linux-kernel - usb/uwb: GPF in uwbd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAAeHK+yW8zGJ9HudmQxCgfwkWAJ-DhC=HH9Ry=QsEuLsjLQzyA@mail.gmail.com>
Date:   Tue, 12 Sep 2017 19:10:07 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Johan Hovold <johan@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        USB list <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: usb/uwb: GPF in uwbd_start

Hi!

I've got the following crashes while fuzzing the kernel with syzkaller.

On commit 81a84ad3cb5711cec79f4dd53a4ce026b092c432 (Sep 3).

uwbd_start() calls kthread_run() and checks that the return value in
not NULL. But the return value is not NULL in case kthread_run()
fails, it takes the form of ERR_PTR(-EINTR).

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 5237 Comm: syz-executor Not tainted 4.13.0+ #106
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069cc2700 task.stack: ffff8800607e8000
RIP: 0010:uwbd_start+0xcf/0x160 drivers/uwb/uwbd.c:311
RSP: 0018:ffff8800607ee6d0 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8800606baa80 RCX: 0000000000000000
RDX: 000000000000009a RSI: ffffffff812b6153 RDI: 00000000000004d4
RBP: ffff8800607ee6e8 R08: fffffbfff0fe00fd R09: fffffbfff0fe00fd
R10: ffff8800607ee6f8 R11: fffffbfff0fe00fc R12: fffffffffffffffc
R13: ffff8800606baed8 R14: ffff8800606baab0 R15: 1ffff1000c0fdcf0
FS:  00007f84c9aeb700(0000) GS:ffff88006c800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7829776000 CR3: 000000006a9b6000 CR4: 00000000000006f0
Call Trace:
 uwb_rc_add+0x2cd/0x730 drivers/uwb/lc-rc.c:359
 hwarc_probe+0x34e/0x9b0 drivers/uwb/hwa-rc.c:858
 usb_probe_interface+0x351/0x8d0 drivers/usb/core/driver.c:361
 really_probe drivers/base/dd.c:385
 driver_probe_device+0x610/0xa00 drivers/base/dd.c:529
 __device_attach_driver+0x230/0x290 drivers/base/dd.c:625
 bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463
 __device_attach+0x269/0x3c0 drivers/base/dd.c:682
 device_initial_probe+0x1f/0x30 drivers/base/dd.c:729
 bus_probe_device+0x1da/0x280 drivers/base/bus.c:523
 device_add+0xcf9/0x1640 drivers/base/core.c:1703
 usb_set_configuration+0x1064/0x1890 drivers/usb/core/message.c:1932
 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
 really_probe drivers/base/dd.c:385
 driver_probe_device+0x610/0xa00 drivers/base/dd.c:529
 __device_attach_driver+0x230/0x290 drivers/base/dd.c:625
 bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463
 __device_attach+0x269/0x3c0 drivers/base/dd.c:682
 device_initial_probe+0x1f/0x30 drivers/base/dd.c:729
 bus_probe_device+0x1da/0x280 drivers/base/bus.c:523
 device_add+0xcf9/0x1640 drivers/base/core.c:1703
 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
 hub_port_connect drivers/usb/core/hub.c:4890
 hub_port_connect_change drivers/usb/core/hub.c:4996
 port_event drivers/usb/core/hub.c:5102
 hub_event_impl+0x23ec/0x37e0 drivers/usb/core/hub.c:5224
 gfs_hub_events_handle+0x6f6/0x900 drivers/usb/gadget/legacy/inode.c:1291
 dev_ioctl+0x1c0/0x280 drivers/usb/gadget/legacy/inode.c:1319
 vfs_ioctl fs/ioctl.c:45
 do_vfs_ioctl+0x1d2/0x1560 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700
 SyS_ioctl+0x94/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1a/0xa5 arch/x86/entry/entry_64.S:203
RIP: 0033:0x447727
RSP: 002b:00007f84c9aeabd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f84c9aeb700 RCX: 0000000000447727
RDX: 0000000000000064 RSI: 0000000000004242 RDI: 0000000000000005
RBP: 00007ffe7f91eaa0 R08: 0000000000000000 R09: 0000000000000000
R10: 00007f84c9aeb9d0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f84c9aeb9c0 R15: 00007f84c9aeb700
Code: 03 80 3c 02 00 0f 85 96 00 00 00 4c 8b a3 58 04 00 00 48 b8 00
00 00 00 00 fc ff df 49 8d bc 24 d8 04 00 00 48 89 fa 48 c1 ea 03 <0f>
b6 04 02 84 c0 74 04 3c 03 7e 5c 48 8d bb 50 04 00 00 48 b8
RIP: uwbd_start+0xcf/0x160 RSP: ffff8800607ee6d0
---[ end trace 16d16649a2b03b2e ]---