MIME-Version: 1.0
In-Reply-To: <Pine.LNX.4.44L0.1709281259490.1299-100000@iolanthe.rowland.org>
References: <CAAeHK+xZjXzzgps5LTXmRk-Cp9N7PMFcuC1vnoQD9ub+gaRfDA@mail.gmail.com>
 <Pine.LNX.4.44L0.1709281259490.1299-100000@iolanthe.rowland.org>
From: Andrey Konovalov <andreyknvl@google.com>
Date: Fri, 29 Sep 2017 13:43:02 +0200
Message-ID: <CAAeHK+xKufHohBfONEOttqkvNXgDdWZ4rKSPCnRj6kyA+0HYug@mail.gmail.com>
Subject: Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "Gustavo A. R. Silva" <garsilva@embeddedor.com>,
        Felipe Balbi <felipe.balbi@linux.intel.com>,
        Peter Chen <peter.chen@nxp.com>,
        Colin Ian King <colin.king@canonical.com>,
        USB list <linux-usb@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Dmitry Vyukov <dvyukov@google.com>, Kostya Serebryany <kcc@google.com>,
        syzkaller <syzkaller@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2652
Lines: 77

On Thu, Sep 28, 2017 at 7:01 PM, Alan Stern <stern@rowland.harvard.edu> wrote:
> On Thu, 28 Sep 2017, Andrey Konovalov wrote:
>
>> Hi!
>>
>> I've got the following report while fuzzing the kernel with syzkaller.
>>
>> On commit dc972a67cc54585bd83ad811c4e9b6ab3dcd427e (4.14-rc2+).
>>
>> It seems that out pointer ends up being NULL and kernel crashes on
>> access to out->desc.bEndpointAddress.
>>
>> gadgetfs: bound to dummy_udc driver
>> usb 1-1: new full-speed USB device number 2 using dummy_hcd
>> gadgetfs: connected
>> gadgetfs: disconnected
>> gadgetfs: connected
>> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x81 has invalid
>> maxpacket 2040, setting to 64
>> usb 1-1: config 2 interface 0 altsetting 206 has an invalid endpoint
>> with address 0xFF, skipping
>> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x5 has an
>> invalid bInterval 255, changing to 4
>> usb 1-1: config 2 interface 0 has no altsetting 0
>> usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0
>> usb 1-1: New USB device strings: Mfr=0, Product=185, SerialNumber=1
>> usb 1-1: Product: a
>> usb 1-1: SerialNumber: a
>> gadgetfs: configuration #2
>> kasan: CONFIG_KASAN_INLINE enabled
>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>> general protection fault: 0000 [#1] PREEMPT SMP KASAN
>> Modules linked in:
>> CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted
>> 4.14.0-rc2-42664-gaf7d1481b3cb #297
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> Workqueue: usb_hub_wq hub_event
>> task: ffff880064328000 task.stack: ffff880064398000
>> RIP: 0010:get_endpoints drivers/usb/misc/usbtest.c:208
>> RIP: 0010:usbtest_probe+0x114f/0x1ef0 drivers/usb/misc/usbtest.c:2706
>
> This looks like a simple logic error.
>
> Alan Stern

Hi Alan,

This fixes it.

Tested-by: Andrey Konovalov <andreyknvl@google.com>

Thanks!

>
>
>
> Index: usb-4.x/drivers/usb/misc/usbtest.c
> ===================================================================
> --- usb-4.x.orig/drivers/usb/misc/usbtest.c
> +++ usb-4.x/drivers/usb/misc/usbtest.c
> @@ -202,12 +202,13 @@ found:
>                         return tmp;
>         }
>
> -       if (in) {
> +       if (in)
>                 dev->in_pipe = usb_rcvbulkpipe(udev,
>                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
> +       if (out)
>                 dev->out_pipe = usb_sndbulkpipe(udev,
>                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
> -       }
> +
>         if (iso_in) {
>                 dev->iso_in = &iso_in->desc;
>                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
>