syzbot


panic: uhidev0: no input interrupt endpoint

Status: fixed on 2022/03/13 10:32
Reported-by: syzbot+22d227370f78b3a34442@syzkaller.appspotmail.com
Fix commit: 8934564b15e9 vhci(4): Don't fail with ENOBUFS if no intrxfer is set up.
First crash: 863d, last: 831d

Sample crash report:
[  65.8086866] panic: uhidev0: no input interrupt endpoint
[  65.8086866] kernel diagnostic assertion "ret == 0" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/usb/vhci.c", line 1054 uhidev0: detached

[  65.8261431] uhidev0: at uhub3cpu0: Begin traceback...
[  65.8261431]  port 1 (addr 2) disconnected
[  65.8386757] vpanic() at netbsd:vpanic+0x258 sys/kern/subr_prf.c:290
[  65.8686770] _sub_D_65535_0() at netbsd:_sub_D_65535_0+-0x259cf
[  65.8986777] vhci_fd_close() at netbsd:vhci_fd_close+0xd1 sys/dev/usb/vhci.c:1054
[  65.9286801] closef() at netbsd:closef+0x152 sys/kern/kern_descrip.c:832
[  65.9586764] fd_close() at netbsd:fd_close+0x340 sys/kern/kern_descrip.c:715
[  65.9886759] sys_close() at netbsd:sys_close+0x3e sys/kern/sys_descrip.c:516
[  66.0186779] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[  66.0186779] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[  66.0186779] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[  66.0293802] --- syscall (number 6) ---
[  66.0386768] netbsd:syscall+0x25a:
[  66.0386768] cpu0: End traceback...
[  66.0386768] fatal breakpoint trap in supervisor mode
[  66.0504972] trap type 1 code 0 rip 0xffffffff80220a2d cs 0x8 rflags 0x282 cr2 0x74384eb8b470 ilevel 0 rsp 0xffffa9019db68b20
[  66.0634930] curlwp 0xffffa90013cd4600 pid 1494.1708 lowest kstack 0xffffa9019db612c0
Stopped in pid 1494.1708 (syz-executor5229) at  netbsd:breakpoint+0x5:  leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x258 sys/kern/subr_prf.c:290
_sub_D_65535_0() at netbsd:_sub_D_65535_0+-0x259cf
vhci_fd_close() at netbsd:vhci_fd_close+0xd1 sys/dev/usb/vhci.c:1054
closef() at netbsd:closef+0x152 sys/kern/kern_descrip.c:832
fd_close() at netbsd:fd_close+0x340 sys/kern/kern_descrip.c:715
sys_close() at netbsd:sys_close+0x3e sys/kern/sys_descrip.c:516
syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
--- syscall (number 6) ---
netbsd:syscall+0x25a:
Panic string: kernel diagnostic assertion "ret == 0" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/usb/vhci.c", line 1054
PID    LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
1874  1874 2   0         0   ffffa90012c4b780   syz-executor5229
1712 >1339 7   1         0   ffffa90013d340c0   syz-executor5229
1712   841 2   0         0   ffffa90013d2c040   syz-executor5229
1712  1640 2   0         0   ffffa9001332b980   syz-executor5229
1712  1712 2   1  10040140   ffffa90012bd8640   syz-executor5229
1494 >1708 7   0     40040   ffffa90013cd4600   syz-executor5229
1494   846 3   1       180   ffffa90013cd41c0   syz-executor5229 parked
1494  1663 3   1     40180   ffffa90013d34940   syz-executor5229 parked
1494  1494 2   0  10000140   ffffa90013d34500   syz-executor5229
1720  1748 2   0         0   ffffa90013d1c300   syz-executor5229
1720  1593 2   0         0   ffffa90013d14280   syz-executor5229
1720   835 2   1         0   ffffa90013d14b00   syz-executor5229
1720  1720 2   0  10040140   ffffa90013d01240   syz-executor5229
1597   842 2   0    100140   ffffa90013d1a2c0   syz-executor5229
1597  1597 3   1  10000000   ffffa90013d01680   syz-executor5229 lwpwait
1220  1220 2   0       140   ffffa90013ca45c0   syz-executor5229
421    421 2   0       140   ffffa90013ca4180   syz-executor5229
1224  1224 2   0       140   ffffa900134639c0   syz-executor5229
1223  1223 2   1        40   ffffa90013463580   syz-executor5229
1193  1193 2   0       140   ffffa90013463140   syz-executor5229
1222  1222 2   1       140   ffffa900133a4ac0   syz-executor5229
1221  1221 3   0       180   ffffa90012b36500   syz-executor5229 nanoslp
1078  1078 3   0       180   ffffa90012a92080               sshd select
1070  1070 3   0       180   ffffa900133a4240              getty nanoslp
1073  1073 3   0       180   ffffa9001337ea40              getty nanoslp
1074  1074 3   0       180   ffffa900133b6280              getty nanoslp
1252  1252 3   0       1c0   ffffa9001267cbc0              getty ttyraw
926    926 3   1       180   ffffa9001337e600               sshd select
941    941 3   1       180   ffffa90012ce06c0             powerd kqueue
687    687 3   0       180   ffffa900133b6b00            syslogd kqueue
602    602 3   0       180   ffffa90012beeac0             dhcpcd poll
739    739 3   0       180   ffffa90012c71900             dhcpcd poll
464    464 3   0       180   ffffa90012bee680             dhcpcd poll
587    587 3   1       180   ffffa90012c3e300             dhcpcd poll
289    289 3   0       180   ffffa90012d72080             dhcpcd poll
