Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Oliver Neukum <oneukum@suse.com>
Subject: Re: [syzbot] divide error in genelink_tx_fixup
To:     syzbot <syzbot+a6ec4dd9d38cb9261a77@syzkaller.appspotmail.com>,
        davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org,
        linux-usb@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
References: <000000000000809ecc05cea5165d@google.com>
Message-ID: <28d9989c-4a80-daf7-d0e0-ae8e56b6e4d9@suse.com>
Date:   Tue, 19 Oct 2021 12:02:51 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.12.0
In-Reply-To: <000000000000809ecc05cea5165d@google.com>
Content-Type: multipart/mixed;
 boundary="------------39FC8B90E38B602D5E2C221F"
Content-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?MzMzQWh3T1V1M2RWM285QjBWSXhUcW5GMGhhRVhlUFBWdnJWWDFJSDAxYWFq?=
 =?utf-8?B?b0xkOExJUEF4OTBtNm9tZVNPNnpJdVFtTW9DdndjWmczQTF3citPSGtVajM1?=
 =?utf-8?B?RlpSTHR3dnM0TDZVQytuaEE4YWd0d1Z5eDhhZjF0a282MGJiSFpBbFVYUmZh?=
 =?utf-8?B?bGFsdTVRQ3YwOWNML3BOajZQWU56YncvV0plb3NmWVVaZ1RpSk4wZTJnc2Jm?=
 =?utf-8?B?Ui9XQ3VOaWhNcUpzNEFhYVhSR0JXYW1HalBwNDRlaWhnQjl4Y0xoV3VVWk03?=
 =?utf-8?B?dmV5ejZQSXZQVzVLMTZLcWQvRTRDNjZ0bTAxMGRIZVJQQnMwTG8rT2VEUDVy?=
 =?utf-8?B?ODF2RGZWNHBtRmsyK3p2a0lLaEtMUk52ZmtzNnRiaitlTktRVGhWd21Ga0xk?=
 =?utf-8?B?MCtkbU5HaUFicURvMmxVVFRIRytTY3RZM1NpaWtuMFFSNDA0LzV0ZnYzbkwv?=
 =?utf-8?B?OC9YTzRpMHdSSVY3MFl1bG9YQVRKbm1YSFYvVWRPaEhDbjk4dXNRQTZIeHV2?=
 =?utf-8?B?dlVjL1FGVi9WbW9HeXpRUlNzUXlrbnZ4RnJZNW9MMDIxZkdKVjJxWFFCTlg0?=
 =?utf-8?B?ZitSN2Erd21VbWJ1R2I0SjhtWnlxL2ZPUjJUdnFhVm5ZZnJFRjhmQ29VeEI0?=
 =?utf-8?B?a29WczJLV3lSdGdmaUJPOFY0eTVpYXZTeFpiUm1kOUs5aUlNaXN2SllLcVVz?=
 =?utf-8?B?M1RxTHRvQWhTQmpmK3Z4R0sxV0RGUHRTTk5yOHYrS0J3Z0R1cUlwRkp1eWt5?=
 =?utf-8?B?Y0k2dWcvQTBzak14NTllR0ZFWm8vWmpOSDEyU1VxM1k5cnZ5RFJqQUFZRTF0?=
 =?utf-8?B?b0RxQ2lqcFN6bEN6YlhIS3ZQWFlCRkxjL2l4N1BjcW5QN0gzcnZEM0JPaE1v?=
 =?utf-8?B?MUdyeGZSTk9helF4bEFJVXV2c1NwbmZyYTVJQjk4SmNPZjVtdURDekNLdDdy?=
 =?utf-8?B?UTdFUDBaaldoeGR1OTZIWndLRmxVVk5mclZqSklQckNHTk9OWkJQQVdCVkR1?=
 =?utf-8?B?em5KVDdIdGVPMkZSQ0NyZnpESFpjNFlKbXlqcVZ0WHVVa2JoV2lCT3REa1My?=
 =?utf-8?B?OE5wcDkxdmVqK3BRNVVJczBFMUFzVnhnWlhQRUZRRTB3ZFA0Q2FKNVY1ZVpt?=
 =?utf-8?B?NVg4Nk01WEJGdDhKYVorQ00vUnBSd3RxRmxJSDBHSVdjS21MRjZLQm9KbVZ5?=
 =?utf-8?B?K1FEWTY1ZVFaTGg0OFJVTlN1a2c5SnNCTjlBbHRCcHA0djVKV3Q3VnlLeTh3?=
 =?utf-8?B?ZGptYzY2VmRGc0VFaUtTcThCb1ZUTENLeVhGajJQWWhqcHZuWkNjemtMZ1lV?=
 =?utf-8?B?bndmRVcxYWtpQkZOZnNBbkRQUkFjUkdVU3FIRzZoLytlaXdyTS92Nk5TYndI?=
 =?utf-8?B?TWhVaE9KNTk0bVBPQ0FaWTRKRkRWT0xrckl4Vmw5Tm1nWExpcnl4cHhtRWpK?=
 =?utf-8?B?eCtYTHdFQzJadTkwTmVwN25GWlJBeWk4Ly9NZWM0NU5FSTBXZTNJMEM5RnF4?=
 =?utf-8?B?cG1SSXF3c0RnaTBwR1lYZXZJeTZqbGw5cGdxUkw4Tm0wc2ZuT3JjbE1uNUgz?=
 =?utf-8?B?MzcyT2ZNMzBHQXljUHNwN2xHR04rS2FDL28reVpVSXh1c2dTUjNlK3AvZGRw?=
 =?utf-8?B?STFqNVlzMEtWazRQenRzdDVQclVVVWhMOVkvQ3QvOVk3TEQ0K1VINU54bTRH?=
 =?utf-8?B?R3MzZFN4U25ZNVNWMyt5SDdkZXRVVDR1TENFdmNkN0twMUhIUWRTMURuWjJY?=
 =?utf-8?B?MkpOOHZYTTRLajl4NUc3MTdpbnZMK0laSXM2dWpTN1lPNnlPd040S0V0dnpR?=
 =?utf-8?B?TWxoYTdLUHJEQWpCeFhxU1hmZVh3bElCdXFSMWRRMG5XeFVuNDFDREh2dVpE?=
 =?utf-8?Q?LSAyQcIHCuCPz?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: eb9d0a46-1fb7-4b3c-4cdc-08d992e79e3c
X-MS-Exchange-CrossTenant-AuthSource: DB7PR04MB5050.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 10:02:54.1267
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: nR7TB+4XfTIkD+1yo3Uz4pVPvsY70ZC6ghiDjWvkeqaT0p0BilGr2BHwgTK0P9xf4l/UDJqu5P5qqM04Hrg4AA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR04MB6764
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--------------39FC8B90E38B602D5E2C221F
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


On 18.10.21 20:55, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    660a92a59b9e usb: xhci: Enable runtime-pm by default on AM..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1506ccf0b00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5016916cdc0a4a84
> dashboard link: https://syzkaller.appspot.com/bug?extid=a6ec4dd9d38cb9261a77
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11308734b00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f56f68b00000
>

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
c03fb16bafdf


--------------39FC8B90E38B602D5E2C221F
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-usbnet-sanity-check-for-maxpacket.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="0001-usbnet-sanity-check-for-maxpacket.patch"

From 1bf4920e0c85fd0fd49f95e2b41e104c77a95de7 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 19 Oct 2021 10:02:42 +0200
Subject: [PATCH] usbnet: sanity check for maxpacket

maxpacket of 0 makes no sense and oopdses as we need to divide
by it. Give up.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com
---
 drivers/net/usb/usbnet.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 840c1c2ab16a..396f5e677bf0 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1788,6 +1788,9 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 	if (!dev->rx_urb_size)
 		dev->rx_urb_size = dev->hard_mtu;
 	dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
+	if (dev->maxpacket == 0)
+		/* that is a broken device */
+		goto out4;
 
 	/* let userspace know we have a random address */
 	if (ether_addr_equal(net->dev_addr, node_id))
-- 
2.26.2


--------------39FC8B90E38B602D5E2C221F--