Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751787AbdIUQKj (ORCPT ); Thu, 21 Sep 2017 12:10:39 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:54884 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751738AbdIUQKi (ORCPT ); Thu, 21 Sep 2017 12:10:38 -0400 Date: Thu, 21 Sep 2017 18:10:27 +0200 From: Greg Kroah-Hartman To: Andrey Konovalov Cc: Oliver Neukum , Alan Stern , USB list , linux-scsi@vger.kernel.org, usb-storage@lists.one-eyed-alien.net, LKML , Dmitry Vyukov , Kostya Serebryany , syzkaller Subject: Re: usb/storage/uas: slab-out-of-bounds in uas_probe Message-ID: <20170921161027.GB15554@kroah.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.0 (2017-09-02) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 594 Lines: 19 On Thu, Sep 21, 2017 at 05:39:05PM +0200, Andrey Konovalov wrote: > Hi! > > I've got the following report while fuzzing the kernel with syzkaller. > > On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18). > > The issue occurs when we iterate over interface altsettings, but I > don't see the driver doing anything wrong. I might be missing > something, or this might be an issue in USB core altsettings parsing. Any chance you happen to have the descriptors that you were feeding into the kernel at this crash? That might help in figuring out what "went wrong". thanks, greg k-h