Re: [syzbot] KASAN: null-ptr-deref Read in phy_disconnect

On Tue, 31 Aug 2021 17:30:19 +0200 Oleksij Rempel wrote:

Am 31.08.21 um 16:20 schrieb Andrew Lunn:

quoted

On Tue, Aug 31, 2021 at 06:48:45AM -0700, Jakub Kicinski wrote:  

quoted

On Tue, 31 Aug 2021 03:36:23 -0700 syzbot wrote:  

 [...]  

quoted

Looking at the console messages:

[   36.456221][   T32] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   36.976035][   T32] usb 1-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=42.6c
[   36.985338][   T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   36.993579][   T32] usb 1-1: Product: syz
[   36.997817][   T32] usb 1-1: Manufacturer: syz
[   37.002423][   T32] usb 1-1: SerialNumber: syz
[   37.013578][   T32] usb 1-1: config 0 descriptor??
[   37.276018][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random
executing program
[   37.715517][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71
[   37.725693][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9
[   37.925418][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71
[   37.936461][   T32] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9
[   38.119561][   T32] asix 1-1:0.0 eth1: register 'asix' at usb-dummy_hcd.0-1, ASIX AX88178 USB 2.0 Ethernet, 8a:c0:d1:1e:27:4c
[   38.138828][   T32] usb 1-1: USB disconnect, device number 2
[   38.150689][   T32] asix 1-1:0.0 eth1: unregister 'asix' usb-dummy_hcd.0-1, ASIX AX88178 USB 2.0 Ethernet

So this is a AX88178, and you would expect it to use
ax88178_bind(). That function never calls ax88772_init_phy() which is
what connects the PHY to the MAC, and sets priv->phydev.

static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf)
{
        struct asix_common_private *priv = dev->driver_priv;

        phy_disconnect(priv->phydev);

So this passes a NULL pointer.

static const struct driver_info ax88178_info = {
        .description = "ASIX AX88178 USB 2.0 Ethernet",
        .bind = ax88178_bind,
        .unbind = ax88772_unbind,
        .status = asix_status,

You cannot pair ax88178_bind with ax88772_unbind. Either a
ax88178_unbind is needed, or ax88772_unbind needs to check for a NULL
pointer.

	Andrew
 

Yes, this was fixed following patch:
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/drivers/net/usb/asix_devices.c?id=1406e8cb4b05fdc67692b1af2da39d7ca5278713

#syz fix: net: usb: asix: do not call phy_disconnect() for ax88178