[Linux-kernel-mentees] Syzbot analysis; KASAN: null-ptr-deref Read in zr364xx_vidioc_querycap
skhan at linuxfoundation.org
Tue May 14 20:14:39 UTC 2019
On 5/11/19 1:44 AM, Vandana BN wrote:
> This is a NULL pointer derefrence bug in USB_ZR364XX driver.
> KASAN: null-ptr-deref Read in zr364xx_vidioc_querycap
> The ioctl vidioc_querycap() is used to get capablity of driver and hardware.
> USB_ZR364XX driver registers zr364xx_vidioc_querycap() as
> .vidioc_querycap funtion which is part of v4l2_ioctl_ops in v4l2.
> When VIDIOC_QUERYCAP ioctl is called, the below function path is traversed
> which further calls below funtions
> In function check_memory_region(), if the input addr is not valid, that is,
> if addr is greater than KASAN_SHADOW_START which is VA_START - the first
> kernel virtual address.
> then, kasan_report() get called which prints the stack seen in bug
> report via dump_stack().
> The stack trace in the bug points at below line in zr364xx_vidioc_querycap()
> "706 strscpy(cap->card, cam->udev->product, sizeof(cap->card));"
> The bug report has the below line which tells that the addr which is
> src(cam->udev->product) in the above strcpy() is NULL.
> "Read of size 1 at addr 0000000000000000 by task v4l_id/5287"
> So, for this device the Product is not initialized and accessing it
> causes a NULL pointer deref.
> Also, in usb.h in comment on struct usb_device it says
> "@product: iProduct string, if present (static)" .
> I deduce that product can be NULL from this, and in all other places
> where udev->product is accessed does NULL check before accessing it.
Correct. Other drivers do check if product in null first.
> The fix would be to check for NULL before strcpy or/and copy DRIVER_DESC
> or "zr364xx" to cap->card insted in zr364xx_vidioc_querycap().
Right. A null check would fix the problem. Send the fix in. cc'ing Hans
More information about the Linux-kernel-mentees