Re: WARNING in usb_submit_urb (4)

From: syzbot <syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com>
To: Thinh.Nguyen@synopsys.com, felipe.balbi@linux.intel.com,
	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org, shuah@kernel.org,
	stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com
Subject: Re: WARNING in usb_submit_urb (4)
Date: Mon, 12 Nov 2018 02:04:03 -0800	[thread overview]
Message-ID: <000000000000214dc1057a74d206@google.com> (raw)
In-Reply-To: <00000000000065a79f057a095de8@google.com>

syzbot has found a reproducer for the following crash on:

HEAD commit:    e12e00e388de Merge tag 'kbuild-fixes-v4.20' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=100e4ef5400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8f215f21f041a0d7
dashboard link: https://syzkaller.appspot.com/bug?extid=7634edaea4d0b341c625
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11ce6fbd400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com

hub 3-0:1.0: 8 ports detected
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 8 ports detected
------------[ cut here ]------------
URB 000000005e43faa5 submitted while active
WARNING: CPU: 0 PID: 6240 at drivers/usb/core/urb.c:363  
usb_submit_urb+0x11cf/0x14e0 drivers/usb/core/urb.c:363
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 6240 Comm: kworker/0:1 Not tainted 4.20.0-rc1+ #332
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: events_power_efficient hub_init_func2
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x244/0x39d lib/dump_stack.c:113
  panic+0x2ad/0x55c kernel/panic.c:188
  __warn.cold.8+0x20/0x45 kernel/panic.c:540
  report_bug+0x254/0x2d0 lib/bug.c:186
  fixup_bug arch/x86/kernel/traps.c:178 [inline]
  do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
  do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290
  invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:969
RIP: 0010:usb_submit_urb+0x11cf/0x14e0 drivers/usb/core/urb.c:363
Code: ee e8 95 62 7b fc 45 84 ed 0f 85 e2 f6 ff ff e8 b7 61 7b fc 48 89 de  
48 c7 c7 a0 32 92 88 c6 05 d4 45 0d 05 01 e8 11 c5 44 fc <0f> 0b e9 c0 f6  
ff ff c7 45 a0 01 00 00 00 e9 65 f7 ff ff 41 bc ed
RSP: 0018:ffff8881c1f974f0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c83bb800 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8165e7e5 RDI: 0000000000000005
RBP: ffff8881c1f97560 R08: ffff8881bc062040 R09: ffffed103b5c3ef8
R10: ffffed103b5c3ef8 R11: ffff8881dae1f7c7 R12: 00000000fffffff0
R13: 0000000000000000 R14: 0000000000000009 R15: ffff8881c1f976f8
  hub_activate+0xcab/0x1940 drivers/usb/core/hub.c:1215
  hub_init_func2+0x1e/0x30 drivers/usb/core/hub.c:1240
  process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153
  worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
  kthread+0x35a/0x440 kernel/kthread.c:246
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..