WARNING in snd_usbmidi_input_start/usb_submit_urb

Status: fixed on 2020/09/16 22:51
Subsystems: usb sound
[Documentation on labels]
Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com
Fix commit: 9b7e5208a941 ALSA: usb-audio: Fix race against the error recovery URB submission
First crash: 2243d, last: 2196d
Cause bisection: introduced by (bisect log) :
commit f2c2e717642c66f7fe7e5dd69b2e8ff5849f4d10
Author: Andrey Konovalov <andreyknvl@google.com>
Date: Mon Feb 24 16:13:03 2020 +0000

  usb: gadget: add raw-gadget interface

Crash: WARNING in snd_usbmidi_submit_urb/usb_submit_urb (log)
Repro: syz .config
  
▶ ▼ Discussions (7)
Title Replies (including bot) Last reply
[PATCH 4.19 000/133] 4.19.134-rc1 review 165 (165) 2020/08/13 12:07
[PATCH 5.7 000/244] 5.7.10-rc1 review 256 (256) 2020/07/27 17:31
[PATCH 5.4 000/215] 5.4.53-rc1 review 222 (222) 2020/07/21 16:38
[PATCH 4.14 000/125] 4.14.189-rc1 review 130 (130) 2020/07/21 16:37
[PATCH 4.9 00/86] 4.9.231-rc1 review 92 (92) 2020/07/21 16:36
[PATCH 4.4 00/58] 4.4.231-rc1 review 64 (64) 2020/07/21 16:36
WARNING in snd_usbmidi_input_start/usb_submit_urb 0 (1) 2020/06/05 14:13

