* [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) @ 2024-08-03 3:01 syzbot 2024-08-03 13:55 ` Nam Cao 2024-08-03 14:24 ` Nam Cao 0 siblings, 2 replies; 6+ messages in thread From: syzbot @ 2024-08-03 3:01 UTC (permalink / raw) To: florian.c.schilhabel, gregkh, linux-kernel, linux-media, linux-staging, linux-usb, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 1722389b0d86 Merge tag 'net-6.11-rc1' of git://git.kernel... git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing console output: https://syzkaller.appspot.com/x/log.txt?x=12d2a623980000 kernel config: https://syzkaller.appspot.com/x/.config?x=e3044dca4d5f6dbe dashboard link: https://syzkaller.appspot.com/bug?extid=ca2eaaadab55de6a5a42 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123da96d980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1560c223980000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/78a5695ed7e2/disk-1722389b.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/1507b4c5000d/vmlinux-1722389b.xz kernel image: https://storage.googleapis.com/syzbot-assets/449aa9e94d6b/bzImage-1722389b.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ca2eaaadab55de6a5a42@syzkaller.appspotmail.com ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Modules linked in: CPU: 0 UID: 0 PID: 2583 Comm: dhcpcd Not tainted 6.10.0-syzkaller-g1722389b0d86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Code: 84 3c 02 00 00 e8 a5 eb fe fc 4c 89 ef e8 2d 21 d7 fe 45 89 e0 89 e9 4c 89 f2 48 89 c6 48 c7 c7 e0 17 a0 87 e8 96 dc c4 fc 90 <0f> 0b 90 90 e9 e9 f8 ff ff e8 77 eb fe fc 49 81 c4 c0 05 00 00 e9 RSP: 0018:ffffc900015b7678 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888103e8ad00 RCX: ffffffff81194ce9 RDX: ffff88810e70ba00 RSI: ffffffff81194cf6 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888100fec0a8 R14: ffff888109f01e00 R15: ffff888103e8ad7c FS: 00007f3757320740(0000) GS:ffff8881f6200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd527ba8870 CR3: 000000010c766000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170 rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203 rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline] rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394 netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397 __dev_open+0x2d4/0x4e0 net/core/dev.c:1474 __dev_change_flags+0x561/0x720 net/core/dev.c:8837 dev_change_flags+0x8f/0x160 net/core/dev.c:8909 devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177 inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003 sock_do_ioctl+0x116/0x280 net/socket.c:1222 sock_ioctl+0x22e/0x6c0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f37573eed49 Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8 RSP: 002b:00007ffe0c834f48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f37573206c0 RCX: 00007f37573eed49 RDX: 00007ffe0c845138 RSI: 0000000000008914 RDI: 0000000000000005 RBP: 00007ffe0c8552f8 R08: 00007ffe0c8450f8 R09: 00007ffe0c8450a8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe0c845138 R14: 0000000000000028 R15: 0000000000008914 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) 2024-08-03 3:01 [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) syzbot @ 2024-08-03 13:55 ` Nam Cao 2024-08-03 14:06 ` syzbot 2024-08-03 14:24 ` Nam Cao 1 sibling, 1 reply; 6+ messages in thread From: Nam Cao @ 2024-08-03 13:55 UTC (permalink / raw) To: syzbot Cc: florian.c.schilhabel, gregkh, linux-kernel, linux-media, linux-staging, linux-usb, syzkaller-bugs On Fri, Aug 02, 2024 at 08:01:38PM -0700, syzbot wrote: > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 ... > Call Trace: > <TASK> > r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170 > rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203 > rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline] > rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394 > netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397 #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 1722389b0d86 diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c index 1148075f0cd6..80d8c462fafa 100644 --- a/drivers/staging/rtl8712/hal_init.c +++ b/drivers/staging/rtl8712/hal_init.c @@ -152,6 +152,10 @@ static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength) return _SUCCESS; } +static const int pipetypes[4] = { + PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT +}; + static u8 rtl8712_dl_fw(struct _adapter *adapter) { sint i; @@ -167,6 +171,29 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) u32 txdscp_sz = sizeof(struct tx_desc); u8 ret = _FAIL; + struct intf_hdl *hdl = &adapter->pio_queue->intf; + struct intf_priv *pintfpriv = hdl->pintfpriv; + struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev; + struct usb_device *pusbd = pdvobj->pusbdev; + + for (int i = 0; i < 16; ++i) { + struct usb_host_endpoint *ep = pusbd->ep_in[i]; + if (!ep) + continue; + int xfertype = usb_endpoint_type(&ep->desc); + int type = pipetypes[xfertype]; + pr_err("ep_in[%d] type=%d\n", i, type); + } + + for (int i = 0; i < 16; ++i) { + struct usb_host_endpoint *ep = pusbd->ep_out[i]; + if (!ep) + continue; + int xfertype = usb_endpoint_type(&ep->desc); + int type = pipetypes[xfertype]; + pr_err("ep_out[%d] type=%d\n", i, type); + } + ulfilelength = rtl871x_open_fw(adapter, &mappedfw); if (mappedfw && (ulfilelength > 0)) { update_fwhdr(&fwhdr, mappedfw); @@ -200,6 +227,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) txdesc->txdw0 |= cpu_to_le32(dump_imem_sz & 0x0000ffff); memcpy(payload, ptr, dump_imem_sz); + pr_err("%s:%d\n", __func__, __LINE__); r8712_write_mem(adapter, RTL8712_DMA_VOQ, dump_imem_sz + TXDESC_SIZE, (u8 *)txdesc); @@ -229,6 +257,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) txdesc->txdw0 |= cpu_to_le32(dump_emem_sz & 0x0000ffff); memcpy(payload, ptr, dump_emem_sz); + pr_err("%s:%d\n", __func__, __LINE__); r8712_write_mem(adapter, RTL8712_DMA_VOQ, dump_emem_sz + TXDESC_SIZE, (u8 *)txdesc); @@ -282,6 +311,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff); txdesc->txdw0 |= cpu_to_le32(BIT(28)); memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz); + pr_err("%s:%d\n", __func__, __LINE__); r8712_write_mem(adapter, RTL8712_DMA_VOQ, fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc); ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) 2024-08-03 13:55 ` Nam Cao @ 2024-08-03 14:06 ` syzbot 0 siblings, 0 replies; 6+ messages in thread From: syzbot @ 2024-08-03 14:06 UTC (permalink / raw) To: florian.c.schilhabel, gregkh, linux-kernel, linux-media, linux-staging, linux-usb, namcao, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: WARNING in r8712_usb_write_mem/usb_submit_urb ep_out[2] type=2 ep_out[3] type=0 ep_out[4] type=1 rtl8712_dl_fw:230 ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Modules linked in: CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.10.0-syzkaller-12562-g1722389b0d86-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Code: 84 3c 02 00 00 e8 a5 eb fe fc 4c 89 ef e8 2d 21 d7 fe 45 89 e0 89 e9 4c 89 f2 48 89 c6 48 c7 c7 40 18 a0 87 e8 96 dc c4 fc 90 <0f> 0b 90 90 e9 e9 f8 ff ff e8 77 eb fe fc 49 81 c4 c0 05 00 00 e9 RSP: 0018:ffffc90004acf678 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888128648700 RCX: ffffffff81194ce9 RDX: ffff88810db70000 RSI: ffffffff81194cf6 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888115b8f0a8 R14: ffff888103aa5560 R15: ffff88812864877c FS: 00007f06eaa79740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b92c582068 CR3: 000000010c70c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170 rtl8712_dl_fw+0xa03/0x1310 drivers/staging/rtl8712/hal_init.c:231 rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:360 [inline] rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:424 netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397 __dev_open+0x2d4/0x4e0 net/core/dev.c:1474 __dev_change_flags+0x561/0x720 net/core/dev.c:8837 dev_change_flags+0x8f/0x160 net/core/dev.c:8909 devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177 inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003 sock_do_ioctl+0x116/0x280 net/socket.c:1222 sock_ioctl+0x22e/0x6c0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f06eab47d49 Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8 RSP: 002b:00007fffa5c56198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f06eaa796c0 RCX: 00007f06eab47d49 RDX: 00007fffa5c66388 RSI: 0000000000008914 RDI: 0000000000000005 RBP: 00007fffa5c76548 R08: 00007fffa5c66348 R09: 00007fffa5c662f8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffa5c66388 R14: 0000000000000028 R15: 0000000000008914 </TASK> Tested on: commit: 1722389b Merge tag 'net-6.11-rc1' of git://git.kernel... git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=131843bd980000 kernel config: https://syzkaller.appspot.com/x/.config?x=e3044dca4d5f6dbe dashboard link: https://syzkaller.appspot.com/bug?extid=ca2eaaadab55de6a5a42 