Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <000000000000301a4d05bfe14b8f@google.com>
In-Reply-To: <000000000000301a4d05bfe14b8f@google.com>
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Wed, 14 Apr 2021 07:45:15 +0200
Message-ID: <CACT4Y+ZT2m7t+o9=VYCE32U_1aUVJXRp_5KgJSdEZC1YXy=qgA@mail.gmail.com>
Subject: Re: [syzbot] unexpected kernel reboot (4)
To:     syzbot <syzbot+9ce030d4c89856b27619@syzkaller.appspotmail.com>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
        Andrey Konovalov <andreyknvl@gmail.com>,
        "open list:HID CORE LAYER" <linux-input@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Tue, Apr 13, 2021 at 11:27 PM syzbot
<syzbot+9ce030d4c89856b27619@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    89698bec Merge tag 'm68knommu-for-v5.12-rc7' of git://git=
...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=3D1243fcfed0000=
0
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3Db234ddbbe2953=
747
> dashboard link: https://syzkaller.appspot.com/bug?extid=3D9ce030d4c89856b=
27619
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D173e92fed00=
000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D1735da2ed0000=
0
>
> IMPORTANT: if you fix the issue, please add the following tag to the comm=
it:
> Reported-by: syzbot+9ce030d4c89856b27619@syzkaller.appspotmail.com
>
> output_len: 0x000000000e74eb68
> kernel_total_size: 0x000000000f226000
> needed_size: 0x000000000f400000
> trampoline_32bit: 0x000000000009d000
> Decompressing Linux... Parsing ELF... done.
> Booting the kernel.

+linux-input

The reproducer connects some USB HID device and communicates with the drive=
r.
Previously we observed reboots because HID devices can trigger reboot
SYSRQ, but we disable it with "CONFIG_MAGIC_SYSRQ is not set".
How else can a USB device reboot the machine? Is it possible to disable it?
I don't see any direct includes of <linux/reboot.h> in drivers/usb/*

r0 =3D syz_usb_connect$hid(0x0, 0x36,
&(0x7f0000000000)=3DANY=3D[@ANYBLOB=3D"1201000000000e40260933334100001b0001=
0902240001000000000904000001030100000921100000012201000905810308"],
0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000001440)=3D{0x24, 0x0, 0x0,
&(0x7f0000000040)=3D{0x0, 0x22, 0x1, {[@local]}}, 0x0}, 0x0)
syz_usb_ep_write(r0, 0x0, 0xfd,
&(0x7f0000000b80)=3D"34981a23c3490d163907e65ff758478e74cd7dc073700ebf655f1c=
e3394018ade882075917a36a30ad3594f98282ea729f3620534fd655c69ebec66aa7397e843=
ee79879e825e6a31a189616c611912dee259ab9d8ff1566c90ae8985ec380bcab6b8265695f=
7b76654377adab6b1930de1f44060000000000000021f50f1dd3fff126f862f378ef2deb2d4=
331b9bcb3f394062133b4bb44a7f168473f7ca3d9945bfb4c456b22428a7a11d5d7df1fcc4f=
7ffad0e526d34321fb6aedfb5dd4fc6797cba2cf45369daea9f0953bf1a8343aa7548f3f981=
7c6a1bedde9dcaa4b8eed4a493828384fc9ccb7d230967ea0cb2003076ac7d9f386a5fbaec3=
92")


> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches