lkml.org 
[lkml]   [2019]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: general protection fault in __dev_printk
On Tue, 23 Apr 2019, syzbot wrote:

> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger
> crash:
>
> Reported-and-tested-by:
> syzbot+2eb9121678bdb36e6d57@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: d34f9519 usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan/tree/usb-fuzzer
> kernel config: https://syzkaller.appspot.com/x/.config?x=c73d1bb5aeaeae20
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> patch: https://syzkaller.appspot.com/x/patch.diff?x=15909780a00000
>
> Note: testing is done by a robot and is best-effort only.

Okay, here's the original patch again, with the error message #if-ed
out. Maybe those messages are slowing down dummy-hcd enough that the
yurex_disconnect() routine never gets a chance to run. Although to
tell the truth, I don't see how that could happen.

Alan Stern


#syz test: https://github.com/google/kasan.git usb-fuzzer

--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -143,8 +143,10 @@ static void yurex_interrupt(struct urb *
/* The device is terminated, clean up */
return;
default:
+#if 0
dev_err(&dev->interface->dev,
"%s - unknown status received: %d\n", __func__, status);
+#endif
goto exit;
}

@@ -314,6 +316,7 @@ static void yurex_disconnect(struct usb_
usb_deregister_dev(interface, &yurex_class);

/* prevent more I/O from starting */
+ usb_poison_urb(dev->urb);
mutex_lock(&dev->io_mutex);
dev->interface = NULL;
mutex_unlock(&dev->io_mutex);
\
 
 \ /
  Last update: 2019-04-23 18:49    [W:0.055 / U:1.592 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site