WARNING in corrupted/usb_submit_urb

Status: auto-obsoleted due to no activity on 2025/09/23 21:18
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+38ebbc9acce0587aa35d@syzkaller.appspotmail.com
First crash: 1164d, last: 837d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2023/06/03 upstream (ToT) 51f269a6ecc7 C [report] WARNING in amradio_send_cmd/usb_submit_urb
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in corrupted/usb_submit_urb (2) usb -1 syz, C error done 69 835d 2089d 0/29 closed as invalid on 2026/07/17 14:22
linux-6.1 WARNING in corrupted/usb_submit_urb origin:upstream -1 syz, C error 1 700d 1160d 0/3 auto-obsoleted due to no activity on 2025/08/30 15:47
upstream WARNING in corrupted/usb_submit_urb usb -1 syz, C 23 2353d 2245d 0/29 closed as invalid on 2020/06/19 14:24
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/09/23 21:02 15m retest repro linux-5.15.y OK log
2025/07/14 03:49 15m retest repro linux-5.15.y report log
2025/05/04 23:14 17m retest repro linux-5.15.y report log
2025/02/23 19:10 58m retest repro linux-5.15.y report log
2024/12/15 18:12 56m retest repro linux-5.15.y report log
▶ ▼ Fix bisection attempts (9)
Created Duration User Patch Repo Result
2024/05/30 19:50 9m bisect fix linux-5.15.y error job log
2024/04/01 03:00 1h03m bisect fix linux-5.15.y OK (0) job log log
2024/03/01 18:24 53m bisect fix linux-5.15.y OK (0) job log log
2024/01/22 09:47 59m bisect fix linux-5.15.y OK (0) job log log
2023/12/23 04:57 1h11m bisect fix linux-5.15.y OK (0) job log log
2023/11/23 00:40 50m bisect fix linux-5.15.y OK (0) job log log
2023/10/21 18:15 1h10m bisect fix linux-5.15.y OK (0) job log log
2023/09/21 04:15 1h16m bisect fix linux-5.15.y OK (0) job log log
2023/07/07 09:14 1h14m bisect fix linux-5.15.y OK (0) job log log

Sample crash report:
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: syz
usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
usb 1-1: config 0 descriptor??
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 1 PID: 3249 at drivers/usb/core/urb.c:503 usb_submit_urb+0xc8d/0x1990 drivers/usb/core/urb.c:502
Modules linked in:
CPU: 1 PID: 3249 Comm: kworker/1:3 Not tainted 5.15.156-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xc8d/0x1990 drivers/usb/core/urb.c:502
Code: 0f b6 04 18 84 c0 44 8b 64 24 1c 0f 85 2b 09 00 00 45 8b 07 48 c7 c7 c0 94 22 8b 48 8b 74 24 08 4c 89 f2 89 e9 e8 33 4b 30 fb <0f> 0b 48 8b 5c 24 20 48 8b 6c 24 28 41 89 de 4c 89 f7 48 c7 c6 d0
RSP: 0018:ffffc90003146c60 EFLAGS: 00010246
RAX: 1dd394d4ec11e300 RBX: dffffc0000000000 RCX: ffff88801e34d940
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: ffffffff8166862c R09: ffffed10173667a8
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: ffff888016bf4600 R14: ffff88801319b5f0 R15: ffffffff8b2292ac
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffff68cd58 CR3: 0000000023235000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/25 12:55 linux-5.15.y c52b9710c83d 8bdc0f22 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan WARNING in corrupted/usb_submit_urb
2023/06/03 16:50 linux-5.15.y 0ab06468cbd1 a4ae4f42 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan WARNING in corrupted/usb_submit_urb
* Struck through repros no longer work on HEAD.