linux-kernel - Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAAeHK+xKufHohBfONEOttqkvNXgDdWZ4rKSPCnRj6kyA+0HYug@mail.gmail.com>
Date:   Fri, 29 Sep 2017 13:43:02 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Alan Stern <stern@...land.harvard.edu>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Gustavo A. R. Silva" <garsilva@...eddedor.com>,
        Felipe Balbi <felipe.balbi@...ux.intel.com>,
        Peter Chen <peter.chen@....com>,
        Colin Ian King <colin.king@...onical.com>,
        USB list <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints

On Thu, Sep 28, 2017 at 7:01 PM, Alan Stern <stern@...land.harvard.edu> wrote:
> On Thu, 28 Sep 2017, Andrey Konovalov wrote:
>
>> Hi!
>>
>> I've got the following report while fuzzing the kernel with syzkaller.
>>
>> On commit dc972a67cc54585bd83ad811c4e9b6ab3dcd427e (4.14-rc2+).
>>
>> It seems that out pointer ends up being NULL and kernel crashes on
>> access to out->desc.bEndpointAddress.
>>
>> gadgetfs: bound to dummy_udc driver
>> usb 1-1: new full-speed USB device number 2 using dummy_hcd
>> gadgetfs: connected
>> gadgetfs: disconnected
>> gadgetfs: connected
>> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x81 has invalid
>> maxpacket 2040, setting to 64
>> usb 1-1: config 2 interface 0 altsetting 206 has an invalid endpoint
>> with address 0xFF, skipping
>> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x5 has an
>> invalid bInterval 255, changing to 4
>> usb 1-1: config 2 interface 0 has no altsetting 0
>> usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0
>> usb 1-1: New USB device strings: Mfr=0, Product=185, SerialNumber=1
>> usb 1-1: Product: a
>> usb 1-1: SerialNumber: a
>> gadgetfs: configuration #2
>> kasan: CONFIG_KASAN_INLINE enabled
>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>> general protection fault: 0000 [#1] PREEMPT SMP KASAN
>> Modules linked in:
>> CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted
>> 4.14.0-rc2-42664-gaf7d1481b3cb #297
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> Workqueue: usb_hub_wq hub_event
>> task: ffff880064328000 task.stack: ffff880064398000
>> RIP: 0010:get_endpoints drivers/usb/misc/usbtest.c:208
>> RIP: 0010:usbtest_probe+0x114f/0x1ef0 drivers/usb/misc/usbtest.c:2706
>
> This looks like a simple logic error.
>
> Alan Stern

Hi Alan,

This fixes it.

Tested-by: Andrey Konovalov <andreyknvl@...gle.com>

Thanks!

>
>
>
> Index: usb-4.x/drivers/usb/misc/usbtest.c
> ===================================================================
> --- usb-4.x.orig/drivers/usb/misc/usbtest.c
> +++ usb-4.x/drivers/usb/misc/usbtest.c
> @@ -202,12 +202,13 @@ found:
>                         return tmp;
>         }
>
> -       if (in) {
> +       if (in)
>                 dev->in_pipe = usb_rcvbulkpipe(udev,
>                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
> +       if (out)
>                 dev->out_pipe = usb_sndbulkpipe(udev,
>                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
> -       }
> +
>         if (iso_in) {
>                 dev->iso_in = &iso_in->desc;
>                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
>