linux-kernel - Re: [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240803142426.d8uduX0h@linutronix.de>
Date: Sat, 3 Aug 2024 16:24:26 +0200
From: Nam Cao <namcao@...utronix.de>
To: syzbot <syzbot+ca2eaaadab55de6a5a42@...kaller.appspotmail.com>
Cc: florian.c.schilhabel@...glemail.com, gregkh@...uxfoundation.org,
	linux-kernel@...r.kernel.org, linux-media@...r.kernel.org,
	linux-staging@...ts.linux.dev, linux-usb@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [staging?] [usb?] WARNING in
 r8712_usb_write_mem/usb_submit_urb (2)

On Fri, Aug 02, 2024 at 08:01:38PM -0700, syzbot wrote:
> usb 1-1: BOGUS urb xfer, pipe 3 != type 1
> WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
...
> Call Trace:
>  <TASK>
>  r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170
>  rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203
>  rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
>  rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394
>  netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.6.y

diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c
index 1148075f0cd6..80d8c462fafa 100644
--- a/drivers/staging/rtl8712/hal_init.c
+++ b/drivers/staging/rtl8712/hal_init.c
@@ -152,6 +152,10 @@ static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength)
 	return _SUCCESS;
 }
 
+static const int pipetypes[4] = {
+	PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+};
+
 static u8 rtl8712_dl_fw(struct _adapter *adapter)
 {
 	sint i;
@@ -167,6 +171,29 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
 	u32 txdscp_sz = sizeof(struct tx_desc);
 	u8 ret = _FAIL;
 
+	struct intf_hdl *hdl = &adapter->pio_queue->intf;
+	struct intf_priv *pintfpriv = hdl->pintfpriv;
+	struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev;
+	struct usb_device *pusbd = pdvobj->pusbdev;
+
+	for (int i = 0; i < 16; ++i) {
+		struct usb_host_endpoint *ep = pusbd->ep_in[i];
+		if (!ep)
+			continue;
+		int xfertype = usb_endpoint_type(&ep->desc);
+		int type = pipetypes[xfertype];
+		pr_err("ep_in[%d] type=%d\n", i, type);
+	}
+
+	for (int i = 0; i < 16; ++i) {
+		struct usb_host_endpoint *ep = pusbd->ep_out[i];
+		if (!ep)
+			continue;
+		int xfertype = usb_endpoint_type(&ep->desc);
+		int type = pipetypes[xfertype];
+		pr_err("ep_out[%d] type=%d\n", i, type);
+	}
+
 	ulfilelength = rtl871x_open_fw(adapter, &mappedfw);
 	if (mappedfw && (ulfilelength > 0)) {
 		update_fwhdr(&fwhdr, mappedfw);
@@ -200,6 +227,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
 			txdesc->txdw0 |= cpu_to_le32(dump_imem_sz &
 						       0x0000ffff);
 			memcpy(payload, ptr, dump_imem_sz);
+			pr_err("%s:%d\n", __func__, __LINE__);
 			r8712_write_mem(adapter, RTL8712_DMA_VOQ,
 					dump_imem_sz + TXDESC_SIZE,
 					(u8 *)txdesc);
@@ -229,6 +257,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
 			txdesc->txdw0 |= cpu_to_le32(dump_emem_sz &
 						       0x0000ffff);
 			memcpy(payload, ptr, dump_emem_sz);
+			pr_err("%s:%d\n", __func__, __LINE__);
 			r8712_write_mem(adapter, RTL8712_DMA_VOQ,
 					dump_emem_sz + TXDESC_SIZE,
 					(u8 *)txdesc);
@@ -282,6 +311,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
 		txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff);
 		txdesc->txdw0 |= cpu_to_le32(BIT(28));
 		memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz);
+		pr_err("%s:%d\n", __func__, __LINE__);
 		r8712_write_mem(adapter, RTL8712_DMA_VOQ,
 				fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc);