linux-kernel - Re: [syzbot] KASAN: null-ptr-deref Read in phy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210831083446.43effd7c@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Tue, 31 Aug 2021 08:34:46 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Oleksij Rempel <linux@...pel-privat.de>
Cc:     Andrew Lunn <andrew@...n.ch>,
        syzbot <syzbot+6a916267d9bc5fa2d9a6@...kaller.appspotmail.com>,
        davem@...emloft.net, hkallweit1@...il.com,
        linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
        linux@...linux.org.uk, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KASAN: null-ptr-deref Read in phy_disconnect

On Tue, 31 Aug 2021 17:30:19 +0200 Oleksij Rempel wrote:
> Am 31.08.21 um 16:20 schrieb Andrew Lunn:
> > On Tue, Aug 31, 2021 at 06:48:45AM -0700, Jakub Kicinski wrote:  
> >> On Tue, 31 Aug 2021 03:36:23 -0700 syzbot wrote:  
>  [...]  
> >
> > Looking at the console messages:
> >
> > [   36.456221][   T32] usb 1-1: new high-speed USB device number 2 using dummy_hcd
> > [   36.976035][   T32] usb 1-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=42.6c
> > [   36.985338][   T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
> > [   36.993579][   T32] usb 1-1: Product: syz
> > [   36.997817][   T32] usb 1-1: Manufacturer: syz
> > [   37.002423][   T32] usb 1-1: SerialNumber: syz
> > [   37.013578][   T32] usb 1-1: config 0 descriptor??
> > [   37.276018][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random
> > executing program
> > [   37.715517][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71
> > [   37.725693][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9
> > [   37.925418][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71
> > [   37.936461][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9
> > [   38.119561][   T32] asix 1-1:0.0 eth1: register 'asix' at usb-dummy_hcd.0-1, ASIX AX88178 USB 2.0 Ethernet, 8a:c0:d1:1e:27:4c
> > [   38.138828][   T32] usb 1-1: USB disconnect, device number 2
> > [   38.150689][   T32] asix 1-1:0.0 eth1: unregister 'asix' usb-dummy_hcd.0-1, ASIX AX88178 USB 2.0 Ethernet
> >
> > So this is a AX88178, and you would expect it to use
> > ax88178_bind(). That function never calls ax88772_init_phy() which is
> > what connects the PHY to the MAC, and sets priv->phydev.
> >
> > static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf)
> > {
> >         struct asix_common_private *priv = dev->driver_priv;
> >
> >         phy_disconnect(priv->phydev);
> >
> > So this passes a NULL pointer.
> >
> > static const struct driver_info ax88178_info = {
> >         .description = "ASIX AX88178 USB 2.0 Ethernet",
> >         .bind = ax88178_bind,
> >         .unbind = ax88772_unbind,
> >         .status = asix_status,
> >
> > You cannot pair ax88178_bind with ax88772_unbind. Either a
> > ax88178_unbind is needed, or ax88772_unbind needs to check for a NULL
> > pointer.
> >
> > 	Andrew
> >  
> 
> Yes, this was fixed following patch:
> https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/drivers/net/usb/asix_devices.c?id=1406e8cb4b05fdc67692b1af2da39d7ca5278713

#syz fix: net: usb: asix: do not call phy_disconnect() for ax88178