* [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
@ 2019-09-18 12:01 Bjørn Mork
2019-09-18 12:26 ` divide error in cdc_ncm_update_rxtx_max syzbot
2019-09-21 19:30 ` [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Jakub Kicinski
0 siblings, 2 replies; 7+ messages in thread
From: Bjørn Mork @ 2019-09-18 12:01 UTC (permalink / raw)
To: netdev
Cc: linux-usb, Oliver Neukum, Bjørn Mork, syzbot+ce366e2b8296e25d84f5
Endpoints with zero wMaxPacketSize are not usable for transferring
data. Ignore such endpoints when looking for valid in, out and
status pipes, to make the driver more robust against invalid and
meaningless descriptors.
The wMaxPacketSize of the out pipe is used as divisor. So this change
fixes a divide-by-zero bug.
Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com
Signed-off-by: Bjørn Mork <bjorn@mork.no>
---
#syz test: https://github.com/google/kasan.git f0df5c1b
drivers/net/usb/cdc_ncm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 50c05d0f44cb..00cab3f43a4c 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -681,8 +681,12 @@ cdc_ncm_find_endpoints(struct usbnet *dev, struct usb_interface *intf)
u8 ep;
for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) {
-
e = intf->cur_altsetting->endpoint + ep;
+
+ /* ignore endpoints which cannot transfer data */
+ if (!usb_endpoint_maxp(&e->desc))
+ continue;
+
switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
case USB_ENDPOINT_XFER_INT:
if (usb_endpoint_dir_in(&e->desc)) {
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: divide error in cdc_ncm_update_rxtx_max
2019-09-18 12:01 [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Bjørn Mork
@ 2019-09-18 12:26 ` syzbot
2019-09-21 19:30 ` [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Jakub Kicinski
1 sibling, 0 replies; 7+ messages in thread
From: syzbot @ 2019-09-18 12:26 UTC (permalink / raw)
To: bjorn, linux-usb, netdev, oliver, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com
Tested on:
commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=ce366e2b8296e25d84f5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=114971b5600000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
2019-09-18 12:01 [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Bjørn Mork
2019-09-18 12:26 ` divide error in cdc_ncm_update_rxtx_max syzbot
@ 2019-09-21 19:30 ` Jakub Kicinski
1 sibling, 0 replies; 7+ messages in thread
From: Jakub Kicinski @ 2019-09-21 19:30 UTC (permalink / raw)
To: Bjørn Mork
Cc: netdev, linux-usb, Oliver Neukum, syzbot+ce366e2b8296e25d84f5
On Wed, 18 Sep 2019 14:01:46 +0200, Bjørn Mork wrote:
> Endpoints with zero wMaxPacketSize are not usable for transferring
> data. Ignore such endpoints when looking for valid in, out and
> status pipes, to make the driver more robust against invalid and
> meaningless descriptors.
>
> The wMaxPacketSize of the out pipe is used as divisor. So this change
> fixes a divide-by-zero bug.
>
> Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com
> Signed-off-by: Bjørn Mork <bjorn@mork.no>
Applied, queued, thank you!
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: divide error in cdc_ncm_update_rxtx_max
2019-09-17 14:09 ` syzbot
@ 2019-09-17 15:46 ` Bjørn Mork
0 siblings, 0 replies; 7+ messages in thread
From: Bjørn Mork @ 2019-09-17 15:46 UTC (permalink / raw)
To: syzbot
Cc: andreyknvl, davem, linux-kernel, linux-usb, netdev, oliver,
syzkaller-bugs
syzbot <syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com> writes:
> syzbot has tested the proposed patch but the reproducer still
> triggered crash:
> divide error in usbnet_update_max_qlen
>
> cdc_ncm 5-1:1.0: setting tx_max = 16384
> divide error: 0000 [#1] SMP KASAN
> CPU: 1 PID: 1737 Comm: kworker/1:2 Not tainted 5.3.0-rc7+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine,
> BIOS Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:usbnet_update_max_qlen drivers/net/usb/usbnet.c:344 [inline]
> RIP: 0010:usbnet_update_max_qlen+0x231/0x370 drivers/net/usb/usbnet.c:338
Sure, but that's another error already fixed by Oliver..
I guess this fix worked. But I believe we should see if this is a more
generic issue than just this single driver/bug. I fear it is...
