linux-kernel - usb/net/asix: kernel hang in asix_phy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 24 Oct 2017 16:59:34 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     "David S. Miller" <davem@...emloft.net>, allan <allan@...x.com.tw>,
        Peter Chen <peter.chen@....com>,
        Greg Ungerer <gerg@...ux-m68k.org>,
        Colin Ian King <colin.king@...onical.com>,
        Philippe Reynes <tremyfr@...il.com>,
        Dean Jenkins <Dean_Jenkins@...tor.com>,
        USB list <linux-usb@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: usb/net/asix: kernel hang in asix_phy_reset

Hi!

While fuzzing the kernel with syzkaller I've been getting kernel hangs
within the asix driver.

On commit 6cff0a118f23b98c604a3604ea9de11338e24fbe (4.14-rc6+).

As far as I can tell the issue is that asix_phy_reset() doesn't
enforce proper timeout.

asix_phy_reset() calls asix_mdio_read() in a loop 5000 times with 100
us delay, which gives 500 ms of sleeping time, but it doesn't account
for the time while asix_mdio_read() executes. asix_mdio_read() in
turns contains another loop for 30 iterations with a sleep for 1 ms
(and does a bunch of stuff besides that). As a result asix_mdio_read()
takes ~80 ms in my setup. This results in at least 5000 * 80 ms = 400
seconds of delay in addition to those insignificant 500 ms.

Hang stack trace:

[<ffffffff8297c34e>] usb_start_wait_urb+0xfe/0x220 drivers/usb/core/message.c:61
[<     inline     >] usb_internal_control_msg drivers/usb/core/message.c:100
[<ffffffff8297c735>] usb_control_msg+0x2c5/0x3a0 drivers/usb/core/message.c:151
[<ffffffff8290efad>] __usbnet_read_cmd+0xcd/0x180 drivers/net/usb/usbnet.c:1986
[<ffffffff8290f0df>] usbnet_read_cmd+0x7f/0xe0 drivers/net/usb/usbnet.c:2044
[<ffffffff82900465>] asix_read_cmd+0x75/0xe0 drivers/net/usb/asix_common.c:37
[<ffffffff8290252b>] asix_mdio_read+0xbb/0x150 drivers/net/usb/asix_common.c:471
[<ffffffff828fe64a>] asix_phy_reset.isra.9+0xfa/0x1d0
drivers/net/usb/asix_devices.c:227
[<ffffffff828ff6c7>] ax88172_bind+0x397/0x4e0 drivers/net/usb/asix_devices.c:284
[<ffffffff829134b6>] usbnet_probe+0xb06/0x2600 drivers/net/usb/usbnet.c:1726
[<ffffffff82989f58>] usb_probe_interface+0x358/0x880
drivers/usb/core/driver.c:361
[<     inline     >] really_probe drivers/base/dd.c:413
[<ffffffff824bd780>] driver_probe_device+0x490/0x800 drivers/base/dd.c:557
[<ffffffff824bdedb>] __device_attach_driver+0x22b/0x290 drivers/base/dd.c:653
[<ffffffff824b7e4a>] bus_for_each_drv+0xfa/0x170 drivers/base/bus.c:463
[<ffffffff824bd10b>] __device_attach+0x1ab/0x290 drivers/base/dd.c:710
[<ffffffff824bdfda>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:757
[<ffffffff824bb086>] bus_probe_device+0x1e6/0x290 drivers/base/bus.c:523
[<ffffffff824b53ff>] device_add+0xb2f/0x1340 drivers/base/core.c:1835
[<ffffffff829836ad>] usb_set_configuration+0xe9d/0x1660
drivers/usb/core/message.c:1932
[<ffffffff829a314e>] generic_probe+0x6e/0xe0 drivers/usb/core/generic.c:174
[<ffffffff82989bca>] usb_probe_device+0xaa/0xe0 drivers/usb/core/driver.c:266
[<     inline     >] really_probe drivers/base/dd.c:413
[<ffffffff824bd780>] driver_probe_device+0x490/0x800 drivers/base/dd.c:557
[<ffffffff824bdedb>] __device_attach_driver+0x22b/0x290 drivers/base/dd.c:653
[<ffffffff824b7e4a>] bus_for_each_drv+0xfa/0x170 drivers/base/bus.c:463
[<ffffffff824bd10b>] __device_attach+0x1ab/0x290 drivers/base/dd.c:710
[<ffffffff824bdfda>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:757
[<ffffffff824bb086>] bus_probe_device+0x1e6/0x290 drivers/base/bus.c:523
[<ffffffff824b53ff>] device_add+0xb2f/0x1340 drivers/base/core.c:1835
[<ffffffff82966d53>] usb_new_device+0x7b3/0xff0 drivers/usb/core/hub.c:2457
[<     inline     >] hub_port_connect drivers/usb/core/hub.c:4906
[<     inline     >] hub_port_connect_change drivers/usb/core/hub.c:5012
[<     inline     >] port_event drivers/usb/core/hub.c:5118
[<ffffffff8296a69a>] hub_event+0x133a/0x2d90 drivers/usb/core/hub.c:5198
[<ffffffff8115d7ab>] process_one_work+0x78b/0x1540 kernel/workqueue.c:2113
[<ffffffff8115e647>] worker_thread+0xe7/0xff0 kernel/workqueue.c:2247
[<ffffffff8116d63c>] kthread+0x33c/0x410 kernel/kthread.c:231
[<ffffffff838d45da>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
[<ffffffffffffffff>] 0xffffffffffffffff

Messages printed to kernel log:

[  244.451821] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable software MII access
[  244.470152] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.490199] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.510193] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to write reg index 0x0000: -71
[  244.511992] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable hardware MII access
[  244.530191] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to write reg index 0x0000: -71
[  244.532024] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable software MII access
[  244.550197] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.570198] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.590194] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to write reg index 0x0000: -71
[  244.591960] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable hardware MII access
[  244.610193] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to write reg index 0x0000: -71
[  244.611978] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable software MII access
[  244.630224] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.650197] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.670193] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to write reg index 0x0000: -71
[  244.671991] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable hardware MII access
[  244.690170] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to write reg index 0x0000: -71
[  244.691907] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to enable software MII access
[  244.710201] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71
[  244.730205] asix 1-1:0.0 (unnamed net_device) (uninitialized):
Failed to read reg index 0x0000: -71