linux-kernel - RE: [PATCH v2] usb: gadget: composite: Fix null pointer exception

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <KU1PR02MB253627CFDBE573DE95F3A09EB0919@KU1PR02MB2536.apcprd02.prod.outlook.com>
Date:   Mon, 8 Nov 2021 12:42:24 +0000
From:   胡启航(Nick Hu) <huqihang@...o.com>
To:     Greg KH <gregkh@...uxfoundation.org>
CC:     "balbi@...nel.org" <balbi@...nel.org>,
        "peter.chen@...nel.org" <peter.chen@...nel.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v2] usb: gadget: composite: Fix null pointer exception

> -----Original Message-----
> From: Greg KH <gregkh@...uxfoundation.org>
> Sent: Friday, November 5, 2021 8:45 PM
> To: 胡启航(Nick Hu) <huqihang@...o.com>
> Cc: balbi@...nel.org; peter.chen@...nel.org; linux-usb@...r.kernel.org;
> linux-kernel@...r.kernel.org
> Subject: Re: [PATCH v2] usb: gadget: composite: Fix null pointer exception
> 
> On Fri, Nov 05, 2021 at 06:48:40PM +0800, Qihang Hu wrote:
> > In the config_ep_by_speed_and_alt function, select the corresponding
> > descriptor through g->speed, but the function driver may not
> > support the corresponding speed. So, we need to check whether the
> > function driver provides the corresponding speed descriptor when
> > selecting the descriptor.
> >
> > [  237.708146]  android_work: sent uevent USB_STATE=CONNECTED
> > [  237.712464]  kconfigfs-gadget gadget: super-speed config #1: b
> > [  237.712487]  kUnable to handle kernel NULL pointer dereference at
> virtual address 0000000000000000
> 
> So this is an invalid driver causing this problem?  Or can this be
> triggered by userspace?

Yes, if the kernel is loaded with an interface driver that does not support all
speeds, this problem can be triggered in userspace.

> 
> > [  237.712493]  kMem abort info:
> > [  237.712498]  k  ESR = 0x96000006
> > [  237.712504]  k  EC = 0x25: DABT (current EL), IL = 32 bits
> > [  237.712510]  k  SET = 0, FnV = 0
> > [  237.712515]  k  EA = 0, S1PTW = 0
> > [  237.712520]  kData abort info:
> > [  237.712525]  k  ISV = 0, ISS = 0x00000006
> > [  237.712530]  k  CM = 0, WnR = 0
> > [  237.712536]  kuser pgtable: 4k pages, 39-bit VAs,
> pgdp=000000020ef29000
> > [  237.712541]  k[0000000000000000] pgd=000000020ef2a003,
> pud=000000020ef2a003, pmd=0000000000000000
> > [  237.712554]  kInternal error: Oops: 96000006 [#1] PREEMPT SMP
> > [  237.722067]  kSkip md ftrace buffer dump for: 0x1609e0
> > [  237.787037]  kWorkqueue: dwc_wq dwc3_bh_work.cfi_jt
> > [  237.854922]  kpstate: 60c00085 (nZCv daIf +PAN +UAO)
> > [  237.863165]  kpc : config_ep_by_speed_and_alt+0x90/0x308
> > [  237.871766]  klr : audio_set_alt+0x54/0x78
> > [  237.879108]  ksp : ffffffc0104839e0
> >
> > Signed-off-by: Qihang Hu <huqihang@...o.com>
> 
> What commit id does this fix?

I have not submitted a BUG.
I will study and submit a BUG as soon as possible.

> 
> > ---
> > Changes in v2:
> > -Add warning message
> > ---
> >  drivers/usb/gadget/composite.c | 40 +++++++++++++++++++++++-----------
> >  1 file changed, 27 insertions(+), 13 deletions(-)
> >
> > diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
> > index 72a9797dbbae..746b34cf0310 100644
> > --- a/drivers/usb/gadget/composite.c
> > +++ b/drivers/usb/gadget/composite.c
> > @@ -160,6 +160,9 @@ int config_ep_by_speed_and_alt(struct usb_gadget
> *g,
> >
> >  	struct usb_descriptor_header **d_spd; /* cursor for speed desc */
> >
> 
> Why the blank line here?
> 
> > +	struct usb_composite_dev *cdev;
> > +	int incomplete_desc = 0;
> 
> Shouldn't this be a bool?
> 

The bool variable should indeed be used, I will fix this problem in V3

Thanks