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=10b25b03980000 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) 2024-08-03 3:01 [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) syzbot 2024-08-03 13:55 ` Nam Cao @ 2024-08-03 14:24 ` Nam Cao 2024-08-03 14:35 ` syzbot 2024-08-03 15:11 ` Alan Stern 1 sibling, 2 replies; 6+ messages in thread From: Nam Cao @ 2024-08-03 14:24 UTC (permalink / raw) To: syzbot Cc: florian.c.schilhabel, gregkh, linux-kernel, linux-media, linux-staging, linux-usb, syzkaller-bugs On Fri, Aug 02, 2024 at 08:01:38PM -0700, syzbot wrote: > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 ... > Call Trace: > <TASK> > r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170 > rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203 > rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline] > rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394 > netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397 #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.6.y diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c index 1148075f0cd6..80d8c462fafa 100644 --- a/drivers/staging/rtl8712/hal_init.c +++ b/drivers/staging/rtl8712/hal_init.c @@ -152,6 +152,10 @@ static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength) return _SUCCESS; } +static const int pipetypes[4] = { + PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT +}; + static u8 rtl8712_dl_fw(struct _adapter *adapter) { sint i; @@ -167,6 +171,29 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) u32 txdscp_sz = sizeof(struct tx_desc); u8 ret = _FAIL; + struct intf_hdl *hdl = &adapter->pio_queue->intf; + struct intf_priv *pintfpriv = hdl->pintfpriv; + struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev; + struct usb_device *pusbd = pdvobj->pusbdev; + + for (int i = 0; i < 16; ++i) { + struct usb_host_endpoint *ep = pusbd->ep_in[i]; + if (!ep) + continue; + int xfertype = usb_endpoint_type(&ep->desc); + int type = pipetypes[xfertype]; + pr_err("ep_in[%d] type=%d\n", i, type); + } + + for (int i = 0; i < 16; ++i) { + struct usb_host_endpoint *ep = pusbd->ep_out[i]; + if (!ep) + continue; + int xfertype = usb_endpoint_type(&ep->desc); + int type = pipetypes[xfertype]; + pr_err("ep_out[%d] type=%d\n", i, type); + } + ulfilelength = rtl871x_open_fw(adapter, &mappedfw); if (mappedfw && (ulfilelength > 0)) { update_fwhdr(&fwhdr, mappedfw); @@ -200,6 +227,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) txdesc->txdw0 |= cpu_to_le32(dump_imem_sz & 0x0000ffff); memcpy(payload, ptr, dump_imem_sz); + pr_err("%s:%d\n", __func__, __LINE__); r8712_write_mem(adapter, RTL8712_DMA_VOQ, dump_imem_sz + TXDESC_SIZE, (u8 *)txdesc); @@ -229,6 +257,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) txdesc->txdw0 |= cpu_to_le32(dump_emem_sz & 0x0000ffff); memcpy(payload, ptr, dump_emem_sz); + pr_err("%s:%d\n", __func__, __LINE__); r8712_write_mem(adapter, RTL8712_DMA_VOQ, dump_emem_sz + TXDESC_SIZE, (u8 *)txdesc); @@ -282,6 +311,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff); txdesc->txdw0 |= cpu_to_le32(BIT(28)); memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz); + pr_err("%s:%d\n", __func__, __LINE__); r8712_write_mem(adapter, RTL8712_DMA_VOQ, fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc); ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) 2024-08-03 14:24 ` Nam Cao @ 2024-08-03 14:35 ` syzbot 2024-08-03 15:11 ` Alan Stern 1 sibling, 0 replies; 6+ messages in thread From: syzbot @ 2024-08-03 14:35 UTC (permalink / raw) To: florian.c.schilhabel, gregkh, linux-kernel, linux-media, linux-staging, linux-usb, namcao, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in r871xu_dev_remove INFO: task kworker/1:1:28 blocked for more than 143 seconds. Not tainted 6.6.44-syzkaller-g721391060066-dirty #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:27456 pid:28 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> context_switch kernel/sched/core.c:5380 [inline] __schedule+0xca5/0x30d0 kernel/sched/core.c:6698 schedule+0xe7/0x1b0 kernel/sched/core.c:6772 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x5bd/0x9d0 kernel/locking/mutex.c:747 unregister_netdev+0x12/0x30 net/core/dev.c:11102 r871xu_dev_remove+0x291/0x480 drivers/staging/rtl8712/usb_intf.c:596 usb_unbind_interface+0x1e0/0x8d0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:569 [inline] device_remove+0x122/0x170 drivers/base/dd.c:561 __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1295 