* KASAN reporting: general protection fault in flexcop_usb_probe
@ 2019-07-30 7:48 Oliver Neukum
2019-07-30 8:30 ` syzbot
0 siblings, 1 reply; 15+ messages in thread
From: Oliver Neukum @ 2019-07-30 7:48 UTC (permalink / raw)
To: syzbot+d93dff37e6a89431c158; +Cc: linux-media, linux-usb
Reacting to this:
Title: general protection fault in flexcop_usb_probe
Last occurred: 0 days ago
Reported: 102 days ago
Branches: Mainline (with usb-fuzzer patches)
Dashboard link: https://syzkaller.appspot.com/bug?id=c0203bd72037d0
7493f4b7562411e4f5f4553a8f
Original thread: https://lkml.kernel.org/lkml/00000000000010fe260586
536e86@google.com/T/#u
This bug has a C reproducer.
No one replied to the original thread for this bug.
This looks like a bug in a media USB driver.
If you fix this bug, please add the following tag to the commit:
Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
#syz test: https://github.com/google/kasan.git 9a33b369
From 5a34ecc6c75479a9f245a867e1ce37e6e28f58f8 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 29 Jul 2019 16:21:11 +0200
Subject: [PATCH] b2c2-flexcop-usb: add sanity checking
The driver needs an isochronous endpoint to be present. It will
oops in its absence. Add checking for it.
Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/media/usb/b2c2/flexcop-usb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
index 1826ff825c2e..1a801dc286f8 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -538,6 +538,9 @@ static int flexcop_usb_probe(struct usb_interface *intf,
struct flexcop_device *fc = NULL;
int ret;
+ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
err("out of memory\n");
return -ENOMEM;
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: general protection fault in flexcop_usb_probe
2019-07-30 7:48 KASAN reporting: general protection fault in flexcop_usb_probe Oliver Neukum
@ 2019-07-30 8:30 ` syzbot
2019-09-20 16:01 ` Andrey Konovalov
0 siblings, 1 reply; 15+ messages in thread
From: syzbot @ 2019-07-30 8:30 UTC (permalink / raw)
To: linux-media, linux-usb, oneukum, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
Tested on:
commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1226c2d8600000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-07-30 8:30 ` syzbot
@ 2019-09-20 16:01 ` Andrey Konovalov
2019-09-23 9:06 ` Oliver Neukum
0 siblings, 1 reply; 15+ messages in thread
From: Andrey Konovalov @ 2019-09-20 16:01 UTC (permalink / raw)
To: syzbot; +Cc: linux-media, USB list, Oliver Neukum, syzkaller-bugs
On Tue, Jul 30, 2019 at 10:30 AM syzbot
<syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger
> crash:
>
> Reported-and-tested-by:
> syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git
> kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> patch: https://syzkaller.appspot.com/x/patch.diff?x=1226c2d8600000
>
> Note: testing is done by a robot and is best-effort only.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000081a9c1058ee1d06a%40google.com.
Hi Oliver,
I was wondering if you've submitted this patch anywhere? The bug is
still happening.
https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
Thanks!
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-09-20 16:01 ` Andrey Konovalov
@ 2019-09-23 9:06 ` Oliver Neukum
2019-09-23 12:46 ` Andrey Konovalov
0 siblings, 1 reply; 15+ messages in thread
From: Oliver Neukum @ 2019-09-23 9:06 UTC (permalink / raw)
To: Andrey Konovalov, syzbot; +Cc: syzkaller-bugs, linux-media, USB list
Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:
> > Reported-and-tested-by:
> > syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
[..]
> Hi Oliver,
>
> I was wondering if you've submitted this patch anywhere? The bug is
> still happening.
>
> https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
Hi,
I definitely did submit it:
https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
Regards
Oliver
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-09-23 9:06 ` Oliver Neukum
@ 2019-09-23 12:46 ` Andrey Konovalov
2019-09-23 12:51 ` Hans Verkuil
0 siblings, 1 reply; 15+ messages in thread
From: Andrey Konovalov @ 2019-09-23 12:46 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: syzbot, syzkaller-bugs, linux-media, USB list, Oliver Neukum
On Mon, Sep 23, 2019 at 11:21 AM Oliver Neukum <oneukum@suse.com> wrote:
>
> Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:
>
> > > Reported-and-tested-by:
> > > syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
>
> [..]
> > Hi Oliver,
> >
> > I was wondering if you've submitted this patch anywhere? The bug is
> > still happening.
> >
> > https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
>
> Hi,
>
> I definitely did submit it:
> https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
Hi Mauro,
Do you know what happened to this patch? Did it get lost?
Thanks!
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-09-23 12:46 ` Andrey Konovalov
@ 2019-09-23 12:51 ` Hans Verkuil
2019-11-07 15:02 ` Oliver Neukum
0 siblings, 1 reply; 15+ messages in thread
From: Hans Verkuil @ 2019-09-23 12:51 UTC (permalink / raw)
To: Andrey Konovalov, Mauro Carvalho Chehab
Cc: syzbot, syzkaller-bugs, linux-media, USB list, Oliver Neukum
On 9/23/19 2:46 PM, Andrey Konovalov wrote:
> On Mon, Sep 23, 2019 at 11:21 AM Oliver Neukum <oneukum@suse.com> wrote:
>>
>> Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:
>>
>>>> Reported-and-tested-by:
>>>> syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
>>
>> [..]
>>> Hi Oliver,
>>>
>>> I was wondering if you've submitted this patch anywhere? The bug is
>>> still happening.
>>>
>>> https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
>>
>> Hi,
>>
>> I definitely did submit it:
>> https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
>
> Hi Mauro,
>
> Do you know what happened to this patch? Did it get lost?
>
> Thanks!
>
Still sitting unreviewed in patchwork: https://patchwork.linuxtv.org/patch/57785/
Not sure why this wasn't picked up.
Regards,
Hans
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-09-23 12:51 ` Hans Verkuil
@ 2019-11-07 15:02 ` Oliver Neukum
2019-11-07 15:47 ` Hans Verkuil
0 siblings, 1 reply; 15+ messages in thread
From: Oliver Neukum @ 2019-11-07 15:02 UTC (permalink / raw)
To: Hans Verkuil, Andrey Konovalov, Mauro Carvalho Chehab
Cc: syzkaller-bugs, syzbot, linux-media, USB list
Am Montag, den 23.09.2019, 14:51 +0200 schrieb Hans Verkuil:
> On 9/23/19 2:46 PM, Andrey Konovalov wrote:
> > On Mon, Sep 23, 2019 at 11:21 AM Oliver Neukum <oneukum@suse.com> wrote:
> > >
> > > Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:
> > >
> > > > > Reported-and-tested-by:
> > > > > syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
> > >
> > > [..]
> > > > Hi Oliver,
> > > >
> > > > I was wondering if you've submitted this patch anywhere? The bug is
> > > > still happening.
> > > >
> > > > https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
> > >
> > > Hi,
> > >
> > > I definitely did submit it:
> > > https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
> >
> > Hi Mauro,
> >
> > Do you know what happened to this patch? Did it get lost?
> >
> > Thanks!
> >
>
> Still sitting unreviewed in patchwork: https://patchwork.linuxtv.org/patch/57785/
>
> Not sure why this wasn't picked up.
Hi,
AFAICT it is still in the state new. What should I do?
Regards
Oliver
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-11-07 15:02 ` Oliver Neukum
@ 2019-11-07 15:47 ` Hans Verkuil
2019-11-08 9:07 ` Sean Young
0 siblings, 1 reply; 15+ messages in thread
From: Hans Verkuil @ 2019-11-07 15:47 UTC (permalink / raw)
To: Oliver Neukum, Andrey Konovalov, Mauro Carvalho Chehab, Sean Young
Cc: syzkaller-bugs, syzbot, linux-media, USB list
Hi Sean,
Mauro is very busy, so can you pick this up? And perhaps check patchwork for more
trivial DVB patches that can be included in a pull request?
