linux-hardening - Re: [PATCH] usb: musb: Check requset->buf before use to avoid crash issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 28 Oct 2023 23:30:28 +0800
From: kernel test robot <lkp@...el.com>
To: Xingxing Luo <xingxing.luo@...soc.com>, b-liu@...com,
	gregkh@...uxfoundation.org, keescook@...omium.org,
	nathan@...nel.org, ndesaulniers@...gle.com, trix@...hat.com
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org, xingxing0070.luo@...il.com,
	Zhiyong.Liu@...soc.com, Cixi.Geng1@...soc.com,
	Orson.Zhai@...soc.com, zhang.lyra@...il.com
Subject: Re: [PATCH] usb: musb: Check requset->buf before use to avoid crash
 issue

Hi Xingxing,

kernel test robot noticed the following build errors:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v6.6-rc7 next-20231027]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Xingxing-Luo/usb-musb-Check-requset-buf-before-use-to-avoid-crash-issue/20231023-173938
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20231023093153.6748-1-xingxing.luo%40unisoc.com
patch subject: [PATCH] usb: musb: Check requset->buf before use to avoid crash issue
config: arm-davinci_all_defconfig (https://download.01.org/0day-ci/archive/20231028/202310282331.d4wx1Z6b-lkp@intel.com/config)
compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project.git 4a5ac14ee968ff0ad5d2cc1ffa0299048db4c88a)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231028/202310282331.d4wx1Z6b-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202310282331.d4wx1Z6b-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/usb/musb/musb_gadget_ep0.c:534:7: error: use of undeclared identifier 'requset'; did you mean 'request'?
     534 |         if (!requset->buf) {
         |              ^~~~~~~
         |              request
   drivers/usb/musb/musb_gadget_ep0.c:521:22: note: 'request' declared here
     521 |         struct usb_request      *request;
         |                                  ^
   1 error generated.

Kconfig warnings: (for reference only)
   WARNING: unmet direct dependencies detected for PINCTRL_SINGLE
   Depends on [n]: PINCTRL [=n] && OF [=y] && HAS_IOMEM [=y]
   Selected by [y]:
   - ARCH_DAVINCI [=y] && ARCH_MULTI_V5 [=y] && CPU_LITTLE_ENDIAN [=y]


vim +534 drivers/usb/musb/musb_gadget_ep0.c

   510	
   511	/*
   512	 * transmitting to the host (IN), this code might be called from IRQ
   513	 * and from kernel thread.
   514	 *
   515	 * Context:  caller holds controller lock
   516	 */
   517	static void ep0_txstate(struct musb *musb)
   518	{
   519		void __iomem		*regs = musb->control_ep->regs;
   520		struct musb_request	*req = next_ep0_request(musb);
   521		struct usb_request	*request;
   522		u16			csr = MUSB_CSR0_TXPKTRDY;
   523		u8			*fifo_src;
   524		u8			fifo_count;
   525	
   526		if (!req) {
   527			/* WARN_ON(1); */
   528			musb_dbg(musb, "odd; csr0 %04x", musb_readw(regs, MUSB_CSR0));
   529			return;
   530		}
   531	
   532		request = &req->request;
   533	
 > 534		if (!requset->buf) {
   535			musb_dbg(musb, "request->buf is NULL");
   536			return;
   537		}
   538	
   539		/* load the data */
   540		fifo_src = (u8 *) request->buf + request->actual;
   541		fifo_count = min((unsigned) MUSB_EP0_FIFOSIZE,
   542			request->length - request->actual);
   543		musb_write_fifo(&musb->endpoints[0], fifo_count, fifo_src);
   544		request->actual += fifo_count;
   545	
   546		/* update the flags */
   547		if (fifo_count < MUSB_MAX_END0_PACKET
   548				|| (request->actual == request->length
   549					&& !request->zero)) {
   550			musb->ep0_state = MUSB_EP0_STAGE_STATUSOUT;
   551			csr |= MUSB_CSR0_P_DATAEND;
   552		} else
   553			request = NULL;
   554	
   555		/* report completions as soon as the fifo's loaded; there's no
   556		 * win in waiting till this last packet gets acked.  (other than
   557		 * very precise fault reporting, needed by USB TMC; possible with
   558		 * this hardware, but not usable from portable gadget drivers.)
   559		 */
   560		if (request) {
   561			musb->ackpend = csr;
   562			musb_g_ep0_giveback(musb, request);
   563			if (!musb->ackpend)
   564				return;
   565			musb->ackpend = 0;
   566		}
   567	
   568		/* send it out, triggering a "txpktrdy cleared" irq */
   569		musb_ep_select(musb->mregs, 0);
   570		musb_writew(regs, MUSB_CSR0, csr);
   571	}
   572	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki