On Thu, Nov 21, 2019 at 07:25:09AM -0800, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: 46178223 usb: gadget: add raw-gadget interface > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=176f9836e00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=99c88c44660624e7 > dashboard link: https://syzkaller.appspot.com/bug?extid=a36ab65c6653d7ccdd62 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1447d3bae00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ef3a86e00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+a36ab65c6653d7ccdd62@xxxxxxxxxxxxxxxxxxxxxxxxx > > usb 1-1: 208:241 : does not exist > usb 1-1: 208:242 : does not exist > usb 1-1: 208:243 : does not exist > usb 1-1: 208:244 : does not exist > usb 1-1: 208:245 : does not exist > usb 1-1: 208:246 : does not exist > usb 1-1: 208:247 : does not exist > usb 1-1: 208:248 : does not exist > usb 1-1: 208:249 : does not exist > usb 1-1: 208:250 : does not exist These error messages are because: sound/usb/card.c 128 static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int interface) 129 { 130 struct usb_device *dev = chip->dev; 131 struct usb_host_interface *alts; 132 struct usb_interface_descriptor *altsd; 133 struct usb_interface *iface = usb_ifnum_to_if(dev, interface); 134 135 if (!iface) { 136 dev_err(&dev->dev, "%u:%d : does not exist\n", 137 ctrlif, interface); 138 return -EINVAL; 139 } "iface" is NULL. The caller ignores the -EINVAL (correctly I think). Then the NULL dereference happens in snd_usb_mixer_controls_badd() sound/usb/mixer.c 2903 static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer, 2904 int ctrlif) 2905 { 2906 struct usb_device *dev = mixer->chip->dev; 2907 struct usb_interface_assoc_descriptor *assoc; 2908 int badd_profile = mixer->chip->badd_profile; 2909 struct uac3_badd_profile *f; 2910 const struct usbmix_ctl_map *map; 2911 int p_chmask = 0, c_chmask = 0, st_chmask = 0; 2912 int i; 2913 2914 assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc; 2915 2916 /* Detect BADD capture/playback channels from AS EP descriptors */ 2917 for (i = 0; i < assoc->bInterfaceCount; i++) { 2918 int intf = assoc->bFirstInterface + i; 2919 2920 struct usb_interface *iface; 2921 struct usb_host_interface *alts; 2922 struct usb_interface_descriptor *altsd; 2923 unsigned int maxpacksize; 2924 char dir_in; 2925 int chmask, num; 2926 2927 if (intf == ctrlif) 2928 continue; 2929 2930 iface = usb_ifnum_to_if(dev, intf); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ iface is not checked. Should it be "if (!iface) continue;?" 2931 num = iface->num_altsetting; 2932 2933 if (num < 2) 2934 return -EINVAL; 2935 I'm not sure. regards, dan carpenter
