From: Andrey Konovalov <andreyknvl@google.com>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: syzbot <syzbot+8ab8bf161038a8768553@syzkaller.appspotmail.com>,
"Jacky . Cao @ sony . com" <Jacky.Cao@sony.com>,
Felipe Balbi <balbi@kernel.org>,
Chunfeng Yun <chunfeng.yun@mediatek.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
LKML <linux-kernel@vger.kernel.org>,
USB list <linux-usb@vger.kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: divide error in dummy_timer
Date: Thu, 24 Oct 2019 19:05:11 +0200 [thread overview]
Message-ID: <CAAeHK+xHTtkSRkMv5kV1hKcR3mhTPkyfUparka3oRBSs6U8yLQ@mail.gmail.com> (raw)
In-Reply-To: <Pine.LNX.4.44L0.1910241053590.1676-100000@iolanthe.rowland.org>
On Thu, Oct 24, 2019 at 5:04 PM Alan Stern <stern@rowland.harvard.edu> wrote:
>
> On Thu, 24 Oct 2019, syzbot wrote:
>
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 22be26f7 usb-fuzzer: main usb gadget fuzzer driver
> > git tree: https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11e2fda7600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=5fe29bc39eff9627
> > dashboard link: https://syzkaller.appspot.com/bug?extid=8ab8bf161038a8768553
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f664e4e00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14674000e00000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+8ab8bf161038a8768553@syzkaller.appspotmail.com
> >
> > divide error: 0000 [#1] SMP KASAN
> > CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc3+ #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > RIP: 0010:transfer drivers/usb/gadget/udc/dummy_hcd.c:1426 [inline]
> > RIP: 0010:dummy_timer+0xad5/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1950
> > Code: 0f 84 f5 fd ff ff e8 8a 55 ab fd 89 de 44 89 e7 e8 70 56 ab fd 41 39
> > dc 0f 82 b0 08 00 00 e8 72 55 ab fd 44 89 e0 31 d2 31 ff <f7> f3 89 d6 89
> > 94 24 c0 00 00 00 e8 cb 56 ab fd 8b 94 24 c0 00 00
> > RSP: 0018:ffff8881db209b20 EFLAGS: 00010046
> > RAX: 0000000000000040 RBX: 0000000000000000 RCX: ffffffff8392c330
> > RDX: 0000000000000000 RSI: ffffffff8392c33e RDI: 0000000000000000
> > RBP: 0000000000000000 R08: ffffffff86c2b200 R09: ffffed103b641353
> > R10: ffffed103b641352 R11: 0000000000000003 R12: 0000000000000040
> > R13: ffff8881d58c0000 R14: dffffc0000000000 R15: ffff8881d78d5a00
> > FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00007fb771a61000 CR3: 00000001d2295000 CR4: 00000000001406f0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> > <IRQ>
> > call_timer_fn+0x179/0x650 kernel/time/timer.c:1404
> > expire_timers kernel/time/timer.c:1449 [inline]
> > __run_timers kernel/time/timer.c:1773 [inline]
> > __run_timers kernel/time/timer.c:1740 [inline]
> > run_timer_softirq+0x5e3/0x1490 kernel/time/timer.c:1786
> > __do_softirq+0x221/0x912 kernel/softirq.c:292
> > invoke_softirq kernel/softirq.c:373 [inline]
> > irq_exit+0x178/0x1a0 kernel/softirq.c:413
> > exiting_irq arch/x86/include/asm/apic.h:536 [inline]
> > smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1137
> > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
> > </IRQ>
> > RIP: 0010:default_idle+0x28/0x2e0 arch/x86/kernel/process.c:581
> > Code: 90 90 41 56 41 55 65 44 8b 2d f4 00 92 7a 41 54 55 53 0f 1f 44 00 00
> > e8 c6 b2 d3 fb e9 07 00 00 00 0f 00 2d ea a5 52 00 fb f4 <65> 44 8b 2d d0
> > 00 92 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
> > RSP: 0018:ffffffff86c07da8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
> > RAX: 0000000000000007 RBX: ffffffff86c2b200 RCX: 0000000000000000
> > RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff86c2ba4c