Sample crash report:
------------[ cut here ]------------
URB 000000000a192c49 submitted while active
WARNING: CPU: 1 PID: 9840 at drivers/usb/core/urb.c:363 usb_submit_urb+0x112f/0x1320 drivers/usb/core/urb.c:363
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 9840 Comm: syz-executor245 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:231
 __warn.cold+0x20/0x45 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x38/0x90 arch/x86/kernel/traps.c:235
 exc_invalid_op+0x13/0x40 arch/x86/kernel/traps.c:255
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:542
RIP: 0010:usb_submit_urb+0x112f/0x1320 drivers/usb/core/urb.c:363
Code: 89 de e8 24 01 5f fc 84 db 0f 85 3d fa ff ff e8 d7 04 5f fc 4c 89 fe 48 c7 c7 c0 04 cd 88 c6 05 3b 37 95 05 01 e8 23 45 30 fc <0f> 0b e9 1b fa ff ff c7 44 24 14 01 00 00 00 e9 3e f5 ff ff 41 bd
RSP: 0018:ffffc9000d82f2a0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888095e140c0 RSI: ffffffff815d4f87 RDI: fffff52001b05e46
RBP: ffff888097499c00 R08: 0000000000000001 R09: ffff8880ae7318e7
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 00000000fffffff0 R14: ffff88809bb49e00 R15: ffff88809bb49e00
 snd_usbmidi_submit_urb sound/usb/midi.c:194 [inline]
 snd_usbmidi_input_start_ep sound/usb/midi.c:2313 [inline]
 snd_usbmidi_input_start.part.0+0x101/0x200 sound/usb/midi.c:2329
 snd_usbmidi_input_start sound/usb/midi.c:1119 [inline]
 substream_open.isra.0+0x82c/0xc10 sound/usb/midi.c:1119
 open_substream+0x42e/0x880 sound/core/rawmidi.c:299
 rawmidi_open_priv+0x519/0x6f0 sound/core/rawmidi.c:342
 snd_rawmidi_kernel_open+0x1b5/0x270 sound/core/rawmidi.c:382
 midisynth_subscribe+0xf2/0x350 sound/core/seq/seq_midi.c:170
 subscribe_port sound/core/seq/seq_ports.c:412 [inline]
 check_and_subscribe_port+0x89a/0xb80 sound/core/seq/seq_ports.c:495
 snd_seq_port_connect+0x2e6/0x520 sound/core/seq/seq_ports.c:564
 snd_seq_ioctl_subscribe_port+0x1fc/0x400 sound/core/seq/seq_clientmgr.c:1484
 snd_seq_kernel_client_ctl+0xeb/0x130 sound/core/seq/seq_clientmgr.c:2353
 snd_seq_oss_midi_open+0x466/0x6e0 sound/core/seq/oss/seq_oss_midi.c:364
 snd_seq_oss_synth_setup_midi+0x123/0x520 sound/core/seq/oss/seq_oss_synth.c:269
 snd_seq_oss_open+0x87e/0xa10 sound/core/seq/oss/seq_oss_init.c:261
 odev_open+0x6c/0x90 sound/core/seq/oss/seq_oss.c:125
 soundcore_open+0x445/0x600 sound/sound_core.c:593
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x501/0x1290 fs/open.c:828
 do_open fs/namei.c:3243 [inline]
 path_openat+0x1bb9/0x2750 fs/namei.c:3360
 do_filp_open+0x17e/0x3c0 fs/namei.c:3387
 do_sys_openat2+0x16f/0x3b0 fs/open.c:1179
 do_sys_open fs/open.c:1195 [inline]
 __do_sys_openat fs/open.c:1209 [inline]
 __se_sys_openat fs/open.c:1204 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1204
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x445799
Code: Bad RIP value.
RSP: 002b:00007fffd386d578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000445799
RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffffffffffffff9c
RBP: 000000000009f3c6 R08: 0000000000000000 R09: 00000000004002e0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402890
R13: 0000000000402920 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (231):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/14 09:11 upstream 0dc589da873b ce4c95b3 .config console log report syz C ci-upstream-kasan-gce-root
2020/07/14 06:53 upstream 0dc589da873b ce4c95b3 .config console log report syz C ci-upstream-kasan-gce
2020/06/03 07:27 upstream 1ee08de1e234 f3ba1b5b .config console log report syz C ci-upstream-kasan-gce-smack-root
2020/07/14 09:41 upstream 0dc589da873b ce4c95b3 .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/06/01 14:23 upstream 3d77e6a8804a a0331e89 .config console log report syz ci-upstream-kasan-gce-smack-root
2020/07/14 13:26 upstream 0dc589da873b ce4c95b3 .config console log report syz ci-upstream-kasan-gce-386
2020/07/18 09:51 upstream 8882572675c1 9c812472 .config console log report ci-upstream-kasan-gce
2020/07/18 05:47 upstream 8882572675c1 9c812472 .config console log report ci-upstream-kasan-gce
2020/07/18 01:33 upstream 8882572675c1 9c812472 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/17 15:48 upstream 8882572675c1 9c812472 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/17 13:56 upstream 8882572675c1 9c812472 .config console log report ci-upstream-kasan-gce
2020/07/17 10:04 upstream f8456690ba8e 54b3c45e .config console log report ci-upstream-kasan-gce
2020/07/17 06:45 upstream f8456690ba8e 54b3c45e .config console log report ci-upstream-kasan-gce
2020/07/17 01:43 upstream f8456690ba8e 54b3c45e .config console log report ci-upstream-kasan-gce-smack-root
2020/07/16 23:07 upstream f8456690ba8e 54b3c45e .config console log report ci-upstream-kasan-gce-root
2020/07/16 21:35 upstream f8456690ba8e f3bec699 .config console log report ci-upstream-kasan-gce
2020/07/16 13:56 upstream 994e99a96c9b f3bec699 .config console log report ci-upstream-kasan-gce-root
2020/07/16 12:13 upstream 994e99a96c9b f3bec699 .config console log report ci-upstream-kasan-gce
2020/07/16 06:17 upstream 994e99a96c9b f3bec699 .config console log report ci-upstream-kasan-gce
2020/07/15 20:34 upstream e9919e11e219 f3bec699 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/15 08:36 upstream e9919e11e219 609fb517 .config console log report ci-upstream-kasan-gce
2020/07/15 00:20 upstream e9919e11e219 609fb517 .config console log report ci-upstream-kasan-gce
2020/07/14 17:46 upstream 0dc589da873b ce4c95b3 .config console log report ci-upstream-kasan-gce
2020/07/14 12:42 upstream 0dc589da873b ce4c95b3 .config console log report ci-upstream-kasan-gce
2020/07/14 05:57 upstream 0dc589da873b ce4c95b3 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/14 03:39 upstream 11ba468877bb f90ec899 .config console log report ci-upstream-kasan-gce
2020/07/13 23:56 upstream 11ba468877bb f90ec899 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/13 20:51 upstream 11ba468877bb f90ec899 .config console log report ci-upstream-kasan-gce-root
2020/07/13 08:12 upstream 4437dd6e8f71 9ebcc5b1 .config console log report ci-upstream-kasan-gce-smack-root
2020/07/13 06:46 upstream 4437dd6e8f71 9ebcc5b1 .config console log report ci-upstream-kasan-gce
2020/07/13 05:23 upstream 4437dd6e8f71 9ebcc5b1 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/13 02:34 upstream 4437dd6e8f71 9ebcc5b1 .config console log report ci-upstream-kasan-gce
2020/07/12 23:36 upstream 4437dd6e8f71 9ebcc5b1 .config console log report ci-upstream-kasan-gce
2020/07/12 21:55 upstream 4437dd6e8f71 115e1930 .config console log report ci-upstream-kasan-gce
2020/07/12 19:50 upstream 0aea6d5c5be3 115e1930 .config console log report ci-upstream-kasan-gce
2020/07/12 15:17 upstream 0aea6d5c5be3 115e1930 .config console log report ci-upstream-kasan-gce
2020/07/12 07:17 upstream 0aea6d5c5be3 115e1930 .config console log report ci-upstream-kasan-gce
2020/07/11 19:06 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce-smack-root
2020/07/11 11:47 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce-smack-root
2020/07/11 09:42 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/11 09:35 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce-smack-root
2020/07/11 07:00 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce
2020/07/11 02:14 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce-selinux-root
2020/07/10 12:58 upstream 42f82040ee66 edf162e8 .config console log report ci-upstream-kasan-gce-root
2020/06/01 14:07 upstream 3d77e6a8804a a0331e89 .config console log report ci-upstream-kasan-gce-smack-root
2020/07/18 00:16 upstream 8882572675c1 9c812472 .config console log report ci-upstream-kasan-gce-386
2020/07/14 21:29 upstream 0dc589da873b 609fb517 .config console log report ci-upstream-kasan-gce-386
2020/07/13 13:01 upstream 11ba468877bb f90ec899 .config console log report ci-upstream-kasan-gce-386
2020/07/10 23:14 upstream a581387e415b 18d18b59 .config console log report ci-upstream-kasan-gce-386
2020/07/13 05:41 linux-next d31958b30ea3 9ebcc5b1 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/07/12 17:49 linux-next d31958b30ea3 115e1930 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/07/12 00:39 linux-next d31958b30ea3 18d18b59 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/07/11 23:31 linux-next d31958b30ea3 18d18b59 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.