Hello,
syzbot found the following issue on:
HEAD commit: 168ae5a7 Merge 5.9-rc8 into usb-next
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=1073b7ff900000
kernel config: https://syzkaller.appspot.com/x/.config?x=5429f3643ebc37a
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
------------[ cut here ]------------
usb 4-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 10570 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 10570 Comm: kworker/0:9 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x107/0x16e lib/dump_stack.c:118
panic+0x2cb/0x702 kernel/panic.c:231
__warn.cold+0x20/0x44 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Code: 84 04 03 00 00 e8 3e 98 c6 fd 4c 89 ef e8 66 b6 12 ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 b3 5d 86 e8 d0 ba 9a fd <0f> 0b e9 c6 f8 ff ff e8 12 98 c6 fd 48 81 c5 40 06 00 00 e9 f2 f7
RSP: 0018:ffff8881ab1bf808 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8881ca76cbc0 RSI: ffffffff8129efa3 RDI: ffffed1035637ef3
RBP: ffff8881a27dfc00 R08: 0000000000000001 R09: ffff8881db22f50f
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff8881d8fab0a0 R14: ffff8881c7299168 R15: ffff8881cc24a700
hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
hif_usb_send+0x4c1/0xcf0 drivers/net/wireless/ath/ath9k/hif_usb.c:470
htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
htc_connect_service+0x705/0xa00 drivers/net/wireless/ath/ath9k/htc_hst.c:275
ath9k_wmi_connect+0xc9/0x190 drivers/net/wireless/ath/ath9k/wmi.c:268
ath9k_init_htc_services.constprop.0+0xb3/0x640 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
ath9k_htc_probe_device+0x25f/0x1e10 drivers/net/wireless/ath/ath9k/htc_drv_init.c:962
ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1220
request_firmware_work_func+0x126/0x250 drivers/base/firmware_loader/main.c:1006
process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
kthread+0x392/0x470 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot has found a reproducer for the following issue on:
HEAD commit: 6c8cf369 usb: typec: Add QCOM PMIC typec detection driver
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=14ea791b900000
kernel config: https://syzkaller.appspot.com/x/.config?x=df3bb4023c36d114
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1087bfe7900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1327b010500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 1 PID: 72 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 72 Comm: kworker/1:2 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x107/0x16e lib/dump_stack.c:118
panic+0x2cb/0x702 kernel/panic.c:231
__warn.cold+0x20/0x44 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Code: 84 04 03 00 00 e8 3e 98 c6 fd 4c 89 ef e8 66 b6 12 ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 b3 5d 86 e8 d0 ba 9a fd <0f> 0b e9 c6 f8 ff ff e8 12 98 c6 fd 48 81 c5 40 06 00 00 e9 f2 f7
RSP: 0018:ffff8881d4757808 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8881d4ffe500 RSI: ffffffff8129efa3 RDI: ffffed103a8eaef3
RBP: ffff8881cde7d800 R08: 0000000000000001 R09: ffff8881db32f50f
R10: 0000000000000000 R11: 0000000000003754 R12: 0000000000000001
R13: ffff8881d1edd0a0 R14: ffff8881d9bc9320 R15: ffff8881d9ba8600
hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
hif_usb_send+0x4c1/0xcf0 drivers/net/wireless/ath/ath9k/hif_usb.c:470
htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
htc_connect_service+0x705/0xa00 drivers/net/wireless/ath/ath9k/htc_hst.c:275
ath9k_wmi_connect+0xc9/0x190 drivers/net/wireless/ath/ath9k/wmi.c:268
ath9k_init_htc_services.constprop.0+0xb3/0x640 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
ath9k_htc_probe_device+0x25f/0x1e10 drivers/net/wireless/ath/ath9k/htc_drv_init.c:962
ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1220
request_firmware_work_func+0x126/0x250 drivers/base/firmware_loader/main.c:1006
process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
kthread+0x392/0x470 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Kernel Offset: disabled
Rebooting in 86400 seconds..
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
drivers/net/wireless/ath/ath9k/hif_usb.c:1319:7: error: implicit declaration of function 'usb_find_bulk_in'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1319:24: error: implicit declaration of function 'endpoint' [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1321:7: error: implicit declaration of function 'usb_find_bulk_out'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1322:46: error: expected ')' before 'return'
drivers/net/wireless/ath/ath9k/hif_usb.c:1357:13: error: expected ')' before '}' token
drivers/net/wireless/ath/ath9k/hif_usb.c:1358:1: error: expected expression before '}' token
Tested on:
commit: 549738f1 Linux 5.9-rc8
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.9-rc8
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=1200b51b900000
On Fri, Oct 09, 2020 at 02:55:08PM -0700, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
>
> drivers/net/wireless/ath/ath9k/hif_usb.c:1319:7: error: implicit declaration of function 'usb_find_bulk_in'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
Let's try again, using a different repository.
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.9-rc8
Index: usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1307,6 +1307,20 @@ static int ath9k_hif_usb_probe(struct us
struct usb_device *udev = interface_to_usbdev(interface);
struct hif_device_usb *hif_dev;
int ret = 0;
+ struct usb_host_interface *alt;
+ struct usb_endpoint_descriptor *epd;
+
+ /* Verify the expected endpoints are present */
+ alt = interface->cur_altsetting;
+ if (!usb_find_int_in_endpoint(alt, &epd) ||
+ usb_endpoint_num(epd) != USB_REG_IN_PIPE ||
+ !usb_find_int_out_endpoint(alt, &epd) ||
+ usb_endpoint_num(epd) != USB_REG_OUT_PIPE ||
+ !usb_find_bulk_in(endpoint(alt, &epd) ||
+ usb_endpoint_num(epd) != USB_WLAN_RX_PIPE ||
+ !usb_find_bulk_out(endpoint(alt, &epd) ||
+ usb_endpoint_num(epd) != USB_WLAN_TX_PIPE)
+ return -ENODEV;
if (id->driver_info == STORAGE_DEVICE)
return send_eject_command(interface);
syzbot suspects this issue was fixed by commit:
commit 16ef02bad239f11f322df8425d302be62f0443ce
Author: Fedor Pchelkin <[email protected]>
Date: Sat Oct 8 21:15:32 2022 +0000
wifi: ath9k: verify the expected usb_endpoints are present
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1162ac2d480000
start commit: 274a2eebf80c Merge tag 'for_linus' of git://git.kernel.org..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=f267ed4fb258122a
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1343a8eb080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17dc40eb080000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: wifi: ath9k: verify the expected usb_endpoints are present
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
On Mon, 30 Jan 2023 at 07:50, syzbot
<[email protected]> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit 16ef02bad239f11f322df8425d302be62f0443ce
> Author: Fedor Pchelkin <[email protected]>
> Date: Sat Oct 8 21:15:32 2022 +0000
>
> wifi: ath9k: verify the expected usb_endpoints are present
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1162ac2d480000
> start commit: 274a2eebf80c Merge tag 'for_linus' of git://git.kernel.org..
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/x/.config?x=f267ed4fb258122a
> dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1343a8eb080000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17dc40eb080000
>
> If the result looks correct, please mark the issue as fixed by replying with:
>
> #syz fix: wifi: ath9k: verify the expected usb_endpoints are present
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Looks reasonable, let's close the bug:
#syz fix: wifi: ath9k: verify the expected usb_endpoints are present