linux-kernel - Re: [syzbot] [usb?] WARNING in usbnet_status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250709021318.3100-1-hdanton@sina.com>
Date: Wed,  9 Jul 2025 10:13:17 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+3f89ec3d1d0842e95d50@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] WARNING in usbnet_status_start

> Date: Tue, 08 Jul 2025 10:51:27 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d1b07cc0868f arm64: dts: s32g: Add USB device tree informa..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1554d582580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=28729dff5d03ad1
> dashboard link: https://syzkaller.appspot.com/bug?extid=3f89ec3d1d0842e95d50
> compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11680a8c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14c9abd4580000

#syz test

--- x/drivers/net/usb/usbnet.c
+++ y/drivers/net/usb/usbnet.c
@@ -231,6 +231,8 @@ static int init_status (struct usbnet *d
 	if (!dev->driver_info->status)
 		return 0;
 
+	if (!dev->status)
+		return -EINVAL;
 	pipe = usb_rcvintpipe (dev->udev,
 			dev->status->desc.bEndpointAddress
 				& USB_ENDPOINT_NUMBER_MASK);
@@ -254,6 +256,8 @@ static int init_status (struct usbnet *d
 				"status ep%din, %d bytes period %d\n",
 				usb_pipeendpoint(pipe), maxp, period);
 		}
+	} else {
+		return -ENOMEM;
 	}
 	return 0;
 }
@@ -1812,7 +1816,7 @@ usbnet_probe (struct usb_interface *udev
 		if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
 			status = -EINVAL;
 	}
-	if (status >= 0 && dev->status)
+	if (status >= 0)
 		status = init_status (dev, udev);
 	if (status < 0)
 		goto out3;
--