| Message ID | 20211022063238.21800-1-bernard@vivo.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net/usb: potential fix divide error: 0000 | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Single patches do not need cover letters |
| netdev/fixes_present | success | Fixes tag not required for -next series |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Guessed tree name to be net-next |
| netdev/subject_prefix | warning | Target tree name not specified in the subject |
| netdev/cc_maintainers | success | CCed 5 of 5 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Signed-off-by tag matches author and committer |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | No Fixes tag |
| netdev/checkpatch | warning | WARNING: Possible repeated word: 'Google' |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | No static functions without inline keyword in header files |
On Thu, Oct 21, 2021 at 11:32:38PM -0700, Bernard Zhao wrote: > This patch try to fix divide error in drivers/net/usb/usbnet.c. > This bug is reported by google syzbot, > divide error: 0000 [#1] SMP KASAN > CPU: 0 PID: 1315 Comm: kworker/0:6 Not tainted 5.15.0-rc6-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Workqueue: mld mld_ifc_work > RIP: 0010:usbnet_start_xmit+0x3f1/0x1f70 drivers/net/usb/usbnet.c:1404 > Call Trace: > __netdev_start_xmit include/linux/netdevice.h:4988 [inline] > netdev_start_xmit include/linux/netdevice.h:5002 [inline] > xmit_one net/core/dev.c:3576 [inline] > dev_hard_start_xmit+0x1df/0x890 net/core/dev.c:3592 > sch_direct_xmit+0x25b/0x790 net/sched/sch_generic.c:342 > __dev_xmit_skb net/core/dev.c:3803 [inline] > __dev_queue_xmit+0xf25/0x2d40 net/core/dev.c:4170 > neigh_resolve_output net/core/neighbour.c:1492 [inline] > neigh_resolve_output+0x50e/0x820 net/core/neighbour.c:1472 > neigh_output include/net/neighbour.h:510 [inline] > ip6_finish_output2+0xdbe/0x1b20 net/ipv6/ip6_output.c:126 > __ip6_finish_output.part.0+0x387/0xbb0 net/ipv6/ip6_output.c:191 > __ip6_finish_output include/linux/skbuff.h:982 [inline] > ip6_finish_output net/ipv6/ip6_output.c:201 [inline] > NF_HOOK_COND include/linux/netfilter.h:296 [inline] > ip6_output+0x3d2/0x810 net/ipv6/ip6_output.c:224 > dst_output include/net/dst.h:450 [inline] > NF_HOOK include/linux/netfilter.h:307 [inline] > NF_HOOK include/linux/netfilt > the link is: > https://syzkaller.appspot.com/bug?id=e829c15b6c30d4680cf3198f72b0414adc907911 > > Signed-off-by: Bernard Zhao <bernard@vivo.com> > --- > drivers/net/usb/usbnet.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c > index 840c1c2ab16a..ada1b8242498 100644 > --- a/drivers/net/usb/usbnet.c > +++ b/drivers/net/usb/usbnet.c > @@ -397,7 +397,7 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu) > int old_rx_urb_size = dev->rx_urb_size; > > // no second zero-length packet read wanted after mtu-sized packets > - if ((ll_mtu % dev->maxpacket) == 0) > + if (dev->maxpacket && ((ll_mtu % dev->maxpacket) == 0)) > return -EDOM; > net->mtu = new_mtu; > > @@ -1401,7 +1401,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, > * handling ZLP/short packets, so cdc_ncm driver will make short > * packet itself if needed. > */ > - if (length % dev->maxpacket == 0) { > + if (dev->maxpacket && (length % dev->maxpacket == 0)) { > if (!(info->flags & FLAG_SEND_ZLP)) { > if (!(info->flags & FLAG_MULTI_PACKET)) { > length++; This was fixed properly yesterday: https://lore.kernel.org/r/20211021122944.21816-1-oneukum@suse.com Johan
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 840c1c2ab16a..ada1b8242498 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -397,7 +397,7 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu) int old_rx_urb_size = dev->rx_urb_size; // no second zero-length packet read wanted after mtu-sized packets - if ((ll_mtu % dev->maxpacket) == 0) + if (dev->maxpacket && ((ll_mtu % dev->maxpacket) == 0)) return -EDOM; net->mtu = new_mtu; @@ -1401,7 +1401,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, * handling ZLP/short packets, so cdc_ncm driver will make short * packet itself if needed. */ - if (length % dev->maxpacket == 0) { + if (dev->maxpacket && (length % dev->maxpacket == 0)) { if (!(info->flags & FLAG_SEND_ZLP)) { if (!(info->flags & FLAG_MULTI_PACKET)) { length++;
This patch try to fix divide error in drivers/net/usb/usbnet.c. This bug is reported by google syzbot, divide error: 0000 [#1] SMP KASAN CPU: 0 PID: 1315 Comm: kworker/0:6 Not tainted 5.15.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: mld mld_ifc_work RIP: 0010:usbnet_start_xmit+0x3f1/0x1f70 drivers/net/usb/usbnet.c:1404 Call Trace: __netdev_start_xmit include/linux/netdevice.h:4988 [inline] netdev_start_xmit include/linux/netdevice.h:5002 [inline] xmit_one net/core/dev.c:3576 [inline] dev_hard_start_xmit+0x1df/0x890 net/core/dev.c:3592 sch_direct_xmit+0x25b/0x790 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3803 [inline] __dev_queue_xmit+0xf25/0x2d40 net/core/dev.c:4170 neigh_resolve_output net/core/neighbour.c:1492 [inline] neigh_resolve_output+0x50e/0x820 net/core/neighbour.c:1472 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0xdbe/0x1b20 net/ipv6/ip6_output.c:126 __ip6_finish_output.part.0+0x387/0xbb0 net/ipv6/ip6_output.c:191 __ip6_finish_output include/linux/skbuff.h:982 [inline] ip6_finish_output net/ipv6/ip6_output.c:201 [inline] NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x3d2/0x810 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilt the link is: https://syzkaller.appspot.com/bug?id=e829c15b6c30d4680cf3198f72b0414adc907911 Signed-off-by: Bernard Zhao <bernard@vivo.com> --- drivers/net/usb/usbnet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)