lkml.org 
[lkml]   [2019]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 202/223] usb: wusbcore: fix unbalanced get/put cluster_id
    Date
    From: Phong Tran <tranmanphong@gmail.com>

    commit f90bf1ece48a736097ea224430578fe586a9544c upstream.

    syzboot reported that
    https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef

    There is not consitency parameter in cluste_id_get/put calling.
    In case of getting the id with result is failure, the wusbhc->cluster_id
    will not be updated and this can not be used for wusb_cluster_id_put().

    Tested report
    https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ

    Reproduce and gdb got the details:

    139 addr = wusb_cluster_id_get();
    (gdb) n
    140 if (addr == 0)
    (gdb) print addr
    $1 = 254 '\376'
    (gdb) n
    142 result = __hwahc_set_cluster_id(hwahc, addr);
    (gdb) print result
    $2 = -71
    (gdb) break wusb_cluster_id_put
    Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384.
    (gdb) s
    Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384
    384 id = 0xff - id;
    (gdb) n
    385 BUG_ON(id >= CLUSTER_IDS);
    (gdb) print id
    $3 = 255 '\377'

    Reported-by: syzbot+fd2bd7df88c606eea4ef@syzkaller.appspotmail.com
    Signed-off-by: Phong Tran <tranmanphong@gmail.com>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20190724020601.15257-1-tranmanphong@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/host/hwa-hc.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/usb/host/hwa-hc.c
    +++ b/drivers/usb/host/hwa-hc.c
    @@ -173,7 +173,7 @@ out:
    return result;

    error_set_cluster_id:
    - wusb_cluster_id_put(wusbhc->cluster_id);
    + wusb_cluster_id_put(addr);
    error_cluster_id_get:
    goto out;


    \
     
     \ /
      Last update: 2019-08-02 12:09    [W:8.957 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site