ci starts bisection 2023-05-12 15:17:14.241188952 +0000 UTC m=+4143.998006983 bisecting fixing commit since b229b6ca5abbd63ff40c1396095b1b36b18139c3 building syzkaller on 2a71366bacf3bf9a3a1a149e631fb15a7d0f2077 ensuring issue is reproducible on original commit b229b6ca5abbd63ff40c1396095b1b36b18139c3 testing commit b229b6ca5abbd63ff40c1396095b1b36b18139c3 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6d229d3fc46e36bbc33fad17d3e35e629c9fdbb61017dfe3598b93bbee029337 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #2: crashed: WARNING in shark_write_val/usb_submit_urb run #3: crashed: WARNING in shark_write_val/usb_submit_urb run #4: crashed: WARNING in shark_write_val/usb_submit_urb run #5: crashed: WARNING in shark_write_val/usb_submit_urb run #6: crashed: WARNING in shark_write_val/usb_submit_urb run #7: crashed: WARNING in shark_write_val/usb_submit_urb run #8: crashed: WARNING in shark_write_val/usb_submit_urb run #9: crashed: WARNING in shark_write_val/usb_submit_urb run #10: crashed: WARNING in shark_write_val/usb_submit_urb run #11: crashed: WARNING in shark_write_val/usb_submit_urb run #12: crashed: WARNING in shark_write_val/usb_submit_urb run #13: crashed: SYZFATAL: executor failed NUM times: executor NUM: exit status NUM run #14: crashed: WARNING in shark_write_val/usb_submit_urb run #15: crashed: WARNING in shark_write_val/usb_submit_urb run #16: crashed: WARNING in shark_write_val/usb_submit_urb run #17: crashed: SYZFATAL: executor failed NUM times: executor NUM: exit status NUM run #18: crashed: WARNING in shark_write_val/usb_submit_urb run #19: crashed: WARNING in shark_write_val/usb_submit_urb testing current HEAD 47a2ee5d4a0bda05decdda7be0a77e792cdb09a3 testing commit 47a2ee5d4a0bda05decdda7be0a77e792cdb09a3 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c974fec520d837ebaac098c42f43cc73f0b3d8b0bbd91b645438f9c89d52e582 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect start 47a2ee5d4a0bda05decdda7be0a77e792cdb09a3 b229b6ca5abbd63ff40c1396095b1b36b18139c3 Bisecting: 24367 revisions left to test after this (roughly 15 steps) [5b7c4cabbb65f5c469464da6c5f614cbd7f730f2] Merge tag 'net-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 5b7c4cabbb65f5c469464da6c5f614cbd7f730f2 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 008029a02f82c33fbf7dae72a563a9b5ed7d22c2a7a2fc2b921b1c807079fe0b all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 5b7c4cabbb65f5c469464da6c5f614cbd7f730f2 Bisecting: 12188 revisions left to test after this (roughly 14 steps) [df45da57cbd35715d590a36a12968a94508ccd1f] Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux testing commit df45da57cbd35715d590a36a12968a94508ccd1f gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 66b6d4705c7ddb39d4621c83dadbf41494f36893603e1dc91b296c289bef31db all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good df45da57cbd35715d590a36a12968a94508ccd1f Bisecting: 6062 revisions left to test after this (roughly 13 steps) [6e98b09da931a00bf4e0477d0fa52748bf28fcce] Merge tag 'net-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 6e98b09da931a00bf4e0477d0fa52748bf28fcce gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8484393063b1b5bd31511e511c1c0527721ddec57950af15ecf350d42a33aaba all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 6e98b09da931a00bf4e0477d0fa52748bf28fcce Bisecting: 3027 revisions left to test after this (roughly 12 steps) [70cc1b5307e8ee3076fdf2ecbeb89eb973aa0ff7] Merge tag 'powerpc-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux testing commit 70cc1b5307e8ee3076fdf2ecbeb89eb973aa0ff7 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8d9e22791bde6318f2c986ee06fdaec4d5b04bef60b4923c8119b0fe3f841ce7 all runs: OK # git bisect bad 70cc1b5307e8ee3076fdf2ecbeb89eb973aa0ff7 Bisecting: 1585 revisions left to test after this (roughly 11 steps) [b39667abcdcc754e32a0eb0df9cf49d45333d4ae] Merge tag 'tty-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit b39667abcdcc754e32a0eb0df9cf49d45333d4ae gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5772c390b508b63c0e0ba979abccb50f96d5733a0f0e1c5266005c314f409121 all runs: OK # git bisect bad b39667abcdcc754e32a0eb0df9cf49d45333d4ae Bisecting: 631 revisions left to test after this (roughly 10 steps) [1c15ca4e4efaddb78f83eed31eeee34c522c3ae2] Merge tag 'sound-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 1c15ca4e4efaddb78f83eed31eeee34c522c3ae2 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 94d48ff0910ffa4d14bcfcaf45dc2e36365836fb009800f6b139b5645c8938be all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 1c15ca4e4efaddb78f83eed31eeee34c522c3ae2 Bisecting: 340 revisions left to test after this (roughly 8 steps) [725a345b2ee3c24f9ac2078eb73667e22a1b7214] Merge tag 'fbdev-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev testing commit 725a345b2ee3c24f9ac2078eb73667e22a1b7214 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ff739a46e0d483486501175831de280c9c01be49d6b18c6ba0aade15ea2843e5 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: crashed: WARNING in shark_write_val/usb_submit_urb run #2: crashed: WARNING in shark_write_val/usb_submit_urb run #3: crashed: WARNING in shark_write_val/usb_submit_urb run #4: crashed: WARNING in shark_write_val/usb_submit_urb run #5: crashed: WARNING in shark_write_val/usb_submit_urb run #6: crashed: WARNING in shark_write_val/usb_submit_urb run #7: crashed: WARNING in shark_write_val/usb_submit_urb run #8: crashed: WARNING in shark_write_val/usb_submit_urb run #9: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 725a345b2ee3c24f9ac2078eb73667e22a1b7214 Bisecting: 170 revisions left to test after this (roughly 7 steps) [976a5c256e34085207c0abf0941b5c967d8d1c18] usb: mtu3: expose role-switch control to userspace testing commit 976a5c256e34085207c0abf0941b5c967d8d1c18 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cfb04949b84f89e06e5a7e6f068a7c3a3a966d366e89c5d71d9c5b5cde71de14 all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 976a5c256e34085207c0abf0941b5c967d8d1c18 Bisecting: 85 revisions left to test after this (roughly 7 steps) [6b97370b2cc6ef75acb72d651ef57041c8f1ece9] tty: vt: reformat tioclinux() testing commit 6b97370b2cc6ef75acb72d651ef57041c8f1ece9 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c4dd5271ec875f9f8ff8e0762ae9a6377e4f029d36d812c4f2d7e98f95edcc9a all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 6b97370b2cc6ef75acb72d651ef57041c8f1ece9 Bisecting: 43 revisions left to test after this (roughly 6 steps) [0549fbac401ced4adea4fca44baf8bab7ebcfc74] Merge branch 'for-6.4/logitech-hidpp' into for-linus testing commit 0549fbac401ced4adea4fca44baf8bab7ebcfc74 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 018b146947d3570999c08fbc7391b3e57e852c0e5398061f4ea5a4d2d53796b8 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: crashed: WARNING in shark_write_val/usb_submit_urb run #2: crashed: WARNING in shark_write_val/usb_submit_urb run #3: crashed: WARNING in shark_write_val/usb_submit_urb run #4: crashed: WARNING in shark_write_val/usb_submit_urb run #5: crashed: WARNING in shark_write_val/usb_submit_urb run #6: crashed: WARNING in shark_write_val/usb_submit_urb run #7: crashed: WARNING in shark_write_val/usb_submit_urb run #8: crashed: WARNING in shark_write_val/usb_submit_urb run #9: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 0549fbac401ced4adea4fca44baf8bab7ebcfc74 Bisecting: 20 revisions left to test after this (roughly 5 steps) [c3a6ef330a08eba406f82b0b8cbca4e4d9b7c4ba] Merge