Bjørn
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: divide error in cdc_ncm_update_rxtx_max
2019-09-17 13:52 ` Bjørn Mork
@ 2019-09-17 14:09 ` syzbot
2019-09-17 15:46 ` Bjørn Mork
0 siblings, 1 reply; 7+ messages in thread
From: syzbot @ 2019-09-17 14:09 UTC (permalink / raw)
To: andreyknvl, bjorn, davem, linux-kernel, linux-usb, netdev,
oliver, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
divide error in usbnet_update_max_qlen
cdc_ncm 5-1:1.0: setting tx_max = 16384
divide error: 0000 [#1] SMP KASAN
CPU: 1 PID: 1737 Comm: kworker/1:2 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:usbnet_update_max_qlen drivers/net/usb/usbnet.c:344 [inline]
RIP: 0010:usbnet_update_max_qlen+0x231/0x370 drivers/net/usb/usbnet.c:338
Code: 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 46 01
00 00 48 8d bb f4 00 00 00 31 d2 b8 c8 63 01 00 48 89 f9 <48> f7 b3 a8 01
00 00 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 0f
RSP: 0018:ffff8881c05c7010 EFLAGS: 00010246
RAX: 00000000000163c8 RBX: ffff8881c7334ec0 RCX: ffff8881c7334fb4
RDX: 0000000000000000 RSI: ffffffff8344ecde RDI: ffff8881c7334fb4
RBP: 0000000000000003 R08: ffff8881d4a9b000 R09: ffffed1038e6688a
R10: ffffed1038e66889 R11: ffff8881c733444f R12: 0000000000004000
R13: ffff8881c7334ec0 R14: 0000000000000000 R15: ffff8881d62e77ac
FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5a513e8000 CR3: 00000001d6436000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cdc_ncm_update_rxtx_max+0xa61/0xf30 drivers/net/usb/cdc_ncm.c:437
cdc_ncm_setup drivers/net/usb/cdc_ncm.c:664 [inline]
cdc_ncm_bind_common+0x1005/0x2570 drivers/net/usb/cdc_ncm.c:921
cdc_ncm_bind+0x7c/0x1c0 drivers/net/usb/cdc_ncm.c:1035
usbnet_probe+0xb43/0x23cf drivers/net/usb/usbnet.c:1722
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x6d0 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:721
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2165
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x6d0 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:721
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2165
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 472dbe98145a6d5e ]---
RIP: 0010:usbnet_update_max_qlen drivers/net/usb/usbnet.c:344 [inline]
RIP: 0010:usbnet_update_max_qlen+0x231/0x370 drivers/net/usb/usbnet.c:338
Code: 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 46 01
00 00 48 8d bb f4 00 00 00 31 d2 b8 c8 63 01 00 48 89 f9 <48> f7 b3 a8 01
00 00 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 0f
RSP: 0018:ffff8881c05c7010 EFLAGS: 00010246
RAX: 00000000000163c8 RBX: ffff8881c7334ec0 RCX: ffff8881c7334fb4
RDX: 0000000000000000 RSI: ffffffff8344ecde RDI: ffff8881c7334fb4
RBP: 0000000000000003 R08: ffff8881d4a9b000 R09: ffffed1038e6688a
R10: ffffed1038e66889 R11: ffff8881c733444f R12: 0000000000004000
R13: ffff8881c7334ec0 R14: 0000000000000000 R15: ffff8881d62e77ac
FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5a513e8000 CR3: 00000001d6436000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Tested on:
commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
console output: https://syzkaller.appspot.com/x/log.txt?x=173ea979600000
kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=ce366e2b8296e25d84f5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1538611d600000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: divide error in cdc_ncm_update_rxtx_max
2019-09-16 13:29 divide error in cdc_ncm_update_rxtx_max syzbot
@ 2019-09-17 13:52 ` Bjørn Mork
2019-09-17 14:09 ` syzbot
0 siblings, 1 reply; 7+ messages in thread
From: Bjørn Mork @ 2019-09-17 13:52 UTC (permalink / raw)
To: syzbot
Cc: andreyknvl, davem, linux-kernel, linux-usb, netdev, oliver,
syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 57 bytes --]
#syz test: https://github.com/google/kasan.git f0df5c1b
[-- Attachment #2: 0001-cdc_ncm-fix-divide-error-when-USB-packet-size-is-0.patch --]
[-- Type: text/x-diff, Size: 4937 bytes --]
From dd2eb64899d5e695e5e05c674ecbbc3fce01b4b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Tue, 17 Sep 2019 15:46:03 +0200
Subject: [RFC] cdc_ncm: fix divide error when USB packet size is 0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
syzbot reported:
cdc_ncm 1-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048
cdc_ncm 1-1:1.0: setting rx_max = 2048
cdc_ncm 1-1:1.0: setting tx_max = 16384
divide error: 0000 [#1] SMP KASAN
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:cdc_ncm_update_rxtx_max+0xc6e/0xef0 drivers/net/usb/cdc_ncm.c:419
Code: e0 07 38 c2 0f 9e c1 84 d2 0f 95 c0 84 c1 0f 85 35 02 00 00 0f
b7 5b 04 81 e3 ff 07 00 00 e8 29 47 f7 fd 31 d2 44 89 e0 31 ff <f7> f3
41 89 d5 89 d6 e8 86 48 f7 fd 45 85 ed 0f 85 17 f7 ff ff e8
RSP: 0018:ffff8881da20f030 EFLAGS: 00010246
RAX: 0000000000004000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff83469377 RDI: 0000000000000000
RBP: ffff8881c7ba0000 R08: ffff8881da1f9800 R09: ffffed103b645d58
R10: ffffed103b645d57 R11: ffff8881db22eabf R12: 0000000000004000
R13: 0000000000000000 R14: ffff8881d35f3dc0 R15: ffff8881d2a70f00
FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1059879000 CR3: 00000001d49db000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cdc_ncm_setup drivers/net/usb/cdc_ncm.c:667 [inline]
cdc_ncm_bind_common+0x1005/0x2570 drivers/net/usb/cdc_ncm.c:924
cdc_ncm_bind+0x7c/0x1c0 drivers/net/usb/cdc_ncm.c:1038
usbnet_probe+0xb43/0x23cf drivers/net/usb/usbnet.c:1722
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x6d0 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:721
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2165
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x6d0 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:721
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2165
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace ab75cc10e099d8e9 ]---
Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com
Signed-off-by: Bjørn Mork <bjorn@mork.no>
---
drivers/net/usb/cdc_ncm.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 50c05d0f44cb..029fe9082a8f 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -377,6 +377,7 @@ static void cdc_ncm_update_rxtx_max(struct usbnet *dev, u32 new_rx, u32 new_tx)
{
struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
u8 iface_no = ctx->control->cur_altsetting->desc.bInterfaceNumber;
+ u16 maxp = usb_maxpacket(dev->udev, dev->out, 1);
u32 val;
val = cdc_ncm_check_rx_max(dev, new_rx);
@@ -411,12 +412,8 @@ static void cdc_ncm_update_rxtx_max(struct usbnet *dev, u32 new_rx, u32 new_tx)
/* Adding a pad byte here if necessary simplifies the handling
* in cdc_ncm_fill_tx_frame, making tx_max always represent
* the real skb max size.
- *
- * We cannot use dev->maxpacket here because this is called from
- * .bind which is called before usbnet sets up dev->maxpacket
*/
- if (val != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
- val % usb_maxpacket(dev->udev, dev->out, 1) == 0)
+ if (maxp && val != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) && val % maxp == 0)
val++;
/* we might need to flush any pending tx buffers if running */
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* divide error in cdc_ncm_update_rxtx_max
@ 2019-09-16 13:29 syzbot
2019-09-17 13:52 ` Bjørn Mork
0 siblings, 1 reply; 7+ messages in thread
From: syzbot @ 2019-09-16 13:29 UTC (permalink / raw)
To: andreyknvl, davem, linux-kernel, linux-usb, netdev, oliver,
syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=14cd1459600000
kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=ce366e2b8296e25d84f5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12b4dd85600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=179b7fc1600000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ce366e2b8296e25d84f5@syzkaller.appspotmail.com
cdc_ncm 1-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048
cdc_ncm 1-1:1.0: setting rx_max = 2048
cdc_ncm 1-1:1.0: setting tx_max = 16384
divide error: 0000 [#1] SMP KASAN
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:cdc_ncm_update_rxtx_max+0xc6e/0xef0 drivers/net/usb/cdc_ncm.c:419
Code: e0 07 38 c2 0f 9e c1 84 d2 0f 95 c0 84 c1 0f 85 35 02 00 00 0f b7 5b
04 81 e3 ff 07 00 00 e8 29 47 f7 fd 31 d2 44 89 e0 31 ff <f7> f3 41 89 d5
89 d6 e8 86 48 f7 fd 45 85 ed 0f 85 17 f7 ff ff e8
RSP: 0018:ffff8881da20f030 EFLAGS: 00010246
RAX: 0000000000004000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff83469377 RDI: 0000000000000000
RBP: ffff8881c7ba0000 R08: ffff8881da1f9800 R09: ffffed103b645d58
R10: ffffed103b645d57 R11: ffff8881db22eabf R12: 0000000000004000
R13: 0000000000000000 R14: ffff8881d35f3dc0 R15: ffff8881d2a70f00
FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1059879000 CR3: 00000001d49db000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cdc_ncm_setup drivers/net/usb/cdc_ncm.c:667 [inline]
cdc_ncm_bind_common+0x1005/0x2570 drivers/net/usb/cdc_ncm.c:924
cdc_ncm_bind+0x7c/0x1c0 drivers/net/usb/cdc_ncm.c:1038
usbnet_probe+0xb43/0x23cf drivers/net/usb/usbnet.c:1722
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x6d0 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:721
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2165
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x6d0 drivers/base/dd.c:548
driver_probe_device+0x101/0x1b0 drivers/base/dd.c:721
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828
bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:894
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2165
usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace ab75cc10e099d8e9 ]---
RIP:
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-09-21 19:30 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-18 12:01 [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Bjørn Mork
2019-09-18 12:26 ` divide error in cdc_ncm_update_rxtx_max syzbot
2019-09-21 19:30 ` [PATCH net,stable] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Jakub Kicinski
-- strict thread matches above, loose matches on Subject: below --
2019-09-16 13:29 divide error in cdc_ncm_update_rxtx_max syzbot
2019-09-17 13:52 ` Bjørn Mork
2019-09-17 14:09 ` syzbot
2019-09-17 15:46 ` Bjørn Mork
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).