WARNING in usbhid_raw_request/usb_submit_urb (2)

Status: closed as invalid on 2020/01/10 16:46
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+10e5f68920f13587ab12@syzkaller.appspotmail.com
First crash: 2469d, last: 2389d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
WARNING in usbhid_raw_request/usb_submit_urb (2) 9 (16) 2020/01/10 16:46
Reminder: 45 active syzbot reports in usb subsystem 1 (1) 2019/11/19 04:27
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in usbhid_raw_request/usb_submit_urb usb -1 syz 37 2484d 2554d 0/29 closed as dup on 2019/08/21 14:08
upstream WARNING in usbhid_raw_request/usb_submit_urb (3) usb -1 syz 18 2279d 2385d 15/29 fixed on 2020/07/17 17:58
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2020/01/08 18:18 17m stern@rowland.harvard.edu patch https://github.com/google/kasan.git ecdf2214 OK
2020/01/07 21:25 16m stern@rowland.harvard.edu patch https://github.com/google/kasan.git ecdf2214 report log
2020/01/07 20:43 17m stern@rowland.harvard.edu patch https://github.com/google/kasan.git ecdf2214 report log
2020/01/07 19:09 17m stern@rowland.harvard.edu patch https://github.com/google/kasan.git ecdf2214 OK
2020/01/03 16:35 17m stern@rowland.harvard.edu patch https://github.com/google/kasan.git ecdf2214 OK

Sample crash report:
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 2 != type 2
WARNING: CPU: 0 PID: 2388 at drivers/usb/core/urb.c:478 usb_submit_urb+0x1188/0x13b0 drivers/usb/core/urb.c:478
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 2388 Comm: syz-executor.0 Not tainted 5.5.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xef/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:221
 __warn.cold+0x2f/0x30 kernel/panic.c:582
 report_bug+0x27b/0x2f0 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 fixup_bug arch/x86/kernel/traps.c:169 [inline]
 do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:267
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:usb_submit_urb+0x1188/0x13b0 drivers/usb/core/urb.c:478
Code: 4d 85 ed 74 2c e8 78 90 e7 fd 4c 89 f7 e8 70 2c 1d ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 80 59 15 86 e8 20 ad bc fd <0f> 0b e9 20 f4 ff ff e8 4c 90 e7 fd 4c 89 f2 48 b8 00 00 00 00 00
RSP: 0018:ffff8881cf197b30 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81295dad RDI: ffffed1039e32f58
RBP: 0000000000000000 R08: ffff8881cfe6b100 R09: fffffbfff11f1ebe
R10: fffffbfff11f1ebd R11: ffffffff88f8f5ef R12: 0000000000000002
R13: ffff8881da370d80 R14: ffff8881d01e90a0 R15: ffff8881cfe18e00
 usb_start_wait_urb+0x108/0x2b0 drivers/usb/core/message.c:57
 usb_internal_control_msg drivers/usb/core/message.c:101 [inline]
 usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:152
 usbhid_set_raw_report drivers/hid/usbhid/hid-core.c:917 [inline]
 usbhid_raw_request+0x21f/0x640 drivers/hid/usbhid/hid-core.c:1265
 hid_hw_raw_request include/linux/hid.h:1079 [inline]
 hidraw_send_report+0x296/0x500 drivers/hid/hidraw.c:151
 hidraw_write+0x34/0x50 drivers/hid/hidraw.c:164
 __vfs_write+0x76/0x100 fs/read_write.c:494
 vfs_write+0x262/0x5c0 fs/read_write.c:558
 ksys_write+0x127/0x250 fs/read_write.c:611
 do_syscall_64+0xb6/0x5c0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a919
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f181187dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919
RDX: 0000000000000002 RSI: 0000000020000040 RDI: 0000000000000007
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f181187e6d4
R13: 00000000004cbe90 R14: 00000000004e5ce0 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/30 03:52 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 af6b8ef8 .config console log report syz ci2-upstream-usb
2020/01/10 10:37 https://github.com/google/kasan.git usb-fuzzer ae1794106b94 4de4e9f0 .config console log report ci2-upstream-usb
2020/01/07 03:22 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 53430d97 .config console log report ci2-upstream-usb
2020/01/05 10:24 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 68256974 .config console log report ci2-upstream-usb
2020/01/05 10:00 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 68256974 .config console log report ci2-upstream-usb
2020/01/05 00:34 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 68256974 .config console log report ci2-upstream-usb
2020/01/04 15:13 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 68256974 .config console log report ci2-upstream-usb
2020/01/03 20:02 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 9dcc1191 .config console log report ci2-upstream-usb
2020/01/01 05:01 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 25a0186e .config console log report ci2-upstream-usb
2019/12/30 01:50 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 af6b8ef8 .config console log report ci2-upstream-usb
2019/12/29 23:01 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 af6b8ef8 .config console log report ci2-upstream-usb
2019/12/26 23:56 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 be5c2c81 .config console log report ci2-upstream-usb
2019/12/26 23:16 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 be5c2c81 .config console log report ci2-upstream-usb
2019/12/24 18:48 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 be5c2c81 .config console log report ci2-upstream-usb
2019/12/23 20:24 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 be5c2c81 .config console log report ci2-upstream-usb
2019/12/21 01:06 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 34011c05 .config console log report ci2-upstream-usb
2019/12/20 18:34 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 34011c05 .config console log report ci2-upstream-usb
2019/12/17 16:47 https://github.com/google/kasan.git usb-fuzzer 4cc037ecf2cb 1af3875f .config console log report ci2-upstream-usb
2019/12/15 22:41 https://github.com/google/kasan.git usb-fuzzer 4cc037ecf2cb eef6e580 .config console log report ci2-upstream-usb
2019/12/13 22:24 https://github.com/google/kasan.git usb-fuzzer 4cc037ecf2cb a5c1ab05 .config console log report ci2-upstream-usb
2019/12/11 17:42 https://github.com/google/kasan.git usb-fuzzer a38cc9afab8a 0d368675 .config console log report ci2-upstream-usb
2019/11/24 16:32 https://github.com/google/kasan.git usb-fuzzer da06441bb485 598ca6c8 .config console log report ci2-upstream-usb
2019/11/12 12:06 https://github.com/google/kasan.git usb-fuzzer 3183c03757f8 048f2d49 .config console log report ci2-upstream-usb
2019/11/03 00:17 https://github.com/google/kasan.git usb-fuzzer ff6409a6ec35 d603afc9 .config console log report ci2-upstream-usb
2019/10/30 13:19 https://github.com/google/kasan.git usb-fuzzer ff6409a6ec35 5ea87a66 .config console log report ci2-upstream-usb
2019/10/25 05:39 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 d01bb02a .config console log report ci2-upstream-usb
2019/10/22 08:29 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 c59a7cd8 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.