linux-kernel - divide error in alauda

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 22 May 2024 15:28:01 +0800
From: Shichao Lai <phyhac@...il.com>
To: Alan Stern <stern@...land.harvard.edu>, 
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>, linux-usb@...r.kernel.org, 
	usb-storage@...ts.one-eyed-alien.net, linux-kernel@...r.kernel.org, 
	syzkaller@...glegroups.com
Subject: divide error in alauda_transport

Hello Dear maintainer!
A new bug was found by our modified syzkaller.

Kernel Version: v6.9-rc7
Reproducer & Kernel config: attachment

=================
divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 10871 Comm: usb-storage Not tainted 6.9.0-rc7 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:954 [inline]
RIP: 0010:alauda_transport+0xd34/0x3280 drivers/usb/storage/alauda.c:1184
Code: 01 e8 85 ed 48 89 44 24 58 0f 84 00 02 00 00 89 6c 24 10 44 8b 74 24
18 e8 29 6e 0a fd 31 d2 4c 89 ff 44 89 f0 44 89 74 24 18 <f7> 74 24 78 41
89 c4 89 d5 44 89 e6 e8 8b c2 ff ff 0f b7 5c 24 50
RSP: 0018:ffffc9000b24fa68 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff844799be
RDX: 0000000000000000 RSI: ffffffff844799f7 RDI: ffff88813bc6ccc0
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffff888115508b00 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88813bc6ccc0
FS:  0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e17750658 CR3: 000000010d3c8000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 usb_stor_invoke_transport+0xed/0x1670 drivers/usb/storage/transport.c:611
 usb_stor_control_thread+0x5d3/0xa80 drivers/usb/storage/usb.c:368
 kthread+0x2c7/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:954 [inline]
RIP: 0010:alauda_transport+0xd34/0x3280 drivers/usb/storage/alauda.c:1184
Code: 01 e8 85 ed 48 89 44 24 58 0f 84 00 02 00 00 89 6c 24 10 44 8b 74 24
18 e8 29 6e 0a fd 31 d2 4c 89 ff 44 89 f0 44 89 74 24 18 <f7> 74 24 78 41
89 c4 89 d5 44 89 e6 e8 8b c2 ff ff 0f b7 5c 24 50
RSP: 0018:ffffc9000b24fa68 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff844799be
RDX: 0000000000000000 RSI: ffffffff844799f7 RDI: ffff88813bc6ccc0
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffff888115508b00 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88813bc6ccc0
FS:  0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e17750658 CR3: 000000010d3c8000 CR4: 0000000000750ef0
PKRU: 55555554
----------------
Code disassembly (best guess):
   0:   01 e8                   add    %ebp,%eax
   2:   85 ed                   test   %ebp,%ebp
   4:   48 89 44 24 58          mov    %rax,0x58(%rsp)
   9:   0f 84 00 02 00 00       je     0x20f
   f:   89 6c 24 10             mov    %ebp,0x10(%rsp)
  13:   44 8b 74 24 18          mov    0x18(%rsp),%r14d
  18:   e8 29 6e 0a fd          call   0xfd0a6e46
  1d:   31 d2                   xor    %edx,%edx
  1f:   4c 89 ff                mov    %r15,%rdi
  22:   44 89 f0                mov    %r14d,%eax
  25:   44 89 74 24 18          mov    %r14d,0x18(%rsp)
* 2a:   f7 74 24 78             divl   0x78(%rsp) <-- trapping instruction
  2e:   41 89 c4                mov    %eax,%r12d
  31:   89 d5                   mov    %edx,%ebp
  33:   44 89 e6                mov    %r12d,%esi
  36:   e8 8b c2 ff ff          call   0xffffc2c6
  3b:   0f b7 5c 24 50          movzwl 0x50(%rsp),%ebx

Content of type "text/html" skipped

View attachment "repro.c" of type "text/x-csrc" (21518 bytes)

Download attachment ".config" of type "application/octet-stream" (233261 bytes)