syzbot


WARNING in hid_submit_ctrl/usb_submit_urb

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com
Fix commit: 0a824efdb724 HID: usbhid: Fix warning caused by 0-length input reports
First crash: 353d, last: 300d

Cause bisection: introduced by (bisect log) :
commit 5cc59c418fde9d02859996707b9d5dfd2941c50b
Author: Alan Stern <stern@rowland.harvard.edu>
Date: Sat May 22 02:16:23 2021 +0000

  USB: core: WARN if pipe direction != setup packet direction

Crash: WARNING in hid_submit_ctrl/usb_submit_urb (log)
Repro: C syz .config
Patch testing requests:
Created Duration User Patch Repo Result
2021/08/19 19:53 15m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 794c7931a242 OK
2021/08/19 15:26 9m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 794c7931a242 report log
2021/08/18 18:49 10m stern@rowland.harvard.edu patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 794c7931a242 report log

Sample crash report:
------------[ cut here ]------------
usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType a1
WARNING: CPU: 1 PID: 8430 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410
Modules linked in:
CPU: 1 PID: 8430 Comm: syz-executor131 Not tainted 5.14.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410
Code: 4c 24 38 8a 04 01 84 c0 0f 85 ad 05 00 00 45 0f b6 06 48 c7 c7 c0 dd e2 8a 48 8b 74 24 20 4c 89 e2 89 d9 31 c0 e8 9b e0 7f fb <0f> 0b e9 0b f0 ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a8 ed ff
RSP: 0018:ffffc9000178faf8 EFLAGS: 00010046
RAX: 157bf76a6417e200 RBX: 0000000080000280 RCX: ffff888031753880
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff81664f72 R09: ffffed10173a3f2c
R10: ffffed10173a3f2c R11: 0000000000000000 R12: ffff888021afd348
R13: ffff88801fbbf400 R14: ffff888019695be0 R15: ffff88801eac10a8
FS:  0000000001f8f300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e5b32ad160 CR3: 0000000012f99000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hid_submit_ctrl+0x6c6/0xc90 drivers/hid/usbhid/hid-core.c:416
 usbhid_restart_ctrl_queue+0x209/0x340 drivers/hid/usbhid/hid-core.c:258
 __usbhid_submit_report drivers/hid/usbhid/hid-core.c:603 [inline]
 usbhid_submit_report+0x538/0xa10 drivers/hid/usbhid/hid-core.c:640
 usbhid_init_reports+0x80/0x280 drivers/hid/usbhid/hid-core.c:780
 hiddev_ioctl+0x971/0x28d0 drivers/hid/usbhid/hiddev.c:689
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:1069 [inline]
 __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:1055
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x444619
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe7356dbd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004004a0 RCX: 0000000000444619
RDX: 0000000000000000 RSI: 0000000000004805 RDI: 0000000000000004
RBP: 0000000000403ea0 R08: 0000000000000001 R09: 00000000004004a0
R10: 000000000000001f R11: 0000000000000246 R12: 0000000000403f30
R13: 0000000000000000 R14: 00000000004b2018 R15: 00000000004004a0

Crashes (38):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2021/08/26 16:23 upstream 73f3af7b4611 b599f2fc .config log report syz C WARNING in hid_submit_ctrl/usb_submit_urb
ci-upstream-kasan-gce-root 2021/08/18 09:13 upstream 794c7931a242 a2fe1cb5 .config log report syz C WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/16 06:29 upstream dd9c7df94c1b f115ae98 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/16 05:27 upstream dd9c7df94c1b f115ae98 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/16 04:13 upstream dd9c7df94c1b f115ae98 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/16 03:04 upstream dd9c7df94c1b f115ae98 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/16 00:55 upstream dd9c7df94c1b a44e4957 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 23:28 upstream dd9c7df94c1b a44e4957 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 20:45 upstream dd9c7df94c1b a44e4957 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 18:16 upstream 8096acd7442e a44e4957 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 18:10 upstream 8096acd7442e a44e4957 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 10:09 upstream 8096acd7442e b9a2f64e .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 08:03 upstream 8096acd7442e b9a2f64e .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 04:34 upstream 8096acd7442e b9a2f64e .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/15 03:01 upstream 8096acd7442e b9a2f64e .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/14 20:39 upstream 40226a3d96ef 94e0b707 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/14 19:50 upstream 40226a3d96ef 94e0b707 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/14 16:55 upstream 40226a3d96ef 94e0b707 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci-qemu-upstream-386 2021/07/14 15:42 upstream 40226a3d96ef 94e0b707 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/05 10:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/05 06:11 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/04 22:22 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/04 20:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/04 14:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/04 08:45 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/04 07:42 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/04 06:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/03 22:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/03 22:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/03 21:17 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d236a457 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/02 18:54 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 1b4f3dfb4792 d0f0970b .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 22:09 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 835d31d319d9 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 17:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9c1587d99f93 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 16:57 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9c1587d99f93 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 14:30 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9c1587d99f93 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 06:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9c1587d99f93 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 05:06 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9c1587d99f93 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb
ci2-upstream-usb 2021/09/01 04:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 9c1587d99f93 7eb7e152 .config log report info WARNING in hid_submit_ctrl/usb_submit_urb