bus_remove_device+0x22f/0x420 drivers/base/bus.c:574 device_del+0x39d/0xa60 drivers/base/core.c:3838 usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1416 usb_disconnect+0x2e1/0x890 drivers/usb/core/hub.c:2276 hub_port_connect drivers/usb/core/hub.c:5329 [inline] hub_port_connect_change drivers/usb/core/hub.c:5629 [inline] port_event drivers/usb/core/hub.c:5789 [inline] hub_event+0x1be4/0x4f50 drivers/usb/core/hub.c:5871 process_one_work+0x889/0x15e0 kernel/workqueue.c:2631 process_scheduled_works kernel/workqueue.c:2704 [inline] worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2785 kthread+0x2c6/0x3b0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293 </TASK> Showing all locks held in the system: 3 locks held by kworker/0:1/9: #0: ffff888109ba9138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x789/0x15e0 kernel/workqueue.c:2606 #1: ffffc9000009fd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15e0 kernel/workqueue.c:2607 #2: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4684 6 locks held by kworker/1:1/28: #0: ffff88810a64fd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x789/0x15e0 kernel/workqueue.c:2606 #1: ffffc900001e7d80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15e0 kernel/workqueue.c:2607 #2: ffff888104f2b190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:992 [inline] #2: ffff888104f2b190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1be/0x4f50 drivers/usb/core/hub.c:5817 #3: ffff888114cd9190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:992 [inline] #3: ffff888114cd9190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x10a/0x890 drivers/usb/core/hub.c:2267 #4: ffff888100f5b160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:992 [inline] #4: ffff888100f5b160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline] #4: ffff888100f5b160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa4/0x610 drivers/base/dd.c:1292 #5: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: unregister_netdev+0x12/0x30 net/core/dev.c:11102 1 lock held by khungtaskd/29: #0: ffffffff888aece0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff888aece0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff888aece0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6614 1 lock held by kworker/u4:7/1043: #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:558 [inline] #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1375 [inline] #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1684 [inline] #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x290/0x30d0 kernel/sched/core.c:6613 3 locks held by kworker/1:2/1939: #0: ffff888109ba9138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x789/0x15e0 kernel/workqueue.c:2606 #1: ffffc9000393fd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15e0 kernel/workqueue.c:2607 #2: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4684 1 lock held by klogd/2494: #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:558 [inline] #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1375 [inline] #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1684 [inline] #0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x290/0x30d0 kernel/sched/core.c:6613 2 locks held by dhcpcd/2543: #0: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x1d3/0x1f10 net/ipv4/devinet.c:1091 #1: ffff88811928cdb0 (&padapter->mutex_start){+.+.}-{3:3}, at: netdev_open+0x32/0x840 drivers/staging/rtl8712/os_intfs.c:392 2 locks held by getty/2563: #0: ffff88810af530a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000432f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc9/0x1480 drivers/tty/n_tty.c:2216 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.6.44-syzkaller-g721391060066-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xf87/0x1210 kernel/hung_task.c:379 kthread+0x2c6/0x3b0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293 </TASK> Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline] NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt+0x1b/0x30 drivers/acpi/processor_idle.c:111 Tested on: commit: 72139106 Linux 6.6.44 git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.6.y console output: https://syzkaller.appspot.com/x/log.txt?x=17be7b65980000 kernel config: https://syzkaller.appspot.com/x/.config?x=cc2e57d9f035477b dashboard link: https://syzkaller.appspot.com/bug?extid=ca2eaaadab55de6a5a42 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=11be7b65980000 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) 2024-08-03 14:24 ` Nam Cao 2024-08-03 14:35 ` syzbot @ 2024-08-03 15:11 ` Alan Stern 1 sibling, 0 replies; 6+ messages in thread From: Alan Stern @ 2024-08-03 15:11 UTC (permalink / raw) To: Nam Cao Cc: syzbot, florian.c.schilhabel, gregkh, linux-kernel, linux-media, linux-staging, linux-usb, syzkaller-bugs On Sat, Aug 03, 2024 at 04:24:26PM +0200, Nam Cao wrote: > On Fri, Aug 02, 2024 at 08:01:38PM -0700, syzbot wrote: > > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > > WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 > ... > > Call Trace: > > <TASK> > > r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170 > > rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203 > > rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline] > > rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394 > > netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397 > > #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.6.y > > diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c > index 1148075f0cd6..80d8c462fafa 100644 > --- a/drivers/staging/rtl8712/hal_init.c > +++ b/drivers/staging/rtl8712/hal_init.c > @@ -152,6 +152,10 @@ static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength) > return _SUCCESS; > } > > +static const int pipetypes[4] = { > + PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT > +}; > + > static u8 rtl8712_dl_fw(struct _adapter *adapter) > { > sint i; > @@ -167,6 +171,29 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) > u32 txdscp_sz = sizeof(struct tx_desc); > u8 ret = _FAIL; > > + struct intf_hdl *hdl = &adapter->pio_queue->intf; > + struct intf_priv *pintfpriv = hdl->pintfpriv; > + struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev; > + struct usb_device *pusbd = pdvobj->pusbdev; > + > + for (int i = 0; i < 16; ++i) { > + struct usb_host_endpoint *ep = pusbd->ep_in[i]; > + if (!ep) > + continue; > + int xfertype = usb_endpoint_type(&ep->desc); > + int type = pipetypes[xfertype]; > + pr_err("ep_in[%d] type=%d\n", i, type); > + } > + > + for (int i = 0; i < 16; ++i) { > + struct usb_host_endpoint *ep = pusbd->ep_out[i]; > + if (!ep) > + continue; > + int xfertype = usb_endpoint_type(&ep->desc); > + int type = pipetypes[xfertype]; > + pr_err("ep_out[%d] type=%d\n", i, type); > + } > + > ulfilelength = rtl871x_open_fw(adapter, &mappedfw); > if (mappedfw && (ulfilelength > 0)) { > update_fwhdr(&fwhdr, mappedfw); > @@ -200,6 +227,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) > txdesc->txdw0 |= cpu_to_le32(dump_imem_sz & > 0x0000ffff); > memcpy(payload, ptr, dump_imem_sz); > + pr_err("%s:%d\n", __func__, __LINE__); > r8712_write_mem(adapter, RTL8712_DMA_VOQ, > dump_imem_sz + TXDESC_SIZE, > (u8 *)txdesc); > @@ -229,6 +257,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) > txdesc->txdw0 |= cpu_to_le32(dump_emem_sz & > 0x0000ffff); > memcpy(payload, ptr, dump_emem_sz); > + pr_err("%s:%d\n", __func__, __LINE__); > r8712_write_mem(adapter, RTL8712_DMA_VOQ, > dump_emem_sz + TXDESC_SIZE, > (u8 *)txdesc); > @@ -282,6 +311,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter) > txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff); > txdesc->txdw0 |= cpu_to_le32(BIT(28)); > memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz); > + pr_err("%s:%d\n", __func__, __LINE__); > r8712_write_mem(adapter, RTL8712_DMA_VOQ, > fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc); You don't have to run all these tests to figure out what the problem is; I can tell you. The bug is connected to ffaddr2piphd() in usb_ops_linux.c. That routine creates a bunch of Bulk pipe values with various endpoint numbers, based on the addr argument passed by its caller. But the driver doesn't check to make sure that these endpoints actually exist in the device or that they are actually Bulk endpoints. That's why the problem occurs. In this syzbot test the endpoint in question is really Interrupt, not Bulk. That's why the warning message appears about the pipe's type not matching the endpoint's type. Alan Stern ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-08-03 15:11 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-08-03 3:01 [syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2) syzbot 2024-08-03 13:55 ` Nam Cao 2024-08-03 14:06 ` syzbot 2024-08-03 14:24 ` Nam Cao 2024-08-03 14:35 ` syzbot 2024-08-03 15:11 ` Alan Stern
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox