All of lore.kernel.org
 help / color / mirror / Atom feed
From: Phong Tran <tranmanphong@gmail.com>
To: syzbot+fd2bd7df88c606eea4ef@syzkaller.appspotmail.com
Cc: andreyknvl@google.com, gregkh@linuxfoundation.org,
	joe@perches.com, linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org, louis@kragniz.eu,
	syzkaller-bugs@googlegroups.com, benquike@gmail.com,
	linux-kernel-mentees@lists.linuxfoundation.org,
	Phong Tran <tranmanphong@gmail.com>
Subject: [PATCH] usb: wusbcore: fix unbalanced get/put cluster_id
Date: Wed, 24 Jul 2019 09:06:01 +0700	[thread overview]
Message-ID: <20190724020601.15257-1-tranmanphong@gmail.com> (raw)
In-Reply-To: <000000000000d48965058e589a94@google.com>

syzboot reported that
https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef

There is not consitency parameter in cluste_id_get/put calling.
In case of getting the id with result is failure, the wusbhc->cluster_id
will not be updated and this can not be used for wusb_cluster_id_put().

Tested report
https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ

Reported-by: syzbot+fd2bd7df88c606eea4ef@syzkaller.appspotmail.com

Reproduce and gdb got the details:

139		addr = wusb_cluster_id_get();
(gdb) n
140		if (addr == 0)
(gdb) print addr
$1 = 254 '\376'
(gdb) n
142		result = __hwahc_set_cluster_id(hwahc, addr);
(gdb) print result
$2 = -71
(gdb) break wusb_cluster_id_put
Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384.
(gdb) s
Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384
384		id = 0xff - id;
(gdb) n
385		BUG_ON(id >= CLUSTER_IDS);
(gdb) print id
$3 = 255 '\377'

Signed-off-by: Phong Tran <tranmanphong@gmail.com>
---
 drivers/usb/host/hwa-hc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 09a8ebd95588..6968b9f2b76b 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -159,7 +159,7 @@ static int hwahc_op_start(struct usb_hcd *usb_hcd)
 	return result;
 
 error_set_cluster_id:
-	wusb_cluster_id_put(wusbhc->cluster_id);
+	wusb_cluster_id_put(addr);
 error_cluster_id_get:
 	goto out;
 
-- 
2.20.1


WARNING: multiple messages have this Message-ID (diff)
From: tranmanphong at gmail.com (Phong Tran)
Subject: [Linux-kernel-mentees] [PATCH] usb: wusbcore: fix unbalanced get/put cluster_id
Date: Wed, 24 Jul 2019 09:06:01 +0700	[thread overview]
Message-ID: <20190724020601.15257-1-tranmanphong@gmail.com> (raw)
In-Reply-To: <000000000000d48965058e589a94@google.com>

syzboot reported that
https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef

There is not consitency parameter in cluste_id_get/put calling.
In case of getting the id with result is failure, the wusbhc->cluster_id
will not be updated and this can not be used for wusb_cluster_id_put().

Tested report
https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ

Reported-by: syzbot+fd2bd7df88c606eea4ef at syzkaller.appspotmail.com

Reproduce and gdb got the details:

139		addr = wusb_cluster_id_get();
(gdb) n
140		if (addr == 0)
(gdb) print addr
$1 = 254 '\376'
(gdb) n
142		result = __hwahc_set_cluster_id(hwahc, addr);
(gdb) print result
$2 = -71
(gdb) break wusb_cluster_id_put
Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384.
(gdb) s
Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384
384		id = 0xff - id;
(gdb) n
385		BUG_ON(id >= CLUSTER_IDS);
(gdb) print id
$3 = 255 '\377'

Signed-off-by: Phong Tran <tranmanphong at gmail.com>
---
 drivers/usb/host/hwa-hc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 09a8ebd95588..6968b9f2b76b 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -159,7 +159,7 @@ static int hwahc_op_start(struct usb_hcd *usb_hcd)
 	return result;
 
 error_set_cluster_id:
-	wusb_cluster_id_put(wusbhc->cluster_id);
+	wusb_cluster_id_put(addr);
 error_cluster_id_get:
 	goto out;
 
-- 
2.20.1

WARNING: multiple messages have this Message-ID (diff)
From: tranmanphong@gmail.com (Phong Tran)
Subject: [Linux-kernel-mentees] [PATCH] usb: wusbcore: fix unbalanced get/put cluster_id
Date: Wed, 24 Jul 2019 09:06:01 +0700	[thread overview]
Message-ID: <20190724020601.15257-1-tranmanphong@gmail.com> (raw)
Message-ID: <20190724020601.75JNYWpxpddwKdEtQHUQlORuQme6vO3DUhKdLjZAGk8@z> (raw)
In-Reply-To: <000000000000d48965058e589a94@google.com>

syzboot reported that
https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef

There is not consitency parameter in cluste_id_get/put calling.
In case of getting the id with result is failure, the wusbhc->cluster_id
will not be updated and this can not be used for wusb_cluster_id_put().

Tested report
https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ

Reported-by: syzbot+fd2bd7df88c606eea4ef at syzkaller.appspotmail.com

Reproduce and gdb got the details:

139		addr = wusb_cluster_id_get();
(gdb) n
140		if (addr == 0)
(gdb) print addr
$1 = 254 '\376'
(gdb) n
142		result = __hwahc_set_cluster_id(hwahc, addr);
(gdb) print result
$2 = -71
(gdb) break wusb_cluster_id_put
Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384.
(gdb) s
Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384
384		id = 0xff - id;
(gdb) n
385		BUG_ON(id >= CLUSTER_IDS);
(gdb) print id
$3 = 255 '\377'

Signed-off-by: Phong Tran <tranmanphong at gmail.com>
---
 drivers/usb/host/hwa-hc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 09a8ebd95588..6968b9f2b76b 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -159,7 +159,7 @@ static int hwahc_op_start(struct usb_hcd *usb_hcd)
 	return result;
 
 error_set_cluster_id:
-	wusb_cluster_id_put(wusbhc->cluster_id);
+	wusb_cluster_id_put(addr);
 error_cluster_id_get:
 	goto out;
 
-- 
2.20.1

  reply	other threads:[~2019-07-24  2:06 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-23 12:48 kernel BUG at drivers/usb/wusbcore/wusbhc.c:LINE! syzbot
2019-07-24  2:06 ` Phong Tran [this message]
2019-07-24  2:06   ` [Linux-kernel-mentees] [PATCH] usb: wusbcore: fix unbalanced get/put cluster_id Phong Tran
2019-07-24  2:06   ` tranmanphong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190724020601.15257-1-tranmanphong@gmail.com \
    --to=tranmanphong@gmail.com \
    --cc=andreyknvl@google.com \
    --cc=benquike@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=joe@perches.com \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=louis@kragniz.eu \
    --cc=syzbot+fd2bd7df88c606eea4ef@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.