linux-kernel - WARNING in smsusb_init_device/usb_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <32d30fde-f991-4619-90df-6085295e9a11@mail.ustc.edu.cn>
Date: Mon, 24 Jun 2024 16:24:59 +0800
From: lcx <lichunxiaona@...l.ustc.edu.cn>
To: Mauro Carvalho Chehab <mchehab@...nel.org>,
 Hans Verkuil <hverkuil-cisco@...all.nl>, Dongliang Mu <dzm91@...t.edu.cn>,
 Ricardo Ribalda <ribalda@...omium.org>,
 Ahelenia Ziemiańska <nabijaczleweli@...ijaczleweli.xyz>,
 Chen Jiahao <chenjiahao16@...wei.com>, linux-media@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: WARNING in smsusb_init_device/usb_submit_urb

Dear Linux maintainers and reviewers:

We would like to report a linux kernel bug, found by a modified version of syzkaller.

Kernel Version: a3e18a540541325a8c8848171f71e0d45ad30b2c(6.10-rc3)

Kernel Config: see attach, config

reproducing program: see attach, repro.c

Feel free to email us if any other information is needed. Hope the provided materials will help finding and fixing the bug.

-------------------------

The full log crash log are as follows:

Syzkaller hit 'WARNING in smsusb_init_device/usb_submit_urb' bug.

smsusb:smsusb_probe: board id=8, interface number 0
smsusb:siano_media_device_register: media controller created
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 1 PID: 67 at drivers/usb/core/urb.c:503 usb_submit_urb+0xbf9/0x1490 drivers/usb/core/urb.c:503
Modules linked in:
CPU: 1 PID: 67 Comm: kworker/1:2 Not tainted 6.10.0-rc3-00021-g2ef5971ff345-dirty #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xbf9/0x1490 drivers/usb/core/urb.c:503
Code: 84 36 02 00 00 e8 97 16 2c fb 4c 89 f7 e8 df 3c f4 fe 45 89 e8 89 e9 4c 89 fa 48 89 c6 48 c7 c7 00 47 3e 8b e8 68 89 f1 fa 90 <0f> 0b 90 90 e9 61 fa ff ff e8 69 16 2c fb 49 81 c5 c8 05 00 00 e9
RSP: 0018:ffffc90000f06e40 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888045f53300 RCX: 0000000000000000
RDX: ffff888042e5d640 RSI: ffffffff814af1dc RDI: 0000000000000001
RBP: 0000000000000003 R08: 0000000000000001 R09: ffffed100fd85171
R10: ffff88807ec28b8b R11: 0000000000000001 R12: ffff888045f5335c
R13: 0000000000000001 R14: ffff8880222af0a8 R15: ffff888040b69120
FS:  0000000000000000(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc9baac7000 CR3: 000000004559e000 CR4: 00000000000006f0
Call Trace:
  <TASK>
  smsusb_submit_urb+0x288/0x410 drivers/media/usb/siano/smsusb.c:173
  smsusb_start_streaming drivers/media/usb/siano/smsusb.c:197 [inline]
  smsusb_init_device+0x7d0/0xd50 drivers/media/usb/siano/smsusb.c:477
  smsusb_probe+0x570/0xfe0 drivers/media/usb/siano/smsusb.c:575
  usb_probe_interface+0x2ac/0x910 drivers/usb/core/driver.c:399
  call_driver_probe drivers/base/dd.c:578 [inline]
  really_probe+0x208/0xa10 drivers/base/dd.c:656
  __driver_probe_device+0x1b4/0x420 drivers/base/dd.c:798
  driver_probe_device+0x4a/0x150 drivers/base/dd.c:828
  __device_attach_driver+0x197/0x2b0 drivers/base/dd.c:956
  bus_for_each_drv+0x151/0x1d0 drivers/base/bus.c:457
  __device_attach+0x1bf/0x460 drivers/base/dd.c:1028
  bus_probe_device+0x171/0x1b0 drivers/base/bus.c:532
  device_add+0x1050/0x1930 drivers/base/core.c:3721
  usb_set_configuration+0xf9c/0x1aa0 drivers/usb/core/message.c:2210
  usb_generic_driver_probe+0x99/0xe0 drivers/usb/core/generic.c:254
  usb_probe_device+0xd0/0x380 drivers/usb/core/driver.c:294
  call_driver_probe drivers/base/dd.c:578 [inline]
  really_probe+0x208/0xa10 drivers/base/dd.c:656
  __driver_probe_device+0x1b4/0x420 drivers/base/dd.c:798
  driver_probe_device+0x4a/0x150 drivers/base/dd.c:828
  __device_attach_driver+0x197/0x2b0 drivers/base/dd.c:956
  bus_for_each_drv+0x151/0x1d0 drivers/base/bus.c:457
  __device_attach+0x1bf/0x460 drivers/base/dd.c:1028
  bus_probe_device+0x171/0x1b0 drivers/base/bus.c:532
  device_add+0x1050/0x1930 drivers/base/core.c:3721
  usb_new_device+0xd70/0x1a00 drivers/usb/core/hub.c:2651
  hub_port_connect drivers/usb/core/hub.c:5521 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
  port_event drivers/usb/core/hub.c:5821 [inline]
  hub_event+0x2894/0x4960 drivers/usb/core/hub.c:5903
  process_one_work+0x93e/0x1970 kernel/workqueue.c:3231
  process_scheduled_works kernel/workqueue.c:3312 [inline]
  worker_thread+0x63b/0xe70 kernel/workqueue.c:3393
  kthread+0x2ab/0x390 kernel/kthread.c:389
  ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
  </TASK>

Content of type "text/html" skipped

View attachment "repro.c" of type "text/plain" (27681 bytes)

View attachment "config" of type "text/plain" (260180 bytes)