From: Andrey Konovalov <andreyknvl@google.com>
To: syzbot <syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com>,
Alan Stern <stern@rowland.harvard.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Kai Heng Feng <kai.heng.feng@canonical.com>,
LKML <linux-kernel@vger.kernel.org>,
USB list <linux-usb@vger.kernel.org>,
mans@mansr.com, Oliver Neukum <oneukum@suse.com>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: general protection fault in usb_set_interface
Date: Fri, 13 Dec 2019 13:15:52 +0100 [thread overview]
Message-ID: <CAAeHK+zTprgU-kp3cOL2S6Wo1tgqL-1sCkEi3Bb8o0BAG71y-A@mail.gmail.com> (raw)
In-Reply-To: <000000000000c2531f0592ab96fb@google.com>
[-- Attachment #1: Type: text/plain, Size: 5135 bytes --]
On Mon, Sep 16, 2019 at 3:29 PM syzbot
<syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=158b66f1600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> dashboard link: https://syzkaller.appspot.com/bug?extid=7fa38a608b1075dfd634
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f57db9600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=127b61a5600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com
>
> usb 3-1: usbvision_write_reg: failed: error -2
> usbvision_set_audio: can't write iopin register for audio switching
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> CPU: 1 PID: 1955 Comm: v4l_id Not tainted 5.3.0-rc7+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:usb_set_interface+0x34/0xa50 drivers/usb/core/message.c:1362
> Code: fc 55 53 48 83 ec 40 89 54 24 18 89 74 24 10 e8 22 1c ef fd 49 8d 7c
> 24 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 fb 08 00 00 49 8b 44 24 48 49 8d 7c 24 18 48 89
> RSP: 0018:ffff8881cb19fd50 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 0000000000000009 RSI: ffffffff834ebe7e RDI: 0000000000000048
> RBP: ffff8881cb8e4200 R08: ffffffff88d21878 R09: ffffed103971cb43
> R10: ffff8881cb19fdc8 R11: ffff8881cb8e5a17 R12: 0000000000000000
> R13: ffff8881cb8e5a10 R14: ffff8881cb8e4cc8 R15: ffff8881cb8e5178
> FS: 00007f4f60b6d700(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4f6060c330 CR3: 00000001cc3a8000 CR4: 00000000001406e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> usbvision_radio_close+0x105/0x250
> drivers/media/usb/usbvision/usbvision-video.c:1114
> v4l2_release+0x2e7/0x390 drivers/media/v4l2-core/v4l2-dev.c:455
> __fput+0x2d7/0x840 fs/file_table.c:280
> task_work_run+0x13f/0x1c0 kernel/task_work.c:113
> tracehook_notify_resume include/linux/tracehook.h:188 [inline]
> exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
> prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
> syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
> do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x7f4f6069b2b0
> Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 32 08 00 e8 c0
> 07 02 00 83 3d 45 a3 2b 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff
> ff 73 31 c3 48 83 ec 08 e8 ce 8a 01 00 48 89 04 24
> RSP: 002b:00007ffde2d50ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
> RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f4f6069b2b0
> RDX: 00007f4f60951df0 RSI: 0000000000000001 RDI: 0000000000000003
> RBP: 0000000000000000 R08: 00007f4f60951df0 R09: 000000000000000a
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400884
> R13: 00007ffde2d51040 R14: 0000000000000000 R15: 0000000000000000
> Modules linked in:
> ---[ end trace 62bd2b7512ab49ee ]---
> RIP: 0010:usb_set_interface+0x34/0xa50 drivers/usb/core/message.c:1362
