syzbot
general protection fault in usb_find_alt_setting
Status:
closed as invalid on 2018/05/11 17:39
Subsystems:
usb
[Documentation on labels]
Reported-by: syzbot+c99ecc8a2c68eb7e06cf2f652e60d63d6fbe2f31@syzkaller.appspotmail.com
First crash: 3230d, last: 3217d
Sample crash report:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 3 PID: 20395 Comm: syz-executor6 Not tainted 4.14.0-next-20171114+ #14
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880073440600 task.stack: ffff880073db8000
RIP: 0010:usb_find_alt_setting+0x38/0x310 drivers/usb/core/usb.c:231
RSP: 0018:ffff880073dbf610 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83bf5e43
RDX: 0000000000000000 RSI: ffffc90004732000 RDI: 0000000000000004
RBP: ffff880073dbf650 R08: ffffed000e7b7ee2 R09: ffffed000e7b7ee2
R10: 0000000000000003 R11: ffffed000e7b7ee1 R12: ffff88002a7ae280
R13: 00000000000000fd R14: 00000000000007fd R15: 0000000000000000
FS: 00007f0979c56700(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020278ffc CR3: 00000000791ea000 CR4: 00000000000006e0
Call Trace:
check_ctrlrecip+0xf3/0x290 drivers/usb/core/devio.c:831
proc_control+0x13f/0xe30 drivers/usb/core/devio.c:1078
usbdev_do_ioctl+0x2097/0x3670 drivers/usb/core/devio.c:2396
usbdev_ioctl+0x25/0x30 drivers/usb/core/devio.c:2553
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x447c99
RSP: 002b:00007f0979c55bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0979c566cc RCX: 0000000000447c99
RDX: 000000002003dffa RSI: 00000000c0185500 RDI: 0000000000000014
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000086a0 R14: 00000000006ec740 R15: 00007f0979c56700
Code: 89 d5 53 48 89 fb 48 83 ec 18 48 89 7d c8 89 75 d0 e8 bd 37 b0 fd 48 8d 7b 04 48 b8 00 00 00 00 00 fc ff df 48 89
netlink: 5 bytes leftover after parsing attributes in process `syz-executor0'.
fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 a1 02 00
RIP: usb_find_alt_setting+0x38/0x310 drivers/usb/core/usb.c:231 RSP: ffff880073dbf610
---[ end trace b2f19bc558c9b10c ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
* Struck through repros no longer work on HEAD.