linux-kernel - Re: [syzbot] WARNING in do_proc_control/usb_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210711155345.GB293743@rowland.harvard.edu>
Date:   Sun, 11 Jul 2021 11:53:45 -0400
From:   Alan Stern <stern@...land.harvard.edu>
To:     syzbot <syzbot+72af3105289dcb4c055b@...kaller.appspotmail.com>
Cc:     gregkh@...uxfoundation.org, johan@...nel.org,
        linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
        mathias.nyman@...ux.intel.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] WARNING in do_proc_control/usb_submit_urb

On Sat, Jul 10, 2021 at 10:50:03AM -0400, Alan Stern wrote:
> On Sat, Jul 10, 2021 at 04:11:15AM -0700, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    ee268dee Add linux-next specific files for 20210707
> > git tree:       linux-next
> 
> Is this an old version of syzbot?  I thought it had been fixed up to 
> give a real URL (one that "#syz test:" would accept) for the git 
> tree and a 12-digit SHA-1 abbreviation for the HEAD commit.

Actually, on further thought it looks like only a one-line change is 
needed.  Let's make sure it works.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git ee268dee

> Index: usb-devel/drivers/usb/core/devio.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/core/devio.c
> +++ usb-devel/drivers/usb/core/devio.c
> @@ -1133,7 +1133,7 @@ static int do_proc_control(struct usb_de
>  		"wIndex=%04x wLength=%04x\n",
>  		ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
>  		ctrl->wIndex, ctrl->wLength);
> -	if (ctrl->bRequestType & 0x80) {
> +	if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {
>  		pipe = usb_rcvctrlpipe(dev, 0);
>  		snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);
>