> Code: fc 55 53 48 83 ec 40 89 54 24 18 89 74 24 10 e8 22 1c ef fd 49 8d 7c
> 24 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 fb 08 00 00 49 8b 44 24 48 49 8d 7c 24 18 48 89
> RSP: 0018:ffff8881cb19fd50 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 0000000000000009 RSI: ffffffff834ebe7e RDI: 0000000000000048
> RBP: ffff8881cb8e4200 R08: ffffffff88d21878 R09: ffffed103971cb43
> R10: ffff8881cb19fdc8 R11: ffff8881cb8e5a17 R12: 0000000000000000
> R13: ffff8881cb8e5a10 R14: ffff8881cb8e4cc8 R15: ffff8881cb8e5178
> FS: 00007f4f60b6d700(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4f6060c330 CR3: 00000001cc3a8000 CR4: 00000000001406e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this bug, for details see:
> https://goo.gl/tpsmEJ#testing-patches
Let's retry here:
#syz test: https://github.com/google/kasan.git f0df5c1b
[-- Attachment #2: usbvision.patch --]
[-- Type: text/x-patch, Size: 1357 bytes --]
Index: usb-devel/drivers/media/usb/usbvision/usbvision-video.c
===================================================================
--- usb-devel.orig/drivers/media/usb/usbvision/usbvision-video.c
+++ usb-devel/drivers/media/usb/usbvision/usbvision-video.c
@@ -49,6 +49,7 @@
#include <media/tuner.h>
#include <linux/workqueue.h>
+#include <linux/delay.h>
#include "usbvision.h"
#include "usbvision-cards.h"
@@ -1585,6 +1586,7 @@ static void usbvision_disconnect(struct
wake_up_interruptible(&usbvision->wait_frame);
wake_up_interruptible(&usbvision->wait_stream);
} else {
+ msleep(100);
usbvision_release(usbvision);
}
Index: usb-devel/drivers/media/v4l2-core/v4l2-dev.c
===================================================================
--- usb-devel.orig/drivers/media/v4l2-core/v4l2-dev.c
+++ usb-devel/drivers/media/v4l2-core/v4l2-dev.c
@@ -24,6 +24,7 @@
#include <linux/kmod.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
+#include <linux/delay.h>
#include <media/v4l2-common.h>
#include <media/v4l2-device.h>
@@ -419,9 +420,10 @@ static int v4l2_open(struct inode *inode
video_get(vdev);
mutex_unlock(&videodev_lock);
if (vdev->fops->open) {
- if (video_is_registered(vdev))
+ if (video_is_registered(vdev)) {
+ msleep(200);
ret = vdev->fops->open(filp);
- else
+ } else
ret = -ENODEV;
}
next prev parent reply other threads:[~2019-12-13 20:36 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-16 13:29 general protection fault in usb_set_interface syzbot
2019-09-16 20:51 ` Alan Stern
2019-09-16 21:03 ` syzbot
2019-09-17 15:16 ` Alan Stern
2019-09-17 15:28 ` syzbot
2019-09-17 15:53 ` Alan Stern
2019-09-17 16:06 ` syzbot
2019-09-17 17:36 ` Alan Stern
2019-09-17 18:08 ` Alan Stern
2019-09-17 18:15 ` syzbot
2019-09-17 18:31 ` Alan Stern
2019-09-17 18:43 ` syzbot
2019-09-18 18:57 ` Alan Stern
2019-09-19 15:19 ` Andrey Konovalov
2019-12-13 12:15 ` Andrey Konovalov [this message]
2019-12-13 12:16 ` syzbot
2019-12-13 12:19 ` Andrey Konovalov
2019-12-13 19:51 ` Alan Stern
2019-12-16 14:59 ` Andrey Konovalov
2019-12-16 15:05 ` Alan Stern
2019-12-16 15:24 ` Andrey Konovalov
2019-12-17 13:17 ` Dmitry Vyukov
2019-12-10 20:17 Re: KASAN: use-after-free Read in usbvision_v4l2_open Alan Stern
2019-12-12 16:52 ` general protection fault in usb_set_interface Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAAeHK+zTprgU-kp3cOL2S6Wo1tgqL-1sCkEi3Bb8o0BAG71y-A@mail.gmail.com \
--to=andreyknvl@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kai.heng.feng@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mans@mansr.com \
--cc=oneukum@suse.com \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).