Probably a bug in the xpad driver?

Asus C302C (code name "cave") should be on kernel 3.18:

https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices

Because we don't update Chrome OS devices to newer kernels, updating the OS is unlikely to help. Kernel 3.18 had support for the original Xbox One gamepads that lacked Bluetooth support, but Xbox One S hadn't come out yet. Support for Xbox One S gamepads was added in 4.10:

https://github.com/torvalds/linux/commit/599b8c09d974d6e4d85a8f7bc8ed7442977866a8

There's a commit (first released in 4.7) with a suspiciously relevant title:

"Input: xpad - fix oops when attaching an unknown Xbox One gamepad"
https://github.com/torvalds/linux/commit/c7f1429389ec1aa25e042bb13451385fbb596f8c

Probably we will need to backport this change to fix the crash.

Marking this Bug-Security since this bug describes a kernel panic caused by connecting a USB device.

A panic isn't automatically a security bug. Is it panicking on an invalid memory access or just on a failed assertion?

I don't have a suitable ChromeOS device to repro this with so I don't know. Looking at the "fix oops" kernel change, it is likely accessing an invalid (null?) memory address.

> Xbox One controllers have multiple interfaces which all have the
same class, subclass, and protocol. One of the these interfaces
has only a single endpoint. When Xpad attempts to bind to this
interface, it causes an oops when trying initialize the output URB
by trying to access the second endpoint's descriptor.

Sorry I'm confused. You're the original reporter, right? So where did you witness this bug?

This was reported by a dogfooder in a dogfood mailing list, I filed the bug on their behalf.

I can try to track down the dogfooder or find a suitable device if we need more info to triage this. I don't think we need a "cave" device since any Chrome OS device on 3.18 should have this bug (if it's in fact the same bug as the xpad kernel oops).

Without a crash report we can't triage this and certainly can't say that this is a security bug.

Okay, I'll try to get a repro and upload a crash report.

I can reproduce this with my HP Chromebook 14 (chell). The crash ID is 6c9a6f2ba2df7a7e.

 Issue 803722  has been merged into this issue.

Marking this as ready for triage now that we have a crash log for this issue.

We don't normally consider crashes security bugs.

Reilly, who's a good owner for this?

Maybe adlr@ or dtor@? I don't know who owns the gamepad side of input on the Chrome OS kernel team or if there is a specific team that handles backporting drivers.

Alright let's send to Andrew for triaging.

Removing Blink>GamepadAPI component to get this out of our triage queue. Next action is on the kernel side.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/2079cc08eae2eb726860208155cbbedb4e6bf066

commit 2079cc08eae2eb726860208155cbbedb4e6bf066
Author: Cameron Gutman <aicommander@gmail.com>
Date: Sun Oct 14 08:09:42 2018

BACKPORT: Input: xpad - fix oops when attaching an unknown Xbox One gamepad

Xbox One controllers have multiple interfaces which all have the
same class, subclass, and protocol. One of the these interfaces
has only a single endpoint. When Xpad attempts to bind to this
interface, it causes an oops when trying initialize the output URB
by trying to access the second endpoint's descriptor.

This situation was avoided for known Xbox One devices by checking
the XTYPE constant associated with the VID and PID tuple. However,
this breaks when new or previously unknown Xbox One controllers
are attached to the system.

This change addresses the problem by deriving the XTYPE for Xbox
One controllers based on the interface protocol before checking
the interface number.

Fixes: 1a48ff81b391 ("Input: xpad - add support for Xbox One controllers")
Signed-off-by: Cameron Gutman <aicommander@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Conflicts:
	drivers/input/joystick/xpad.c

- context changes.

BUG= chromium:876128 
TEST=Build and boot

(cherry picked from commit c7f1429389ec1aa25e042bb13451385fbb596f8c)
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Change-Id: Id780efd3d7bb392d4b00d37dbcf48f4f7afe5954
Reviewed-on: https://chromium-review.googlesource.com/1279332
Reviewed-by: Guenter Roeck <groeck@chromium.org>

[modify] https://crrev.com/2079cc08eae2eb726860208155cbbedb4e6bf066/drivers/input/joystick/xpad.c

Kernels 3.14 and older are unaffected and 4.4+ got the fix through stable merges.