Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Oliver Neukum <oneukum@suse.com>
Subject: Re: [syzbot] divide error in genelink_tx_fixup
To:     syzbot <syzbot+a6ec4dd9d38cb9261a77@syzkaller.appspotmail.com>,
        davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org,
        linux-usb@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
References: <000000000000809ecc05cea5165d@google.com>
Message-ID: <370f6719-b2db-20f8-9a3d-0e1927931b06@suse.com>
Date:   Tue, 19 Oct 2021 10:37:13 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.12.0
In-Reply-To: <000000000000809ecc05cea5165d@google.com>
Content-Type: multipart/mixed;
 boundary="------------3BDE35EAA337CDA1DB4980CE"
Content-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VGlmbVQyQTQxaUluY3JYYXNWeW9UUVMzb01QU21EdlZiR21lZEN2d2hwQWxY?=
 =?utf-8?B?VHpYMG1RTkFTb0grVmdDWjNrSTZzbTJoVUE4VHJDY1gwSFhjU210YUpmR3lS?=
 =?utf-8?B?VWpZblNCRXcwaEpmSkVnOFRTUDJxbVFHVVZKb2JmbTJwdE9saW4xeTBocFJW?=
 =?utf-8?B?bVZ2UlEyOHBnUCtyMmNGSGhNOEM0WHdub1RQMnBsS1pwaG9YQXdzb0huSEps?=
 =?utf-8?B?Nmc4RVhUZ1VWL3JvNjB5RzdZKzQ5SHVWZDlmbCsxMHBvQmM0Tk04V0lnSDZD?=
 =?utf-8?B?Q3BYemVzMndxd1JOSVNxdld1WTdGUEJENDZyZTkyNmZSWXdqYmszRVlrVFhK?=
 =?utf-8?B?SkZqWUM4OE5hTVNSdmYyWGErRWZiejBpMUpZZE9nQTUyWktKRUo2WEUrdWxS?=
 =?utf-8?B?UXJJODBJaFFKbE9vVFJDSDBnam5hcU1mTFhoVWVZM3VkdzI3cTg0VDVMT2VV?=
 =?utf-8?B?ZjhYaXlvODJXMStPV0l5cU96SkJOeHFySnlmcjdlSEY3WGdTZDE2YUpncVNL?=
 =?utf-8?B?MHcwZWIyTjdWWFlTN1lnV05uaFZvRC9OekVJUWlycy9CR0hUK1BDRTNZMlBI?=
 =?utf-8?B?ZVVIdGlBLzBtdThmNG1HTGRBWFArdVR0VFUzZkhtbndqZFFMZnpaMWhFQlM5?=
 =?utf-8?B?V0RXM2dRSlFvUlI5Q1ZCc3BDb3N0eXBrWFk2aUJ4OVczNWtjWUNQZEtkYXF4?=
 =?utf-8?B?eHZKS2krYUNMT1RYOW5QVFM2SndVMWxDbHFFaTgxUVBuVnpWMlB4bEJKK2Va?=
 =?utf-8?B?bXVjQWd3cURsUXYyNzE3bGs5L0RGb2NtS1p6V2xCMXhWNVZqeTlNTXpsU2hm?=
 =?utf-8?B?aVVMNW9maFFINjBISVFVdDdJRCt6VjE4WFJDNFVXNlk0QTR1VkJhdnhEOE9Q?=
 =?utf-8?B?Q3hTTDFyU3FpWVF0aEJwZVREYlk2eTRQR2tIRjB4eU82Q0c2T2F3Rms4MFVW?=
 =?utf-8?B?U0t6M3BtZGhrZS9SUWNRcDZ3QWlXT0duaDB4RmZQUGpyQU1jSTR3VDRKazNG?=
 =?utf-8?B?cnl2bmFYYVBmMXF5YkZQMWYzRDgzRzJQNEtPK2FWWTJOeURlY2xwMkt5U0h0?=
 =?utf-8?B?c0hBRVRwa0FOcWE0a0NqRzVJUG0rUS8zajVFVDBPaWhwb05yNjVSc1A4SFpp?=
 =?utf-8?B?OVd6MFRYVktwNE16U0RoTXBHeDVkVXVkdFp6aEtXdGxKcFNFd3MvcDE0aTcr?=
 =?utf-8?B?dDB4Qk1nOUhkNlFvQXZKN25SdGsvY0pUaUtYMGRVaU5RR0tFeHpjcTNiU3BV?=
 =?utf-8?B?MHR4ckM2ekJiRWxxM205YlVDc3FWZmlGYTN5TzE3cHJ3RzhqUEVBaTJ3K0ND?=
 =?utf-8?B?Q0xHQjFOY2NyY0h6bnhBdWQ4WjNTdER3ZlhxUml2MFJiam9uZWFvc0VCa0li?=
 =?utf-8?B?V2FPaVl1N0srQlh4U2pUVmJMcXFTOCtYRFJ0TTVaaUZHL3hJb0F1bXBVSk5u?=
 =?utf-8?B?Ty9PM0pkWkJaRDNhejNXRkxxTjJ2Rk5RZmo1cVpyeVd4djczeEJaYkN5WjJs?=
 =?utf-8?B?VE94Y0FWUGlkdExXb3UyZTFZclYxSVVLcktWLzZqalZ5aGVQVzliSmx6NUhR?=
 =?utf-8?B?RzlqV2ZxTzE2UEd3bFZ3V1h3WFlSSU5ZdU9nWVVYdVdlbk1FazJmUHFYY0Vh?=
 =?utf-8?B?NGdsTGhsdDlmdVpNc3hUYjAwRERTc1l0VG1jK09LbExwVlRSWStscnVlSVpF?=
 =?utf-8?B?VEdzY0FMNDVkbzE3V0ZxRUVMdXlDeGFVZ2hWSkhYeEhUNkZYQVRQRjYxTWlx?=
 =?utf-8?B?cjE5RHNtMjR0b2NyMTNDWVNudGdJekJLZTIzUHFnc2ZPOEZSVVRzNFlVczNQ?=
 =?utf-8?B?ZEovcVhHbXFVK0NrWVRxS2RGc2puM2J5Nk5TeHBqL0c5cjBVMWd0Q2VPTUNU?=
 =?utf-8?Q?bDu3Z+W/IqdDF?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6dd3adfa-3070-4a5f-1b77-08d992dba79e
X-MS-Exchange-CrossTenant-AuthSource: DB7PR04MB5050.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 08:37:15.8684
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: FnqVl9TkjroFCCW946TVXBftk1rwqMW8O4KIrKJGJW95BZjU7mGzB0s25v5ogzli2ZU7ttSPUGwXvXMVkoxLBw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0401MB2647
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--------------3BDE35EAA337CDA1DB4980CE
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit


On 18.10.21 20:55, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    660a92a59b9e usb: xhci: Enable runtime-pm by default on AM..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1506ccf0b00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5016916cdc0a4a84
> dashboard link: https://syzkaller.appspot.com/bug?extid=a6ec4dd9d38cb9261a77
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11308734b00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f56f68b00000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a6ec4dd9d38cb9261a77@syzkaller.appspotmail.com

#syz test  
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git c03fb16bafdf


--------------3BDE35EAA337CDA1DB4980CE
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-usbnet-sanity-check-for-maxpacket.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="0001-usbnet-sanity-check-for-maxpacket.patch"

From a5270791d4480e9a6bc009c69a4454039aa160e7 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 19 Oct 2021 10:02:42 +0200
Subject: [PATCH] usbnet: sanity check for maxpacket

We cannot leave maxpacket at 0 because we divide by it.
Devices that give us a 0 there are unlikely to work, but let's
assume a 1, so we don't oops and a least try to operate.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com
---
 drivers/net/usb/usbnet.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 840c1c2ab16a..2bdc3e0c1579 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1788,6 +1788,9 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 	if (!dev->rx_urb_size)
 		dev->rx_urb_size = dev->hard_mtu;
 	dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
+	if (dev->maxpacket == 0)
+		/* that is a strange device */
+		dev->maxpacket = 1;
 
 	/* let userspace know we have a random address */
 	if (ether_addr_equal(net->dev_addr, node_id))
-- 
2.26.2


--------------3BDE35EAA337CDA1DB4980CE--