linux-kernel - Re: general protection fault in __dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Apr 2019 12:46:48 -0400 (EDT)
From:   Alan Stern <stern@...land.harvard.edu>
To:     syzbot <syzbot+2eb9121678bdb36e6d57@...kaller.appspotmail.com>
cc:     andreyknvl@...gle.com, <dvyukov@...gle.com>,
        <gregkh@...uxfoundation.org>, <linux-kernel@...r.kernel.org>,
        <linux-usb@...r.kernel.org>, <rafael@...nel.org>,
        <syzkaller-bugs@...glegroups.com>
Subject: Re: general protection fault in __dev_printk

On Tue, 23 Apr 2019, syzbot wrote:

> Hello,
> 
> syzbot has tested the proposed patch and the reproducer did not trigger  
> crash:
> 
> Reported-and-tested-by:  
> syzbot+2eb9121678bdb36e6d57@...kaller.appspotmail.com
> 
> Tested on:
> 
> commit:         d34f9519 usb-fuzzer: main usb gadget fuzzer driver
> git tree:       https://github.com/google/kasan/tree/usb-fuzzer
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c73d1bb5aeaeae20
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=15909780a00000
> 
> Note: testing is done by a robot and is best-effort only.

Okay, here's the original patch again, with the error message #if-ed
out.  Maybe those messages are slowing down dummy-hcd enough that the
yurex_disconnect() routine never gets a chance to run.  Although to
tell the truth, I don't see how that could happen.

Alan Stern


#syz test: https://github.com/google/kasan.git usb-fuzzer

--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -143,8 +143,10 @@ static void yurex_interrupt(struct urb *
 		/* The device is terminated, clean up */
 		return;
 	default:
+#if 0
 		dev_err(&dev->interface->dev,
 			"%s - unknown status received: %d\n", __func__, status);
+#endif
 		goto exit;
 	}
 
@@ -314,6 +316,7 @@ static void yurex_disconnect(struct usb_
 	usb_deregister_dev(interface, &yurex_class);
 
 	/* prevent more I/O from starting */
+	usb_poison_urb(dev->urb);
 	mutex_lock(&dev->io_mutex);
 	dev->interface = NULL;
 	mutex_unlock(&dev->io_mutex);