [<ffffffff8290f0df>] usbnet_read_cmd+0x7f/0xe0 drivers/net/usb/usbnet.c:2044 > [<ffffffff82900465>] asix_read_cmd+0x75/0xe0 drivers/net/usb/asix_common.c:37 > [<ffffffff8290252b>] asix_mdio_read+0xbb/0x150 drivers/net/usb/asix_common.c:471 > [<ffffffff828fe64a>] asix_phy_reset.isra.9+0xfa/0x1d0 > drivers/net/usb/asix_devices.c:227 > [<ffffffff828ff6c7>] ax88172_bind+0x397/0x4e0 drivers/net/usb/asix_devices.c:284 > [<ffffffff829134b6>] usbnet_probe+0xb06/0x2600 drivers/net/usb/usbnet.c:1726 > [<ffffffff82989f58>] usb_probe_interface+0x358/0x880 > drivers/usb/core/driver.c:361 > [< inline >] really_probe drivers/base/dd.c:413 > [<ffffffff824bd780>] driver_probe_device+0x490/0x800 drivers/base/dd.c:557 > [<ffffffff824bdedb>] __device_attach_driver+0x22b/0x290 drivers/base/dd.c:653 > [<ffffffff824b7e4a>] bus_for_each_drv+0xfa/0x170 drivers/base/bus.c:463 > [<ffffffff824bd10b>] __device_attach+0x1ab/0x290 drivers/base/dd.c:710 > [<ffffffff824bdfda>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:757 > [<ffffffff824bb086>] bus_probe_device+0x1e6/0x290 drivers/base/bus.c:523 > [<ffffffff824b53ff>] device_add+0xb2f/0x1340 drivers/base/core.c:1835 > [<ffffffff829836ad>] usb_set_configuration+0xe9d/0x1660 > drivers/usb/core/message.c:1932 > [<ffffffff829a314e>] generic_probe+0x6e/0xe0 drivers/usb/core/generic.c:174 > [<ffffffff82989bca>] usb_probe_device+0xaa/0xe0 drivers/usb/core/driver.c:266 > [< inline >] really_probe drivers/base/dd.c:413 > [<ffffffff824bd780>] driver_probe_device+0x490/0x800 drivers/base/dd.c:557 > [<ffffffff824bdedb>] __device_attach_driver+0x22b/0x290 drivers/base/dd.c:653 > [<ffffffff824b7e4a>] bus_for_each_drv+0xfa/0x170 drivers/base/bus.c:463 > [<ffffffff824bd10b>] __device_attach+0x1ab/0x290 drivers/base/dd.c:710 > [<ffffffff824bdfda>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:757 > [<ffffffff824bb086>] bus_probe_device+0x1e6/0x290 drivers/base/bus.c:523 > [<ffffffff824b53ff>] device_add+0xb2f/0x1340 drivers/base/core.c:1835 > [<ffffffff82966d53>] usb_new_device+0x7b3/0xff0 drivers/usb/core/hub.c:2457 > [< inline >] hub_port_connect drivers/usb/core/hub.c:4906 > [< inline >] hub_port_connect_change drivers/usb/core/hub.c:5012 > [< inline >] port_event drivers/usb/core/hub.c:5118 > [<ffffffff8296a69a>] hub_event+0x133a/0x2d90 drivers/usb/core/hub.c:5198 > [<ffffffff8115d7ab>] process_one_work+0x78b/0x1540 kernel/workqueue.c:2113 > [<ffffffff8115e647>] worker_thread+0xe7/0xff0 kernel/workqueue.c:2247 > [<ffffffff8116d63c>] kthread+0x33c/0x410 kernel/kthread.c:231 > [<ffffffff838d45da>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 > [<ffffffffffffffff>] 0xffffffffffffffff And another hang stack, this time in mdiobus_scan(): [<ffffffff8297cbce>] usb_start_wait_urb+0xfe/0x220 drivers/usb/core/message.c:61 [< inline >] usb_internal_control_msg drivers/usb/core/message.c:100 [<ffffffff8297cfb5>] usb_control_msg+0x2c5/0x3a0 drivers/usb/core/message.c:151 [<ffffffff829127d4>] __usbnet_write_cmd+0xd4/0x170 drivers/net/usb/usbnet.c:2024 [<ffffffff829128ef>] usbnet_write_cmd+0x7f/0xe0 drivers/net/usb/usbnet.c:2062 [<ffffffff82900545>] asix_write_cmd+0x75/0xe0 drivers/net/usb/asix_common.c:60 [<ffffffff82901a99>] asix_set_sw_mii+0x29/0x90 drivers/net/usb/asix_common.c:288 [<ffffffff829024e5>] asix_mdio_read+0x75/0x150 drivers/net/usb/asix_common.c:467 [<ffffffff82903ad6>] asix_mdio_bus_read+0x66/0x80 drivers/net/usb/ax88172a.c:43 [<ffffffff82759b8f>] mdiobus_read+0x6f/0x2f0 drivers/net/phy/mdio_bus.c:541 [< inline >] get_phy_id drivers/net/phy/phy_device.c:537 [<ffffffff827578b4>] get_phy_device+0x74/0x2f0 drivers/net/phy/phy_device.c:569 [<ffffffff827587df>] mdiobus_scan+0x1f/0x60 drivers/net/phy/mdio_bus.c:475 [<ffffffff82758ae6>] __mdiobus_register+0x2c6/0x560 drivers/net/phy/mdio_bus.c:377 [< inline >] ax88172a_init_mdio drivers/net/usb/ax88172a.c:117 [<ffffffff829045f5>] ax88172a_bind+0x515/0x8e0 drivers/net/usb/ax88172a.c:255 [<ffffffff829134b6>] usbnet_probe+0xb06/0x2600 drivers/net/usb/usbnet.c:1726 [<ffffffff8298a8f8>] usb_probe_interface+0x358/0x880 drivers/usb/core/driver.c:361 [< inline >] really_probe drivers/base/dd.c:413 [<ffffffff824bd780>] driver_probe_device+0x490/0x800 drivers/base/dd.c:557 [<ffffffff824bdedb>] __device_attach_driver+0x22b/0x290 drivers/base/dd.c:653 [<ffffffff824b7e4a>] bus_for_each_drv+0xfa/0x170 drivers/base/bus.c:463 [<ffffffff824bd10b>] __device_attach+0x1ab/0x290 drivers/base/dd.c:710 [<ffffffff824bdfda>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:757 [<ffffffff824bb086>] bus_probe_device+0x1e6/0x290 drivers/base/bus.c:523 [<ffffffff824b53ff>] device_add+0xb2f/0x1340 drivers/base/core.c:1835 [<ffffffff82983f2d>] usb_set_configuration+0xe9d/0x1660 drivers/usb/core/message.c:1932 [<ffffffff829a3aee>] generic_probe+0x6e/0xe0 drivers/usb/core/generic.c:174 [<ffffffff8298a56a>] usb_probe_device+0xaa/0xe0 drivers/usb/core/driver.c:266 > > Messages printed to kernel log: > > [ 244.451821] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable software MII access > [ 244.470152] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.490199] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.510193] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to write reg index 0x0000: -71 > [ 244.511992] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable hardware MII access > [ 244.530191] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to write reg index 0x0000: -71 > [ 244.532024] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable software MII access > [ 244.550197] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.570198] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.590194] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to write reg index 0x0000: -71 > [ 244.591960] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable hardware MII access > [ 244.610193] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to write reg index 0x0000: -71 > [ 244.611978] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable software MII access > [ 244.630224] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.650197] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.670193] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to write reg index 0x0000: -71 > [ 244.671991] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable hardware MII access > [ 244.690170] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to write reg index 0x0000: -71 > [ 244.691907] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to enable software MII access > [ 244.710201] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 > [ 244.730205] asix 1-1:0.0 (unnamed net_device) (uninitialized): > Failed to read reg index 0x0000: -71 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
