Re: [syzbot] divide error in genelink_tx_fixup

[Oliver Neukum <oneukum@suse.com>]

[-- Attachment #1: Type: text/plain, Size: 983 bytes --]


On 18.10.21 20:55, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    660a92a59b9e usb: xhci: Enable runtime-pm by default on AM..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1506ccf0b00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5016916cdc0a4a84
> dashboard link: https://syzkaller.appspot.com/bug?extid=a6ec4dd9d38cb9261a77
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11308734b00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f56f68b00000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a6ec4dd9d38cb9261a77@syzkaller.appspotmail.com

#syz test  
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git c03fb16bafdf





[-- Attachment #2: 0001-usbnet-sanity-check-for-maxpacket.patch --]
[-- Type: text/x-patch, Size: 1150 bytes --]

From a5270791d4480e9a6bc009c69a4454039aa160e7 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 19 Oct 2021 10:02:42 +0200
Subject: [PATCH] usbnet: sanity check for maxpacket

We cannot leave maxpacket at 0 because we divide by it.
Devices that give us a 0 there are unlikely to work, but let's
assume a 1, so we don't oops and a least try to operate.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com
---
 drivers/net/usb/usbnet.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 840c1c2ab16a..2bdc3e0c1579 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1788,6 +1788,9 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 	if (!dev->rx_urb_size)
 		dev->rx_urb_size = dev->hard_mtu;
 	dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
+	if (dev->maxpacket == 0)
+		/* that is a strange device */
+		dev->maxpacket = 1;
 
 	/* let userspace know we have a random address */
 	if (ether_addr_equal(net->dev_addr, node_id))
-- 
2.26.2