branch 'for-6.4/wacom' into for-linus testing commit c3a6ef330a08eba406f82b0b8cbca4e4d9b7c4ba gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 4c18d07eea0300890f76229f26df5b557ba0400ddb6f3e008dd3c0e9f5187931 all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good c3a6ef330a08eba406f82b0b8cbca4e4d9b7c4ba Bisecting: 10 revisions left to test after this (roughly 3 steps) [39674be56fba1cd3a03bf4617f523a35f85fd2c1] usb: dwc3: gadget: Execute gadget stop after halting the controller testing commit 39674be56fba1cd3a03bf4617f523a35f85fd2c1 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9be3e9ab23cdd77d7c7001c96e151b9440b2f74d92e345bc5f2ad67c8b1ff182 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: exit status NUM run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 39674be56fba1cd3a03bf4617f523a35f85fd2c1 Bisecting: 4 revisions left to test after this (roughly 2 steps) [4a2f152af1c478d42bd4f535788d4dbec015704f] dt-bindings: usb: snps,dwc3: Add 'snps,parkmode-disable-hs-quirk' quirk testing commit 4a2f152af1c478d42bd4f535788d4dbec015704f gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0d7926efe5bb242f24391744c4fa14374f293acfac8fc91b98bcbfd3b4ff3582 all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 4a2f152af1c478d42bd4f535788d4dbec015704f Bisecting: 2 revisions left to test after this (roughly 1 step) [13890626501ffda22b18213ddaf7930473da5792] USB: core: Add routines for endpoint checks in old drivers testing commit 13890626501ffda22b18213ddaf7930473da5792 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 618025908962cfd85625b61feaeecbe0694fc10cefd757f717feea8bf36ac337 all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good 13890626501ffda22b18213ddaf7930473da5792 Bisecting: 0 revisions left to test after this (roughly 1 step) [76e31045ba030e94e72105c01b2e98f543d175ac] media: radio-shark: Add endpoint checks testing commit 76e31045ba030e94e72105c01b2e98f543d175ac gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: be08ec1fdcadd6b525f9ecd8e87eded509f4b1181816a45240ddb21dc01f06c7 all runs: OK # git bisect bad 76e31045ba030e94e72105c01b2e98f543d175ac Bisecting: 0 revisions left to test after this (roughly 0 steps) [df05a9b05e466a46725564528b277d0c570d0104] USB: sisusbvga: Add endpoint checks testing commit df05a9b05e466a46725564528b277d0c570d0104 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 957244a4f9b57877555165b8ca5796cad74be02be16ee696f40328ce03ebf331 all runs: crashed: WARNING in shark_write_val/usb_submit_urb # git bisect good df05a9b05e466a46725564528b277d0c570d0104 76e31045ba030e94e72105c01b2e98f543d175ac is the first bad commit commit 76e31045ba030e94e72105c01b2e98f543d175ac Author: Alan Stern Date: Mon Apr 10 15:40:05 2023 -0400 media: radio-shark: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver). Link: https://syzkaller.appspot.com/bug?extid=4b3f8190f6e13b3efd74 Reported-and-tested-by: syzbot+4b3f8190f6e13b3efd74@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/e2858ab4-4adf-46e5-bbf6-c56742034547@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman drivers/media/radio/radio-shark.c | 10 ++++++++++ drivers/media/radio/radio-shark2.c | 10 ++++++++++ 2 files changed, 20 insertions(+) culprit signature: be08ec1fdcadd6b525f9ecd8e87eded509f4b1181816a45240ddb21dc01f06c7 parent signature: 957244a4f9b57877555165b8ca5796cad74be02be16ee696f40328ce03ebf331 revisions tested: 18, total time: 6h13m41.651539719s (build: 4h32m13.284135164s, test: 1h37m22.41809579s) first good commit: 76e31045ba030e94e72105c01b2e98f543d175ac media: radio-shark: Add endpoint checks recipients (to): ["gregkh@linuxfoundation.org" "stern@rowland.harvard.edu" "syzbot+4b3f8190f6e13b3efd74@syzkaller.appspotmail.com"] recipients (cc): []