syzbot


divide error in isd200_ata_command

Status: fixed on 2024/04/10 03:59
Subsystems: usb-storage
[Documentation on labels]
Reported-by: syzbot+28748250ab47a8f04100@syzkaller.appspotmail.com
Fix commit: 014bcf41d946 USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
First crash: 62d, last: 56d
Cause bisection: introduced by (bisect log) :
commit 321da3dc1f3c92a12e3c5da934090d2992a8814c
Author: Martin K. Petersen <martin.petersen@oracle.com>
Date: Tue Feb 13 14:33:06 2024 +0000

  scsi: sd: usb_storage: uas: Access media prior to querying device properties

Crash: divide error in isd200_ata_command (log)
Repro: C syz .config
  
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command 3 (3) 2024/03/01 11:36
[syzbot] [usb-storage?] divide error in isd200_ata_command 13 (17) 2024/02/29 17:57
Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/02/28 19:18 1h14m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f2e367d6ad3bdc527c2b14e759c2f010d6b2b7a1 OK log
2024/02/28 16:12 0m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f2e367d6ad3b error OK
2024/02/27 19:36 1h04m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f2e367d6ad3b error OK

Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5070 Comm: usb-storage Not tainted 6.8.0-rc5-syzkaller-00297-gf2e367d6ad3b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
RIP: 0010:isd200_scsi_to_ata drivers/usb/storage/isd200.c:1318 [inline]
RIP: 0010:isd200_ata_command+0x776/0x2380 drivers/usb/storage/isd200.c:1529
Code: 62 fa 49 8d 7c 24 0c 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 00 18 00 00 41 0f b7 5c 24 0c 48 8b 7c 24 18 89 f8 31 d2 <f7> f3 41 89 d0 49 83 c4 06 4c 89 e0 48 c1 e8 03 42 0f b6 04 28 84
RSP: 0018:ffffc900043ffc00 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888023230000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043ffd50 R08: ffffffff873161fd R09: ffffffff87315c95
R10: 0000000000000008 R11: ffff888023230000 R12: ffff88807f7a0000
R13: dffffc0000000000 R14: ffff888021da1000 R15: ffff88807c10a110
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563828985bd8 CR3: 000000002e0cc000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_stor_control_thread+0x4b1/0xa50 drivers/usb/storage/usb.c:368
 kthread+0x2ef/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:isd200_scsi_to_ata drivers/usb/storage/isd200.c:1318 [inline]
RIP: 0010:isd200_ata_command+0x776/0x2380 drivers/usb/storage/isd200.c:1529
Code: 62 fa 49 8d 7c 24 0c 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 00 18 00 00 41 0f b7 5c 24 0c 48 8b 7c 24 18 89 f8 31 d2 <f7> f3 41 89 d0 49 83 c4 06 4c 89 e0 48 c1 e8 03 42 0f b6 04 28 84
RSP: 0018:ffffc900043ffc00 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888023230000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043ffd50 R08: ffffffff873161fd R09: ffffffff87315c95
R10: 0000000000000008 R11: ffff888023230000 R12: ffff88807f7a0000
R13: dffffc0000000000 R14: ffff888021da1000 R15: ffff88807c10a110
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563828985bd8 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	fa                   	cli
   1:	49 8d 7c 24 0c       	lea    0xc(%r12),%rdi
   6:	48 89 f8             	mov    %rdi,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax
  12:	84 c0                	test   %al,%al
  14:	0f 85 00 18 00 00    	jne    0x181a
  1a:	41 0f b7 5c 24 0c    	movzwl 0xc(%r12),%ebx
  20:	48 8b 7c 24 18       	mov    0x18(%rsp),%rdi
  25:	89 f8                	mov    %edi,%eax
  27:	31 d2                	xor    %edx,%edx
* 29:	f7 f3                	div    %ebx <-- trapping instruction
  2b:	41 89 d0             	mov    %edx,%r8d
  2e:	49 83 c4 06          	add    $0x6,%r12
  32:	4c 89 e0             	mov    %r12,%rax
  35:	48 c1 e8 03          	shr    $0x3,%rax
  39:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax
  3e:	84                   	.byte 0x84

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/25 05:31 upstream f2e367d6ad3b 8d446f15 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/03/01 18:10 upstream 87adedeba51a 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/03/01 12:26 upstream 87adedeba51a 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/29 11:04 upstream e326df53af00 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/28 11:19 upstream cf1182944c7c d367cbe5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/27 04:27 upstream d206a76d7d27 edd6a5e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/27 04:23 upstream d206a76d7d27 edd6a5e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/27 03:43 upstream d206a76d7d27 edd6a5e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/26 07:34 upstream 70ff1fe626a1 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
2024/02/25 05:09 upstream f2e367d6ad3b 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce divide error in isd200_ata_command
* Struck through repros no longer work on HEAD.