Regards,
Hans
On 11/7/19 4:02 PM, Oliver Neukum wrote:
> Am Montag, den 23.09.2019, 14:51 +0200 schrieb Hans Verkuil:
>> On 9/23/19 2:46 PM, Andrey Konovalov wrote:
>>> On Mon, Sep 23, 2019 at 11:21 AM Oliver Neukum <oneukum@suse.com> wrote:
>>>>
>>>> Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:
>>>>
>>>>>> Reported-and-tested-by:
>>>>>> syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
>>>>
>>>> [..]
>>>>> Hi Oliver,
>>>>>
>>>>> I was wondering if you've submitted this patch anywhere? The bug is
>>>>> still happening.
>>>>>
>>>>> https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
>>>>
>>>> Hi,
>>>>
>>>> I definitely did submit it:
>>>> https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
>>>
>>> Hi Mauro,
>>>
>>> Do you know what happened to this patch? Did it get lost?
>>>
>>> Thanks!
>>>
>>
>> Still sitting unreviewed in patchwork: https://patchwork.linuxtv.org/patch/57785/
>>
>> Not sure why this wasn't picked up.
>
> Hi,
>
> AFAICT it is still in the state new. What should I do?
>
> Regards
> Oliver
>
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-11-07 15:47 ` Hans Verkuil
@ 2019-11-08 9:07 ` Sean Young
0 siblings, 0 replies; 15+ messages in thread
From: Sean Young @ 2019-11-08 9:07 UTC (permalink / raw)
To: Hans Verkuil
Cc: Oliver Neukum, Andrey Konovalov, Mauro Carvalho Chehab,
syzkaller-bugs, syzbot, linux-media, USB list
Hi Hans, Oliver,
My bad, it slipped between the cracks. I am preparing a pull request now.
Sorry about this.
Sean
On Thu, Nov 07, 2019 at 04:47:50PM +0100, Hans Verkuil wrote:
> Hi Sean,
>
> Mauro is very busy, so can you pick this up? And perhaps check patchwork for more
> trivial DVB patches that can be included in a pull request?
>
> Regards,
>
> Hans
>
> On 11/7/19 4:02 PM, Oliver Neukum wrote:
> > Am Montag, den 23.09.2019, 14:51 +0200 schrieb Hans Verkuil:
> >> On 9/23/19 2:46 PM, Andrey Konovalov wrote:
> >>> On Mon, Sep 23, 2019 at 11:21 AM Oliver Neukum <oneukum@suse.com> wrote:
> >>>>
> >>>> Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:
> >>>>
> >>>>>> Reported-and-tested-by:
> >>>>>> syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
> >>>>
> >>>> [..]
> >>>>> Hi Oliver,
> >>>>>
> >>>>> I was wondering if you've submitted this patch anywhere? The bug is
> >>>>> still happening.
> >>>>>
> >>>>> https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
> >>>>
> >>>> Hi,
> >>>>
> >>>> I definitely did submit it:
> >>>> https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
> >>>
> >>> Hi Mauro,
> >>>
> >>> Do you know what happened to this patch? Did it get lost?
> >>>
> >>> Thanks!
> >>>
> >>
> >> Still sitting unreviewed in patchwork: https://patchwork.linuxtv.org/patch/57785/
> >>
> >> Not sure why this wasn't picked up.
> >
> > Hi,
> >
> > AFAICT it is still in the state new. What should I do?
> >
> > Regards
> > Oliver
> >
^ permalink raw reply [flat|nested] 15+ messages in thread
* KASAN reporting: general protection fault in flexcop_usb_probe
@ 2019-07-29 14:26 Oliver Neukum
2019-07-29 15:05 ` syzbot
0 siblings, 1 reply; 15+ messages in thread
From: Oliver Neukum @ 2019-07-29 14:26 UTC (permalink / raw)
To: syzbot+d93dff37e6a89431c158; +Cc: linux-media, linux-usb
Reacting to this:
Title: general protection fault in flexcop_usb_probe
Last occurred: 0 days ago
Reported: 102 days ago
Branches: Mainline (with usb-fuzzer patches)
Dashboard link: https://syzkaller.appspot.com/bug?id=c0203bd72037d0
7493f4b7562411e4f5f4553a8f
Original thread: https://lkml.kernel.org/lkml/00000000000010fe260586
536e86@google.com/T/#u
This bug has a C reproducer.
No one replied to the original thread for this bug.
This looks like a bug in a media USB driver.
If you fix this bug, please add the following tag to the commit:
Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
#syz test: https://github.com/google/kasan.git usb-fuzzer-usb-testing-2019.07.11
From 5a34ecc6c75479a9f245a867e1ce37e6e28f58f8 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 29 Jul 2019 16:21:11 +0200
Subject: [PATCH] b2c2-flexcop-usb: add sanity checking
The driver needs an isochronous endpoint to be present. It will
oops in its absence. Add checking for it.
Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/media/usb/b2c2/flexcop-usb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
index 1826ff825c2e..1a801dc286f8 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -538,6 +538,9 @@ static int flexcop_usb_probe(struct usb_interface *intf,
struct flexcop_device *fc = NULL;
int ret;
+ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
err("out of memory\n");
return -ENOMEM;
--
2.16.4
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: general protection fault in flexcop_usb_probe
2019-07-29 14:26 KASAN reporting: " Oliver Neukum
@ 2019-07-29 15:05 ` syzbot
2019-07-29 16:54 ` Andrey Konovalov
0 siblings, 1 reply; 15+ messages in thread
From: syzbot @ 2019-07-29 15:05 UTC (permalink / raw)
To: linux-media, linux-usb, oneukum, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
Tested on:
commit: 6a3599ce usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
usb-fuzzer-usb-testing-2019.07.11
kernel config: https://syzkaller.appspot.com/x/.config?x=662450485a75f217
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1036e80c600000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-07-29 15:05 ` syzbot
@ 2019-07-29 16:54 ` Andrey Konovalov
2019-07-29 17:34 ` syzbot
2019-07-30 7:51 ` Oliver Neukum
0 siblings, 2 replies; 15+ messages in thread
From: Andrey Konovalov @ 2019-07-29 16:54 UTC (permalink / raw)
To: Oliver Neukum, syzbot; +Cc: linux-media, USB list, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 1699 bytes --]
On Mon, Jul 29, 2019 at 5:05 PM syzbot
<syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger
> crash:
>
> Reported-and-tested-by:
> syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 6a3599ce usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git
> usb-fuzzer-usb-testing-2019.07.11
> kernel config: https://syzkaller.appspot.com/x/.config?x=662450485a75f217
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> patch: https://syzkaller.appspot.com/x/patch.diff?x=1036e80c600000
>
> Note: testing is done by a robot and is best-effort only.
Hi Oliver,
Thanks a lot for fixing all of these USB bugs!
The usb-fuzzer branch is working again, so it should be possible to
use it for testing. But, I've actually just realized, that the proper
way to test fixes for USB bugs is to use the exact commit hash that is
provided in each bug report (the kernel interface for emulating USB
device is not stable yet, and has significantly changed at least
once). I've updated syzbot documentation to reflect this.
Let's try to retest this one with the right kernel commit id:
#syz test: https://github.com/google/kasan.git 9a33b369
Thanks!
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000488c6d058ed337b2%40google.com.
