Re: general protection fault in flexcop_usb_probe

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+d93dff...@syzkaller.appspotmail.com

Tested on:

commit: 6a3599ce usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
usb-fuzzer-usb-testing-2019.07.11
kernel config: https://syzkaller.appspot.com/x/.config?x=662450485a75f217
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1036e80c600000

Note: testing is done by a robot and is best-effort only.

[Andrey Konovalov]

Hi Oliver,

Thanks a lot for fixing all of these USB bugs!

The usb-fuzzer branch is working again, so it should be possible to
use it for testing. But, I've actually just realized, that the proper
way to test fixes for USB bugs is to use the exact commit hash that is
provided in each bug report (the kernel interface for emulating USB
device is not stable yet, and has significantly changed at least
once). I've updated syzbot documentation to reflect this.

Let's try to retest this one with the right kernel commit id:

#syz test: https://github.com/google/kasan.git 9a33b369

Thanks!




>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000488c6d058ed337b2%40google.com.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+d93dff...@syzkaller.appspotmail.com

Tested on:

commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=11cc12d8600000

[Oliver Neukum]

Am Montag, den 29.07.2019, 18:54 +0200 schrieb Andrey Konovalov:

Hi,

> Thanks a lot for fixing all of these USB bugs!

I fear the day we get serious about MA USB.
All these issues will turn into security issues.

> The usb-fuzzer branch is working again, so it should be possible to
> use it for testing. But, I've actually just realized, that the proper
> way to test fixes for USB bugs is to use the exact commit hash that is
> provided in each bug report (the kernel interface for emulating USB
> device is not stable yet, and has significantly changed at least
> once). I've updated syzbot documentation to reflect this.

Where is taht documentation?

> Let's try to retest this one with the right kernel commit id:
>
> #syz test: https://github.com/google/kasan.git 9a33b369

Retesting.

Regards
Oliver

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+d93dff...@syzkaller.appspotmail.com

Tested on:

commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=1226c2d8600000

[Dmitry Vyukov]

On Tue, Jul 30, 2019 at 9:51 AM Oliver Neukum <one...@suse.com> wrote:
>
> Am Montag, den 29.07.2019, 18:54 +0200 schrieb Andrey Konovalov:
>
> Hi,
>
> > Thanks a lot for fixing all of these USB bugs!
>
> I fear the day we get serious about MA USB.
> All these issues will turn into security issues.
>
> > The usb-fuzzer branch is working again, so it should be possible to
> > use it for testing. But, I've actually just realized, that the proper
> > way to test fixes for USB bugs is to use the exact commit hash that is
> > provided in each bug report (the kernel interface for emulating USB
> > device is not stable yet, and has significantly changed at least
> > once). I've updated syzbot documentation to reflect this.
>
> Where is taht documentation?

Hi Oliver,

The link is referenced in every bug report ;)
https://groups.google.com/forum/#!topic/syzkaller-bugs/C4kgnyomFyQ
> See https://goo.gl/tpsmEJ for more information about syzbot.

[Andrey Konovalov]

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000081a9c1058ee1d06a%40google.com.

Hi Oliver,

I was wondering if you've submitted this patch anywhere? The bug is
still happening.

https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f

Thanks!

[Oliver Neukum]

Am Freitag, den 20.09.2019, 18:01 +0200 schrieb Andrey Konovalov:

> > Reported-and-tested-by:
> > syzbot+d93dff...@syzkaller.appspotmail.com

[..]

> Hi Oliver,
>
> I was wondering if you've submitted this patch anywhere? The bug is
> still happening.
>
> https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f

Hi,

I definitely did submit it:
https://www.mail-archive.com/linux...@vger.kernel.org/msg148850.html

Regards
Oliver

[Andrey Konovalov]

Hi Mauro,

Do you know what happened to this patch? Did it get lost?

Thanks!

[Hans Verkuil]

Still sitting unreviewed in patchwork: https://patchwork.linuxtv.org/patch/57785/

Not sure why this wasn't picked up.

Regards,

Hans

[Oliver Neukum]

Hi,

AFAICT it is still in the state new. What should I do?

Regards
Oliver

[Hans Verkuil]

Hi Sean,

Mauro is very busy, so can you pick this up? And perhaps check patchwork for more
trivial DVB patches that can be included in a pull request?

Regards,

Hans

[Sean Young]

Hi Hans, Oliver,

My bad, it slipped between the cracks. I am preparing a pull request now.

Sorry about this.

Sean