Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1741714

Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints

Show all headers | View raw

On Thu, 28 Sep 2017, Andrey Konovalov wrote:

> Hi!
> 
> I've got the following report while fuzzing the kernel with syzkaller.
> 
> On commit dc972a67cc54585bd83ad811c4e9b6ab3dcd427e (4.14-rc2+).
> 
> It seems that out pointer ends up being NULL and kernel crashes on
> access to out->desc.bEndpointAddress.
> 
> gadgetfs: bound to dummy_udc driver
> usb 1-1: new full-speed USB device number 2 using dummy_hcd
> gadgetfs: connected
> gadgetfs: disconnected
> gadgetfs: connected
> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x81 has invalid
> maxpacket 2040, setting to 64
> usb 1-1: config 2 interface 0 altsetting 206 has an invalid endpoint
> with address 0xFF, skipping
> usb 1-1: config 2 interface 0 altsetting 206 endpoint 0x5 has an
> invalid bInterval 255, changing to 4
> usb 1-1: config 2 interface 0 has no altsetting 0
> usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0
> usb 1-1: New USB device strings: Mfr=0, Product=185, SerialNumber=1
> usb 1-1: Product: a
> usb 1-1: SerialNumber: a
> gadgetfs: configuration #2
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> Modules linked in:
> CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted
> 4.14.0-rc2-42664-gaf7d1481b3cb #297
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: usb_hub_wq hub_event
> task: ffff880064328000 task.stack: ffff880064398000
> RIP: 0010:get_endpoints drivers/usb/misc/usbtest.c:208
> RIP: 0010:usbtest_probe+0x114f/0x1ef0 drivers/usb/misc/usbtest.c:2706

This looks like a simple logic error.

Alan Stern



Index: usb-4.x/drivers/usb/misc/usbtest.c
===================================================================
--- usb-4.x.orig/drivers/usb/misc/usbtest.c
+++ usb-4.x/drivers/usb/misc/usbtest.c
@@ -202,12 +202,13 @@ found:
 			return tmp;
 	}
 
-	if (in) {
+	if (in)
 		dev->in_pipe = usb_rcvbulkpipe(udev,
 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+	if (out)
 		dev->out_pipe = usb_sndbulkpipe(udev,
 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-	}
+
 	if (iso_in) {
 		dev->iso_in = &iso_in->desc;
 		dev->in_iso_pipe = usb_rcvisocpipe(udev,

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints Andrey Konovalov <andreyknvl@google.com> - 2017-09-28 13:40 +0200
  Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints Alan Stern <stern@rowland.harvard.edu> - 2017-09-28 19:10 +0200
    Re: usb/misc/usbtest: null-ptr-deref in usbtest_probe/get_endpoints Andrey Konovalov <andreyknvl@google.com> - 2017-09-29 13:50 +0200

csiph-web