linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
To: Roderick Colenbrander <thunderbird2k@gmail.com>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>,
	Jiri Kosina <jikos@kernel.org>,
	lkml <linux-kernel@vger.kernel.org>,
	"open list:HID CORE LAYER" <linux-input@vger.kernel.org>
Subject: Re: NULL pointer dereference when writing fuzzed data to /dev/uhid
Date: Fri, 4 Jan 2019 20:04:38 +0300	[thread overview]
Message-ID: <CAE5jQCfPCSe3eCRnjt2WzF0-SVYY7yM=KuAYS5_p7Gz0CmQy4w@mail.gmail.com> (raw)
In-Reply-To: <CAEc3jaAf2Cd_1vS8Xo-VoJzJKxWJDNm++=eY+5G2dHa5Jo2gXg@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 3371 bytes --]

> Would you be able to share the sony.bin file?
Sent it in this message.

> Did you inject a particular device?
If you are asking me, then no, I blindly send fuzzed data with a
simple (but quite large and not very meaningful) header. That time it
just turned out to be Sony-like descriptor :)

Best regards
Anatoly

пт, 4 янв. 2019 г. в 19:38, Roderick Colenbrander <thunderbird2k@gmail.com>:
>
> > > For sony.bin:
> > >
> > > root@kvm-xfstests:~# cat /vtmp/sony.bin > /dev/uhid
> > > [   16.891931] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.892432] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.892894] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.893362] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.893844] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.895389] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.898165] sony 0003:054C:1000.0001: ignoring exceeding usage max
> > > [   16.901190] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.903797] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.906401] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.908957] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.911449] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.913936] sony 0003:054C:1000.0001: unknown main item tag 0x1
> > > [   16.916551] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.918454] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.919743] sony 0003:054C:1000.0001: unknown main item tag 0x4
> > > [   16.920834] sony 0003:054C:1000.0001: unknown main item tag 0xe
> > > [   16.921904] sony 0003:054C:1000.0001: unknown main item tag 0xe
> > > [   16.923006] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.924082] sony 0003:054C:1000.0001: unknown main item tag 0x2
> > > [   16.925195] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.926289] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.927400] sony 0003:054C:1000.0001: unknown main item tag 0x0
> > > [   16.928546] BUG: unable to handle kernel NULL pointer dereference
> > > at 0000000000000028
> > > [   16.929951] #PF error: [normal kernel read fault]
> > > [   16.930884] PGD 800000007a52b067 P4D 800000007a52b067 PUD 0
> > > [   16.931836] Oops: 0000 [#1] SMP PTI
> > > [   16.932437] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted
> > > 4.20.0-xfstests-10979-g96d4f267e40 #1
> > > [   16.933752] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> > > BIOS 1.11.1-1ubuntu1 04/01/2014
> > > [   16.935372] Workqueue: events uhid_device_add_worker
> > > [   16.936321] RIP: 0010:hid_validate_values+0x48/0x110
> >
> > In a sense, it's good to have a fault there because this was added to
> > make sure we do not blindly accept any data. The fact that it doesn't
> > fail gracefully is a sign that there is something else.
> > Maybe Roderick could have a look?
> >
> > Cheers,
> > Benjamin
> >
>
> Sure I can have a look. Would you be able to share the sony.bin file?
> Did you inject a particular device? We do a lot of remapping and
> processing in hid-sony at startup. It is probably related to that.
>
> Thanks,
> Roderick

[-- Attachment #2: sony.bin --]
[-- Type: application/octet-stream, Size: 471 bytes --]

  reply	other threads:[~2019-01-04 17:04 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-04 12:32 NULL pointer dereference when writing fuzzed data to /dev/uhid Anatoly Trosinenko
2019-01-04 13:25 ` Benjamin Tissoires
2019-01-04 13:47   ` Anatoly Trosinenko
2019-01-04 16:38   ` Roderick Colenbrander
2019-01-04 17:04     ` Anatoly Trosinenko [this message]
2019-01-04 21:35       ` Roderick Colenbrander
2019-01-13 23:09   ` Pavel Machek
2019-01-14 14:23     ` Anatoly Trosinenko
2019-01-14 14:55       ` Benjamin Tissoires
2019-01-14 15:00         ` Anatoly Trosinenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAE5jQCfPCSe3eCRnjt2WzF0-SVYY7yM=KuAYS5_p7Gz0CmQy4w@mail.gmail.com' \
    --to=anatoly.trosinenko@gmail.com \
    --cc=benjamin.tissoires@redhat.com \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=thunderbird2k@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).