linux-kernel - Re: WARNING in usbtmc_probe/usb_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 24 Jun 2024 10:42:14 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: lcx <lichunxiaona@...l.ustc.edu.cn>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: WARNING in usbtmc_probe/usb_submit_urb

On Mon, Jun 24, 2024 at 04:30:26PM +0800, lcx wrote:
> Dear Linux maintainers and reviewers:
> 
> We would like to report a linux kernel bug, found by a modified version of syzkaller.
> 
> Kernel Version: a3e18a540541325a8c8848171f71e0d45ad30b2c(6.10-rc3)
> 
> Kernel Config: see attach, config
> 
> reproducing program: see attach, repro.c
> 
> Feel free to email us if any other information is needed. Hope the provided materials will help finding and fixing the bug.
> 
> -------------------------
> 
> The full log crash log are as follows:
> 
> 
> Syzkaller hit 'WARNING in usbtmc_probe/usb_submit_urb' bug.
> 
> usb 1-1: config 0 descriptor??
> usb 1-1: usb_control_msg returned -71
> usbtmc 1-1:0.0: can't read capabilities
> ------------[ cut here ]------------
> usb 1-1: BOGUS urb xfer, pipe 1 != type 3
> WARNING: CPU: 0 PID: 771 at drivers/usb/core/urb.c:503 usb_submit_urb+0xbf9/0x1490 drivers/usb/core/urb.c:503
> Modules linked in:
> CPU: 0 PID: 771 Comm: kworker/0:2 Not tainted 6.10.0-rc3-00021-g2ef5971ff345-dirty #4
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:usb_submit_urb+0xbf9/0x1490 drivers/usb/core/urb.c:503
> Code: 84 36 02 00 00 e8 97 16 2c fb 4c 89 f7 e8 df 3c f4 fe 45 89 e8 89 e9 4c 89 fa 48 89 c6 48 c7 c7 00 47 3e 8b e8 68 89 f1 fa 90 <0f> 0b 90 90 e9 61 fa ff ff e8 69 16 2c fb 49 81 c5 c8 05 00 00 e9
> RSP: 0018:ffffc90003b87010 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: ffff888017a59800 RCX: 0000000000000000
> RDX: ffff8880183c8000 RSI: ffffffff814af1dc RDI: 0000000000000001
> RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed1005905171
> R10: ffff88802c828b8b R11: 0000000000000001 R12: ffff888017a5985c
> R13: 0000000000000003 R14: ffff88801539a0a8 R15: ffff88801f75e220
> FS:  0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f00c72d30a0 CR3: 000000000cd74000 CR4: 00000000000006f0
> Call Trace:
>  <TASK>
>  usbtmc_probe+0xd21/0x1a90 drivers/usb/class/usbtmc.c:2454

Ah, the usbtmc driver.  Probably just needs to check for proper
endpoints in the device descriptor.  Can you make up a patch for this?

thanks,

greg k-h