linux-kernel - Re: [PATCH] Input: xpad

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Apr 2023 12:25:21 +0300
From:   Dan Carpenter <error27@...il.com>
To:     Dongliang Mu <dzm91@...t.edu.cn>, Vicki Pfau <vi@...rift.com>
Cc:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        Pavel Rojtberg <rojtberg@...il.com>,
        Nate Yocom <nate@...om.org>,
        Mattijs Korpershoek <mkorpershoek@...libre.com>,
        John Butler <radon86dev@...il.com>,
        Matthias Benkmann <matthias.benkmann@...il.com>,
        Christopher Crockett <chaorace@...il.com>,
        Santosh De Massari <s.demassari@...il.com>,
        hust-os-kernel-patches@...glegroups.com,
        syzbot+a3f758b8d8cb7e49afec@...kaller.appspotmail.com,
        "Pierre-Loup A. Griffais" <pgriffais@...vesoftware.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Input: xpad - fix GPF in xpad_probe

On Fri, Apr 14, 2023 at 08:55:47PM +0800, Dongliang Mu wrote:
> In xpad_probe(), it does not allocate xpad->dev with input_dev type.
> Then, when it invokes dev_warn with 1st argument - &xpad->dev->dev, it
> would trigger GPF.

What is a call tree for this?  Actually I found it from the bug report.
drivers/input/joystick/xpad.c
  2034                  if (error)
  2035                          dev_warn(&xpad->dev->dev,
  2036                                   "unable to receive magic message: %d\n",
  2037                                   error);
  2038          }

> 
> Fix this by allocating xpad->dev, its error handling and cleanup
> operations in the remove function.
> 
> Note that this crash does not have any reproducer, so the patch
> only passes compilation testing.

The xpad->dev = input_dev; already happens in xpad_init_input().  We
shouldn't allocate it twice.  I think the fix is to just use a different
device pointer for the dev_warn().  Why not use &xpad->intf->dev?

> 
> Reported-by: syzbot+a3f758b8d8cb7e49afec@...kaller.appspotmail.com

Could you use a Link tag to link to the bug report?
Link: https://groups.google.com/g/syzkaller-bugs/c/iMhTgpGuIbM

This needs a Fixes tag.

Fixes: db7220c48d8d ("Input: xpad - fix support for some third-party controllers")

regards,
dan carpenter