> > RBP: fffffbfff0d85640 R08: ffffffff86c2b200 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> > cpuidle_idle_call kernel/sched/idle.c:154 [inline]
> > do_idle+0x3b6/0x500 kernel/sched/idle.c:263
> > cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:355
> > start_kernel+0x82a/0x864 init/main.c:784
> > secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
> > Modules linked in:
> > ---[ end trace 02e2d9c7c53d85a5 ]---
> > RIP: 0010:transfer drivers/usb/gadget/udc/dummy_hcd.c:1426 [inline]
> > RIP: 0010:dummy_timer+0xad5/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1950
> > Code: 0f 84 f5 fd ff ff e8 8a 55 ab fd 89 de 44 89 e7 e8 70 56 ab fd 41 39
> > dc 0f 82 b0 08 00 00 e8 72 55 ab fd 44 89 e0 31 d2 31 ff <f7> f3 89 d6 89
> > 94 24 c0 00 00 00 e8 cb 56 ab fd 8b 94 24 c0 00 00
> > RSP: 0018:ffff8881db209b20 EFLAGS: 00010046
> > RAX: 0000000000000040 RBX: 0000000000000000 RCX: ffffffff8392c330
> > RDX: 0000000000000000 RSI: ffffffff8392c33e RDI: 0000000000000000
> > RBP: 0000000000000000 R08: ffffffff86c2b200 R09: ffffed103b641353
> > R10: ffffed103b641352 R11: 0000000000000003 R12: 0000000000000040
> > R13: ffff8881d58c0000 R14: dffffc0000000000 R15: ffff8881d78d5a00
> > FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00007fb771a61000 CR3: 00000001d2295000 CR4: 00000000001406f0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >
> >
> > ---
> > This bug is generated by a bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for more information about syzbot.
> > syzbot engineers can be reached at syzkaller@googlegroups.com.
> >
> > syzbot will keep track of this bug report. See:
> > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> > syzbot can test patches for this bug, for details see:
> > https://goo.gl/tpsmEJ#testing-patches
>
> Is this really the sort of thing we need to catch? It isn't a bug in
> any existing kernel code, as far as I know. Maybe only gadgetfs and
> configfs need to worry about it.
Hi Alan,
Do you mean that the gadget driver must ensure that the max packet
size in the endpoint descriptor is not zero? Do HCDs rely on that? I
can add this check into the driver we use for USB fuzzing.
Thanks!
>
> Alan Stern
>
> #syz test: https://github.com/google/kasan.git 22be26f7
>
> drivers/usb/gadget/udc/dummy_hcd.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -522,6 +522,8 @@ static int dummy_enable(struct usb_ep *_
> * For SS devices the wMaxPacketSize is limited by 1024.
> */
> max = usb_endpoint_maxp(desc);
> + if (max == 0)
> + return -EINVAL;
>
> /* drivers must not request bad settings, since lower levels
> * (hardware or its drivers) may not check. some endpoints
>
next prev parent reply other threads:[~2019-10-24 17:05 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-24 13:58 divide error in dummy_timer syzbot
2019-10-24 15:04 ` Alan Stern
2019-10-24 15:22 ` syzbot
2019-10-24 17:05 ` Andrey Konovalov [this message]
2019-10-24 17:57 ` Alan Stern
2019-10-24 18:08 ` syzbot
2019-10-24 18:58 ` Alan Stern
2019-10-24 19:16 ` syzbot
2019-10-28 14:52 ` [PATCH] USB: Skip endpoints with 0 maxpacket length Alan Stern
2019-10-28 14:54 ` [PATCH] USB: gadget: Reject endpoints with 0 maxpacket value Alan Stern
2019-10-28 16:08 ` Greg KH
2019-10-29 8:38 ` Felipe Balbi
2019-10-24 18:55 ` divide error in dummy_timer Andrey Konovalov
2019-10-24 19:17 ` Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAAeHK+xHTtkSRkMv5kV1hKcR3mhTPkyfUparka3oRBSs6U8yLQ@mail.gmail.com \
--to=andreyknvl@google.com \
--cc=Jacky.Cao@sony.com \
--cc=balbi@kernel.org \
--cc=chunfeng.yun@mediatek.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+8ab8bf161038a8768553@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).