netdev - Re: [syzbot] divide error in usbnet_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YW6On2cAm1qLoidn@hovoldconsulting.com>
Date:   Tue, 19 Oct 2021 11:23:43 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Oliver Neukum <oneukum@...e.com>
Cc:     syzbot <syzbot+76bb1d34ffa0adc03baa@...kaller.appspotmail.com>,
        linux-usb@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] divide error in usbnet_start_xmit

On Tue, Oct 19, 2021 at 10:14:20AM +0200, Oliver Neukum wrote:
> 
> On 19.10.21 05:17, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    c03fb16bafdf Merge 5.15-rc6 into usb-next
> > git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> > console output: https://syzkaller.appspot.com/x/log.txt?x=12d48f1f300000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=c27d285bdb7457e2
> > dashboard link: https://syzkaller.appspot.com/bug?extid=76bb1d34ffa0adc03baa
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14fe6decb00000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15c7bcaf300000
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+76bb1d34ffa0adc03baa@...kaller.appspotmail.com
> 
> #syz test:
> https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git c03fb16bafdf
> 
> From a5270791d4480e9a6bc009c69a4454039aa160e7 Mon Sep 17 00:00:00 2001
> From: Oliver Neukum <oneukum@...e.com>
> Date: Tue, 19 Oct 2021 10:02:42 +0200
> Subject: [PATCH] usbnet: sanity check for maxpacket
> 
> We cannot leave maxpacket at 0 because we divide by it.
> Devices that give us a 0 there are unlikely to work, but let's
> assume a 1, so we don't oops and a least try to operate.
> 
> Signed-off-by: Oliver Neukum <oneukum@...e.com>
> Reported-by: syzbot+76bb1d34ffa0adc03baa@...kaller.appspotmail.com
> ---
>  drivers/net/usb/usbnet.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index 840c1c2ab16a..2bdc3e0c1579 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -1788,6 +1788,9 @@ usbnet_probe (struct usb_interface *udev, const
> struct usb_device_id *prod)
>      if (!dev->rx_urb_size)
>          dev->rx_urb_size = dev->hard_mtu;
>      dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
> +    if (dev->maxpacket == 0)
> +        /* that is a strange device */
> +        dev->maxpacket = 1;

Just bail out; what can you do with a 1-byte packet size? Also compare
usbnet_get_endpoints() where such endpoints are ignored.

Johan