From: Takashi Iwai <tiwai@suse.de>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: syzbot <syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com>,
alsa-devel@alsa-project.org, andreyknvl@google.com,
benquike@gmail.com, g@b4.vu, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
perex@perex.cz, syzkaller-bugs@googlegroups.com, tiwai@suse.com,
wang6495@umn.edu
Subject: Re: general protection fault in snd_usb_create_mixer
Date: Fri, 22 Nov 2019 12:28:05 +0100 [thread overview]
Message-ID: <s5h4kyw5ewq.wl-tiwai@suse.de> (raw)
In-Reply-To: <20191121204956.GE617@kadam>
On Thu, 21 Nov 2019 21:49:56 +0100,
Dan Carpenter wrote:
>
> On Thu, Nov 21, 2019 at 07:25:09AM -0800, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 46178223 usb: gadget: add raw-gadget interface
> > git tree: https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=176f9836e00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=99c88c44660624e7
> > dashboard link: https://syzkaller.appspot.com/bug?extid=a36ab65c6653d7ccdd62
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1447d3bae00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ef3a86e00000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com
> >
> > usb 1-1: 208:241 : does not exist
> > usb 1-1: 208:242 : does not exist
> > usb 1-1: 208:243 : does not exist
> > usb 1-1: 208:244 : does not exist
> > usb 1-1: 208:245 : does not exist
> > usb 1-1: 208:246 : does not exist
> > usb 1-1: 208:247 : does not exist
> > usb 1-1: 208:248 : does not exist
> > usb 1-1: 208:249 : does not exist
> > usb 1-1: 208:250 : does not exist
>
> These error messages are because:
>
> sound/usb/card.c
> 128 static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int interface)
> 129 {
> 130 struct usb_device *dev = chip->dev;
> 131 struct usb_host_interface *alts;
> 132 struct usb_interface_descriptor *altsd;
> 133 struct usb_interface *iface = usb_ifnum_to_if(dev, interface);
> 134
> 135 if (!iface) {
> 136 dev_err(&dev->dev, "%u:%d : does not exist\n",
> 137 ctrlif, interface);
> 138 return -EINVAL;
> 139 }
>
> "iface" is NULL. The caller ignores the -EINVAL (correctly I think).
>
> Then the NULL dereference happens in snd_usb_mixer_controls_badd()
>
> sound/usb/mixer.c
> 2903 static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
> 2904 int ctrlif)
> 2905 {
> 2906 struct usb_device *dev = mixer->chip->dev;
> 2907 struct usb_interface_assoc_descriptor *assoc;
> 2908 int badd_profile = mixer->chip->badd_profile;
> 2909 struct uac3_badd_profile *f;
> 2910 const struct usbmix_ctl_map *map;
> 2911 int p_chmask = 0, c_chmask = 0, st_chmask = 0;
> 2912 int i;
> 2913
> 2914 assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc;
> 2915
> 2916 /* Detect BADD capture/playback channels from AS EP descriptors */
> 2917 for (i = 0; i < assoc->bInterfaceCount; i++) {
> 2918 int intf = assoc->bFirstInterface + i;
> 2919
> 2920 struct usb_interface *iface;
> 2921 struct usb_host_interface *alts;
> 2922 struct usb_interface_descriptor *altsd;
> 2923 unsigned int maxpacksize;
> 2924 char dir_in;
> 2925 int chmask, num;
> 2926
> 2927 if (intf == ctrlif)
> 2928 continue;
> 2929
> 2930 iface = usb_ifnum_to_if(dev, intf);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> iface is not checked.
>
> Should it be "if (!iface) continue;?"
Right, that should fix the problem. Although the interface number
referred in snd_usb_mixer_controls_badd() can be different from the
one checked in snd_usb_create_stream(), the culprit is the missing
NULL check there.
thanks,
Takashi
prev parent reply other threads:[~2019-11-22 11:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-21 15:25 general protection fault in snd_usb_create_mixer syzbot
2019-11-21 20:49 ` Dan Carpenter
2019-11-22 11:28 ` Takashi Iwai [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s5h4kyw5ewq.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=alsa-devel@alsa-project.org \
--cc=andreyknvl@google.com \
--cc=benquike@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=g@b4.vu \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=perex@perex.cz \
--cc=syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tiwai@suse.com \
--cc=wang6495@umn.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).