From: Alan Stern <stern@rowland.harvard.edu>
To: syzbot <syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com>
Cc: andreyknvl@google.com, <gregkh@linuxfoundation.org>,
<kai.heng.feng@canonical.com>, <linux-kernel@vger.kernel.org>,
<linux-usb@vger.kernel.org>, <mans@mansr.com>, <oneukum@suse.com>,
<syzkaller-bugs@googlegroups.com>
Subject: Re: general protection fault in usb_set_interface
Date: Tue, 17 Sep 2019 11:16:32 -0400 (EDT) [thread overview]
Message-ID: <Pine.LNX.4.44L0.1909171115310.1590-100000@iolanthe.rowland.org> (raw)
In-Reply-To: <000000000000dcade20592b1edc7@google.com>
On Mon, 16 Sep 2019, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer still triggered
> crash:
> general protection fault in vidioc_querycap
Same problem in a different part of the code.
Alan Stern
#syz test: https://github.com/google/kasan.git f0df5c1b
drivers/media/usb/usbvision/usbvision-video.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
Index: usb-devel/drivers/media/usb/usbvision/usbvision-video.c
===================================================================
--- usb-devel.orig/drivers/media/usb/usbvision/usbvision-video.c
+++ usb-devel/drivers/media/usb/usbvision/usbvision-video.c
@@ -453,6 +453,12 @@ static int vidioc_querycap(struct file *
{
struct usb_usbvision *usbvision = video_drvdata(file);
+ mutex_lock(&usbvision->v4l2_lock);
+ if (!usbvision->dev) {
+ mutex_unlock(&usbvision->v4l2_lock);
+ return -ENODEV;
+ }
+
strscpy(vc->driver, "USBVision", sizeof(vc->driver));
strscpy(vc->card,
usbvision_device_data[usbvision->dev_model].model_string,
@@ -464,6 +470,7 @@ static int vidioc_querycap(struct file *
vc->capabilities |= V4L2_CAP_RADIO;
if (usbvision->have_tuner)
vc->capabilities |= V4L2_CAP_TUNER;
+ mutex_unlock(&usbvision->v4l2_lock);
return 0;
}
@@ -1111,7 +1118,8 @@ static int usbvision_radio_close(struct
mutex_lock(&usbvision->v4l2_lock);
/* Set packet size to 0 */
usbvision->iface_alt = 0;
- usb_set_interface(usbvision->dev, usbvision->iface,
+ if (usbvision->dev)
+ usb_set_interface(usbvision->dev, usbvision->iface,
usbvision->iface_alt);
usbvision_audio_off(usbvision);
next prev parent reply other threads:[~2019-09-17 15:16 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-16 13:29 general protection fault in usb_set_interface syzbot
2019-09-16 20:51 ` Alan Stern
2019-09-16 21:03 ` syzbot
2019-09-17 15:16 ` Alan Stern [this message]
2019-09-17 15:28 ` syzbot
2019-09-17 15:53 ` Alan Stern
2019-09-17 16:06 ` syzbot
2019-09-17 17:36 ` Alan Stern
2019-09-17 18:08 ` Alan Stern
2019-09-17 18:15 ` syzbot
2019-09-17 18:31 ` Alan Stern
2019-09-17 18:43 ` syzbot
2019-09-18 18:57 ` Alan Stern
2019-09-19 15:19 ` Andrey Konovalov
2019-12-13 12:15 ` Andrey Konovalov
2019-12-13 12:16 ` syzbot
2019-12-13 12:19 ` Andrey Konovalov
2019-12-13 19:51 ` Alan Stern
2019-12-16 14:59 ` Andrey Konovalov
2019-12-16 15:05 ` Alan Stern
2019-12-16 15:24 ` Andrey Konovalov
2019-12-17 13:17 ` Dmitry Vyukov
2019-12-10 20:17 Re: KASAN: use-after-free Read in usbvision_v4l2_open Alan Stern
2019-12-12 16:52 ` general protection fault in usb_set_interface Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.1909171115310.1590-100000@iolanthe.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=andreyknvl@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kai.heng.feng@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mans@mansr.com \
--cc=oneukum@suse.com \
--cc=syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).