288    288 3   0       180   ffffa90012d608c0             dhcpcd poll
351    351 3   1       180   ffffa90012d60480             dhcpcd poll
1        1 3   0       180   ffffa900127f49c0               init wait
0      938 3   0       200   ffffa9001295fac0            physiod physiod
0      194 3   0       200   ffffa90012979b00          pooldrain pooldrain
0      193 3   0       200   ffffa900129796c0            ioflush syncer
0      192 3   1       200   ffffa90012979280           pgdaemon pgdaemon
0      168 3   1       200   ffffa9001295f240               usb7 usbevt
0      166 3   1       200   ffffa90012916a80               usb6 usbevt
0      164 2   0       240   ffffa90012916640               usb5
0      163 2   0       240   ffffa90012916200               usb4
0       31 3   1       200   ffffa900128c8a40               usb3 usbevt
0       63 3   0       200   ffffa900128c8600               usb2 usbevt
0      126 3   1       200   ffffa900128c81c0               usb1 usbevt
0      125 3   1       200   ffffa900128a7a00               usb0 usbevt
0      124 3   1       200   ffffa900128a75c0         usbtask-dr usbtsk
0      123 3   1       200   ffffa900128a7180         usbtask-hc usbtsk
0      122 3   0       200   ffffa900120b36c0             npfgc0 npfgcw
0      121 3   1       200   ffffa900127f4580            rt_free rt_free
0      120 3   1       200   ffffa900127f4140              unpgc unpgc
0      119 3   1       200   ffffa900127ee980    key_timehandler key_timehandler
0      118 3   1       200   ffffa900127ee540    icmp6_wqinput/1 icmp6_wqinput
0      117 3   0       200   ffffa900127ee100    icmp6_wqinput/0 icmp6_wqinput
0      116 3   0       200   ffffa900127e2940          nd6_timer nd6_timer
0      115 3   1       200   ffffa900127e2500    carp6_wqinput/1 carp6_wqinput
0      114 3   0       200   ffffa900127e20c0    carp6_wqinput/0 carp6_wqinput
0      113 3   1       200   ffffa900127d4900     carp_wqinput/1 carp_wqinput
0      112 3   0       200   ffffa900127d44c0     carp_wqinput/0 carp_wqinput
0      111 3   1       200   ffffa900127d4080     icmp_wqinput/1 icmp_wqinput
0      110 3   0       200   ffffa900127c48c0     icmp_wqinput/0 icmp_wqinput
0      109 3   0       200   ffffa900127c4480           rt_timer rt_timer
0      108 3   0       200   ffffa9001267c780        vmem_rehash vmem_rehash
0      107 3   0       200   ffffa900127c4040          entbutler entropy
0       98 3   0       200   ffffa900120b7700              viomb balloon
0       97 3   1       200   ffffa900120b72c0      vioif0_txrx/1 vioif0_txrx
0       96 3   0       200   ffffa900120b3b00      vioif0_txrx/0 vioif0_txrx
0       29 3   0       200   ffffa900120b3280           scsibus0 sccomp
0       28 3   0       200   ffffa90010cb9ac0               pms0 pmsreset
0       27 3   1       200   ffffa90010cb9680            xcall/1 xcall
0       26 1   1       200   ffffa90010cb9240          softser/1
0       25 1   1       200   ffffa90010cb8a80          softclk/1
0       24 1   1       200   ffffa90010cb8640          softbio/1
0       23 1   1       200   ffffa90010cb8200          softnet/1
0       22 1   1       201   ffffa9000fb55a40             idle/1
0       21 3   0       200   ffffa9000fb55600           lnxsyswq lnxsyswq
0       20 3   0       200   ffffa9000fb551c0           lnxubdwq lnxubdwq
0       19 3   0       200   ffffa9000fb53a00           lnxpwrwq lnxpwrwq
0       18 3   0       200   ffffa9000fb535c0           lnxlngwq lnxlngwq
0       17 3   0       200   ffffa9000fb53180           lnxhipwq lnxhipwq
0       16 3   0       200   ffffa9000fb4b9c0           lnxrcugc lnxrcugc
0       15 3   0       200   ffffa9000fb4b580             sysmon smtaskq
0       14 3   0       200   ffffa9000fb4b140         pmfsuspend pmfsuspend
0       13 3   0       200   ffffa9000fb47980           pmfevent pmfevent
0       12 3   0       200   ffffa900

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/01/01 13:41 netbsd 0cc1faa26220 e1768e9c .config console log report syz C ci2-netbsd panic: uhidev0: no input interrupt endpoint
2021/12/14 18:45 netbsd ef4911a77f80 d018dd31 .config console log report syz C ci2-netbsd panic: uhidev0: no input interrupt endpoint
2021/12/14 09:31 netbsd 27f50254e3b3 5d14b1ea .config console log report syz ci2-netbsd-kmsan panic: uhidev0: no input interrupt endpoint
2022/01/15 22:55 netbsd 2234d9c8b90d 723cfaf0 .config console log report ci2-netbsd-kmsan panic: uhidev0: no input interrupt endpoint
2022/01/04 06:41 netbsd 0cc1faa26220 7f723fbe .config console log report ci2-netbsd panic: uhidev0: no input interrupt endpoint
2021/12/20 01:09 netbsd d9960c5fc9bd 44068e19 .config console log report ci2-netbsd panic: uhidev0: no input interrupt endpoint
* Struck through repros no longer work on HEAD.