Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752193AbdI1RBa (ORCPT <rfc822;w@1wt.eu>);
        Thu, 28 Sep 2017 13:01:30 -0400
Received: from iolanthe.rowland.org ([192.131.102.54]:55946 "HELO
        iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with SMTP id S1752058AbdI1RB1 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 28 Sep 2017 13:01:27 -0400
Date: Thu, 28 Sep 2017 13:01:26 -0400 (EDT)
From: Alan Stern <stern@rowland.harvard.edu>
X-X-Sender: stern@iolanthe.rowland.org
To: Andrey Konovalov <andreyknvl@google.com>
cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "Gustavo A. R. Silva" <garsilva@embeddedor.com>,
        Felipe Balbi <felipe.balbi@linux.intel.com>,
        Peter Chen <peter.chen@nxp.com>,
        Colin Ian King <colin.king@canonical.com>,
        USB list <linux-usb@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Dmitry Vyukov <dvyukov@google.com>, Kostya Serebryany <kcc@google.com>,
        syzkaller <syzkaller@googlegroups.com>
Subject: Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints
In-Reply-To: <CAAeHK+xZjXzzgps5LTXmRk-Cp9N7PMFcuC1vnoQD9ub+gaRfDA@mail.gmail.com>
Message-ID: <Pine.LNX.4.44L0.1709281259490.1299-100000@iolanthe.rowland.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2251
Lines: 66

On Thu, 28 Sep 2017, Andrey Konovalov wrote:

> Hi!
> 
> I've got the following report while fuzzing the kernel with syzkaller.
> 
> On commit dc972a67cc54585bd83ad811c4e9b6ab3dcd427e (4.14-rc2+).
> 
> It seems that out pointer ends up being NULL and kernel crashes on
> access to out->desc.bEndpointAddress.
> 
> gadgetfs: bound to dummy_udc driver
> usb 1-1: new full-speed USB device number 2 using dummy_hcd
> gadgetfs: connected
> gadgetfs: disconnected
> gadgetfs: connected
> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x81 has invalid
> maxpacket 2040, setting to 64
> usb 1-1: config 2 interface 0 altsetting 206 has an invalid endpoint
> with address 0xFF, skipping
> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x5 has an
> invalid bInterval 255, changing to 4
> usb 1-1: config 2 interface 0 has no altsetting 0
> usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0
> usb 1-1: New USB device strings: Mfr=0, Product=185, SerialNumber=1
> usb 1-1: Product: a
> usb 1-1: SerialNumber: a
> gadgetfs: configuration #2
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> Modules linked in:
> CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted
> 4.14.0-rc2-42664-gaf7d1481b3cb #297
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: usb_hub_wq hub_event
> task: ffff880064328000 task.stack: ffff880064398000
> RIP: 0010:get_endpoints drivers/usb/misc/usbtest.c:208
> RIP: 0010:usbtest_probe+0x114f/0x1ef0 drivers/usb/misc/usbtest.c:2706

This looks like a simple logic error.

Alan Stern



Index: usb-4.x/drivers/usb/misc/usbtest.c
===================================================================
--- usb-4.x.orig/drivers/usb/misc/usbtest.c
+++ usb-4.x/drivers/usb/misc/usbtest.c
@@ -202,12 +202,13 @@ found:
 			return tmp;
 	}
 
-	if (in) {
+	if (in)
 		dev->in_pipe = usb_rcvbulkpipe(udev,
 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+	if (out)
 		dev->out_pipe = usb_sndbulkpipe(udev,
 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-	}
+
 	if (iso_in) {
 		dev->iso_in = &iso_in->desc;
 		dev->in_iso_pipe = usb_rcvisocpipe(udev,