usb/uwb: GPF in uwbd_start

[Andrey Konovalov]

Hi!

I've got the following crashes while fuzzing the kernel with syzkaller.

On commit 81a84ad3cb5711cec79f4dd53a4ce026b092c432 (Sep 3).

uwbd_start() calls kthread_run() and checks that the return value in
not NULL. But the return value is not NULL in case kthread_run()
fails, it takes the form of ERR_PTR(-EINTR).

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 5237 Comm: syz-executor Not tainted 4.13.0+ #106
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069cc2700 task.stack: ffff8800607e8000
RIP: 0010:uwbd_start+0xcf/0x160 drivers/uwb/uwbd.c:311
RSP: 0018:ffff8800607ee6d0 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8800606baa80 RCX: 0000000000000000
RDX: 000000000000009a RSI: ffffffff812b6153 RDI: 00000000000004d4
RBP: ffff8800607ee6e8 R08: fffffbfff0fe00fd R09: fffffbfff0fe00fd
R10: ffff8800607ee6f8 R11: fffffbfff0fe00fc R12: fffffffffffffffc
R13: ffff8800606baed8 R14: ffff8800606baab0 R15: 1ffff1000c0fdcf0
FS: 00007f84c9aeb700(0000) GS:ffff88006c800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7829776000 CR3: 000000006a9b6000 CR4: 00000000000006f0
Call Trace:
uwb_rc_add+0x2cd/0x730 drivers/uwb/lc-rc.c:359
hwarc_probe+0x34e/0x9b0 drivers/uwb/hwa-rc.c:858
usb_probe_interface+0x351/0x8d0 drivers/usb/core/driver.c:361
really_probe drivers/base/dd.c:385
driver_probe_device+0x610/0xa00 drivers/base/dd.c:529
__device_attach_driver+0x230/0x290 drivers/base/dd.c:625
bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463
__device_attach+0x269/0x3c0 drivers/base/dd.c:682
device_initial_probe+0x1f/0x30 drivers/base/dd.c:729
bus_probe_device+0x1da/0x280 drivers/base/bus.c:523
device_add+0xcf9/0x1640 drivers/base/core.c:1703
usb_set_configuration+0x1064/0x1890 drivers/usb/core/message.c:1932
generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
really_probe drivers/base/dd.c:385
driver_probe_device+0x610/0xa00 drivers/base/dd.c:529
__device_attach_driver+0x230/0x290 drivers/base/dd.c:625
bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463
__device_attach+0x269/0x3c0 drivers/base/dd.c:682
device_initial_probe+0x1f/0x30 drivers/base/dd.c:729
bus_probe_device+0x1da/0x280 drivers/base/bus.c:523
device_add+0xcf9/0x1640 drivers/base/core.c:1703
usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
hub_port_connect drivers/usb/core/hub.c:4890
hub_port_connect_change drivers/usb/core/hub.c:4996
port_event drivers/usb/core/hub.c:5102
hub_event_impl+0x23ec/0x37e0 drivers/usb/core/hub.c:5224
gfs_hub_events_handle+0x6f6/0x900 drivers/usb/gadget/legacy/inode.c:1291
dev_ioctl+0x1c0/0x280 drivers/usb/gadget/legacy/inode.c:1319
vfs_ioctl fs/ioctl.c:45
do_vfs_ioctl+0x1d2/0x1560 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700
SyS_ioctl+0x94/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1a/0xa5 arch/x86/entry/entry_64.S:203
RIP: 0033:0x447727
RSP: 002b:00007f84c9aeabd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f84c9aeb700 RCX: 0000000000447727
RDX: 0000000000000064 RSI: 0000000000004242 RDI: 0000000000000005
RBP: 00007ffe7f91eaa0 R08: 0000000000000000 R09: 0000000000000000
R10: 00007f84c9aeb9d0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f84c9aeb9c0 R15: 00007f84c9aeb700
Code: 03 80 3c 02 00 0f 85 96 00 00 00 4c 8b a3 58 04 00 00 48 b8 00
00 00 00 00 fc ff df 49 8d bc 24 d8 04 00 00 48 89 fa 48 c1 ea 03 <0f>
b6 04 02 84 c0 74 04 3c 03 7e 5c 48 8d bb 50 04 00 00 48 b8
RIP: uwbd_start+0xcf/0x160 RSP: ffff8800607ee6d0
---[ end trace 16d16649a2b03b2e ]---

[Greg Kroah-Hartman]

On Tue, Sep 12, 2017 at 07:10:07PM +0200, Andrey Konovalov wrote:
> Hi!
>
> I've got the following crashes while fuzzing the kernel with syzkaller.
>
> On commit 81a84ad3cb5711cec79f4dd53a4ce026b092c432 (Sep 3).
>
> uwbd_start() calls kthread_run() and checks that the return value in
> not NULL. But the return value is not NULL in case kthread_run()
> fails, it takes the form of ERR_PTR(-EINTR).

Great, do you want to write a patch for this, or do you want me to?

And I'm guessing you really don't have the real hardware for this
device, right?

thanks,

greg k-h

[Andrey Konovalov]

On Tue, Sep 12, 2017 at 9:55 PM, Greg Kroah-Hartman
<gre...@linuxfoundation.org> wrote:
> On Tue, Sep 12, 2017 at 07:10:07PM +0200, Andrey Konovalov wrote:
>> Hi!
>>
>> I've got the following crashes while fuzzing the kernel with syzkaller.
>>
>> On commit 81a84ad3cb5711cec79f4dd53a4ce026b092c432 (Sep 3).
>>
>> uwbd_start() calls kthread_run() and checks that the return value in
>> not NULL. But the return value is not NULL in case kthread_run()
>> fails, it takes the form of ERR_PTR(-EINTR).
>
> Great, do you want to write a patch for this, or do you want me to?

Just mailed a patch.

>
> And I'm guessing you really don't have the real hardware for this
> device, right?

I don't have a hardware reproducer, but making it is just a question
of effort. There's the Facedancer21 board [1], which can be used to
emulate arbitrary USB devices. It's also possible to do this with with
something like Raspberry Pi Zero in USB gadget mode through gadgetfs.

[1] https://int3.cc/products/facedancer21

>
> thanks,
>
> greg k-h