linux-kernel - Re: [syzbot] UBSAN: array-index-out-of-bounds in pvr2_i2c_core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9ff91977-a6b5-90f9-3502-58ac641e1307@gmail.com>
Date:   Thu, 14 Apr 2022 23:18:28 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     syzbot <syzbot+1a247e36149ffd709a9b@...kaller.appspotmail.com>,
        isely@...ox.com, linux-kernel@...r.kernel.org,
        linux-media@...r.kernel.org, mchehab@...nel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] UBSAN: array-index-out-of-bounds in pvr2_i2c_core_init

On 4/14/22 23:14, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in pvr2_hdw_create
> 
> pvrusb2: Hardware description: OnAir USB2 Hybrid USB tuner
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3607 at kernel/workqueue.c:3066 __flush_work+0x926/0xb10 kernel/workqueue.c:3066
> Modules linked in:
> CPU: 1 PID: 3607 Comm: kworker/1:4 Not tainted 5.18.0-rc2-syzkaller-00187-g115acbb56978-dirty #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:__flush_work+0x926/0xb10 kernel/workqueue.c:3066
> Code: ff 41 89 c4 89 8d 88 fe ff ff e8 d5 2b 77 00 48 0f ba 2b 03 e9 6a fa ff ff e8 c6 8f 2b 00 0f 0b e9 5a fc ff ff e8 ba 8f 2b 00 <0f> 0b 45 31 f6 e9 4b fc ff ff e8 eb 28 77 00 e9 3a fb ff ff e8 a1
> RSP: 0018:ffffc90003d1ee00 EFLAGS: 00010293
> 

Not bad guess.

Moving work initialization upper, since rewriting error handling is boring


#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master




With regards,
Pavel Skripkin

View attachment "ph" of type "text/plain" (1141 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)