[-- Attachment #2: flexcop.txt --]
[-- Type: text/plain, Size: 535 bytes --]
diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
index 1826ff825c2e..1a801dc286f8 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -538,6 +538,9 @@ static int flexcop_usb_probe(struct usb_interface *intf,
struct flexcop_device *fc = NULL;
int ret;
+ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
err("out of memory\n");
return -ENOMEM;
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: general protection fault in flexcop_usb_probe
2019-07-29 16:54 ` Andrey Konovalov
@ 2019-07-29 17:34 ` syzbot
2019-07-30 7:51 ` Oliver Neukum
1 sibling, 0 replies; 15+ messages in thread
From: syzbot @ 2019-07-29 17:34 UTC (permalink / raw)
To: andreyknvl, linux-media, linux-usb, oneukum, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
Tested on:
commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=11cc12d8600000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-07-29 16:54 ` Andrey Konovalov
2019-07-29 17:34 ` syzbot
@ 2019-07-30 7:51 ` Oliver Neukum
2019-07-30 8:52 ` Dmitry Vyukov
1 sibling, 1 reply; 15+ messages in thread
From: Oliver Neukum @ 2019-07-30 7:51 UTC (permalink / raw)
To: Andrey Konovalov, syzbot; +Cc: syzkaller-bugs, linux-media, USB list
Am Montag, den 29.07.2019, 18:54 +0200 schrieb Andrey Konovalov:
Hi,
> Thanks a lot for fixing all of these USB bugs!
I fear the day we get serious about MA USB.
All these issues will turn into security issues.
> The usb-fuzzer branch is working again, so it should be possible to
> use it for testing. But, I've actually just realized, that the proper
> way to test fixes for USB bugs is to use the exact commit hash that is
> provided in each bug report (the kernel interface for emulating USB
> device is not stable yet, and has significantly changed at least
> once). I've updated syzbot documentation to reflect this.
Where is taht documentation?
> Let's try to retest this one with the right kernel commit id:
>
> #syz test: https://github.com/google/kasan.git 9a33b369
Retesting.
Regards
Oliver
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: general protection fault in flexcop_usb_probe
2019-07-30 7:51 ` Oliver Neukum
@ 2019-07-30 8:52 ` Dmitry Vyukov
0 siblings, 0 replies; 15+ messages in thread
From: Dmitry Vyukov @ 2019-07-30 8:52 UTC (permalink / raw)
To: Oliver Neukum
Cc: Andrey Konovalov, syzbot, syzkaller-bugs, linux-media, USB list
On Tue, Jul 30, 2019 at 9:51 AM Oliver Neukum <oneukum@suse.com> wrote:
>
> Am Montag, den 29.07.2019, 18:54 +0200 schrieb Andrey Konovalov:
>
> Hi,
>
> > Thanks a lot for fixing all of these USB bugs!
>
> I fear the day we get serious about MA USB.
> All these issues will turn into security issues.
>
> > The usb-fuzzer branch is working again, so it should be possible to
> > use it for testing. But, I've actually just realized, that the proper
> > way to test fixes for USB bugs is to use the exact commit hash that is
> > provided in each bug report (the kernel interface for emulating USB
> > device is not stable yet, and has significantly changed at least
> > once). I've updated syzbot documentation to reflect this.
>
> Where is taht documentation?
Hi Oliver,
The link is referenced in every bug report ;)
https://groups.google.com/forum/#!topic/syzkaller-bugs/C4kgnyomFyQ
> See https://goo.gl/tpsmEJ for more information about syzbot.
^ permalink raw reply [flat|nested] 15+ messages in thread
* general protection fault in flexcop_usb_probe
@ 2019-04-12 11:16 syzbot
0 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2019-04-12 11:16 UTC (permalink / raw)
To: andreyknvl, linux-kernel, linux-media, linux-usb, mchehab,
syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan/tree/usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=15adefa7200000
kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15
dashboard link: https://syzkaller.appspot.com/bug?extid=d93dff37e6a89431c158
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175c0cd3200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1186469f200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
b2c2-flexcop: found 'LG Electronics LGDT3303 VSB/QAM Frontend' .
usb 1-1: DVB: registering adapter 0 frontend 0 (LG Electronics LGDT3303
VSB/QAM Frontend)...
b2c2-flexcop: initialization of 'Air2PC/AirStar 2 ATSC 3rd generation
(HD5000)' at the 'USB' bus controlled by a 'FlexCopIII' complete
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:flexcop_usb_transfer_init
drivers/media/usb/b2c2/flexcop-usb.c:429 [inline]
RIP: 0010:flexcop_usb_probe.cold+0x1cb/0x7bd
drivers/media/usb/b2c2/flexcop-usb.c:574
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 74 05 e8 dc d2 65 f7 48 8b 5b 18 b8
ff ff 37 00 48 c1 e0 2a 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48
89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 c1
RSP: 0018:ffff8880a862f2e0 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a430240
RDX: 0000000000000000 RSI: ffffffff8a430300 RDI: 0000000000000004
RBP: ffff88809d3b9108 R08: ffff8880a84d4980 R09: ffffed1015a24fc9
R10: ffffed1015a24fc8 R11: ffff8880ad127e47 R12: ffff88809d3b9148
R13: 0000000000000000 R14: ffff88809d3b9100 R15: ffff88809575c000
FS: 0000000000000000(0000) GS:ffff8880ad100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd361552000 CR3: 0000000095f74000 CR4: 00000000001406e0
Call Trace:
usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361
really_probe+0x2da/0xb10 drivers/base/dd.c:509
driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
__device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
__device_attach+0x223/0x3a0 drivers/base/dd.c:844
bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
device_add+0xad2/0x16e0 drivers/base/core.c:2106
usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
really_probe+0x2da/0xb10 drivers/base/dd.c:509
driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
__device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
__device_attach+0x223/0x3a0 drivers/base/dd.c:844
bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
device_add+0xad2/0x16e0 drivers/base/core.c:2106
usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
hub_port_connect drivers/usb/core/hub.c:5089 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
port_event drivers/usb/core/hub.c:5350 [inline]
hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
kthread+0x313/0x420 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 8800fc602d77e417 ]---
RIP: 0010:flexcop_usb_transfer_init
drivers/media/usb/b2c2/flexcop-usb.c:429 [inline]
RIP: 0010:flexcop_usb_probe.cold+0x1cb/0x7bd
drivers/media/usb/b2c2/flexcop-usb.c:574
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 74 05 e8 dc d2 65 f7 48 8b 5b 18 b8
ff ff 37 00 48 c1 e0 2a 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48
89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 c1
RSP: 0018:ffff8880a862f2e0 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a430240
RDX: 0000000000000000 RSI: ffffffff8a430300 RDI: 0000000000000004
RBP: ffff88809d3b9108 R08: ffff8880a84d4980 R09: ffffed1015a24fc9
R10: ffffed1015a24fc8 R11: ffff8880ad127e47 R12: ffff88809d3b9148
R13: 0000000000000000 R14: ffff88809d3b9100 R15: ffff88809575c000
FS: 0000000000000000(0000) GS:ffff8880ad100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd361552000 CR3: 0000000095f74000 CR4: 00000000001406e0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 15+ messages in thread
end of thread, other threads:[~2019-11-08 9:07 UTC | newest]
Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-30 7:48 KASAN reporting: general protection fault in flexcop_usb_probe Oliver Neukum
2019-07-30 8:30 ` syzbot
2019-09-20 16:01 ` Andrey Konovalov
2019-09-23 9:06 ` Oliver Neukum
2019-09-23 12:46 ` Andrey Konovalov
2019-09-23 12:51 ` Hans Verkuil
2019-11-07 15:02 ` Oliver Neukum
2019-11-07 15:47 ` Hans Verkuil
2019-11-08 9:07 ` Sean Young
-- strict thread matches above, loose matches on Subject: below --
2019-07-29 14:26 KASAN reporting: " Oliver Neukum
2019-07-29 15:05 ` syzbot
2019-07-29 16:54 ` Andrey Konovalov
2019-07-29 17:34 ` syzbot
2019-07-30 7:51 ` Oliver Neukum
2019-07-30 8:52 ` Dmitry Vyukov
2019-04-12 11:16 syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).