From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932448AbcLQRMb (ORCPT ); Sat, 17 Dec 2016 12:12:31 -0500 Received: from mail-lf0-f46.google.com ([209.85.215.46]:34480 "EHLO mail-lf0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754942AbcLQRM2 (ORCPT ); Sat, 17 Dec 2016 12:12:28 -0500 MIME-Version: 1.0 In-Reply-To: References:

From: Andrey Konovalov Date: Sat, 17 Dec 2016 18:12:25 +0100 Message-ID: Subject: Re: usb/core: warning in usb_create_ep_devs/sysfs_create_dir_ns To: Alan Stern Cc: Greg Kroah-Hartman , USB list , LKML , Dmitry Vyukov , Kostya Serebryany , syzkaller Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Dec 16, 2016 at 7:01 PM, Alan Stern wrote: > On Mon, 12 Dec 2016, Andrey Konovalov wrote: > >> Hi! >> >> While running the syzkaller fuzzer I've got the following error report. >> >> On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dev 2). >> >> WARNING: CPU: 2 PID: 865 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x8a/0xa0 >> gadgetfs: disconnected >> sysfs: cannot create duplicate filename >> '/devices/platform/dummy_hcd.0/usb2/2-1/2-1:64.0/ep_05' >> Kernel panic - not syncing: panic_on_warn set ... >> >> CPU: 2 PID: 865 Comm: kworker/2:1 Not tainted 4.9.0-rc7+ #34 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> Workqueue: usb_hub_wq hub_event >> ffff88006bee64c8 ffffffff81f96b8a ffffffff00000001 1ffff1000d7dcc2c >> ffffed000d7dcc24 0000000000000001 0000000041b58ab3 ffffffff8598b510 >> ffffffff81f968f8 ffffffff850fee20 ffffffff85cff020 dffffc0000000000 >> Call Trace: >> [< inline >] __dump_stack lib/dump_stack.c:15 >> [] dump_stack+0x292/0x398 lib/dump_stack.c:51 >> [] panic+0x1cb/0x3a9 kernel/panic.c:179 >> [] __warn+0x1c4/0x1e0 kernel/panic.c:542 >> [] warn_slowpath_fmt+0xc5/0x110 kernel/panic.c:565 >> [] sysfs_warn_dup+0x8a/0xa0 fs/sysfs/dir.c:30 >> [] sysfs_create_dir_ns+0x178/0x1d0 fs/sysfs/dir.c:59 >> [< inline >] create_dir lib/kobject.c:71 >> [] kobject_add_internal+0x227/0xa60 lib/kobject.c:229 >> [< inline >] kobject_add_varg lib/kobject.c:366 >> [] kobject_add+0x139/0x220 lib/kobject.c:411 >> [] device_add+0x353/0x1660 drivers/base/core.c:1088 >> [] device_register+0x1d/0x20 drivers/base/core.c:1206 >> [] usb_create_ep_devs+0x163/0x260 >> drivers/usb/core/endpoint.c:195 >> [] create_intf_ep_devs+0x13b/0x200 >> drivers/usb/core/message.c:1030 >> [] usb_set_configuration+0x1083/0x18d0 >> drivers/usb/core/message.c:1937 > > Hi, Andrey: > > Please check whether the patch below fixes this problem. Hi Alan, Been testing with your patch for the last day, haven't seen any more reports or other issues. Tested-by: Andrey Konovalov Thanks! > > Alan Stern > > > > Index: usb-4.x/drivers/usb/core/config.c > =================================================================== > --- usb-4.x.orig/drivers/usb/core/config.c > +++ usb-4.x/drivers/usb/core/config.c > @@ -234,6 +234,16 @@ static int usb_parse_endpoint(struct dev > if (ifp->desc.bNumEndpoints >= num_ep) > goto skip_to_next_endpoint_or_interface_descriptor; > > + /* Check for duplicate endpoint addresses */ > + for (i = 0; i < ifp->desc.bNumEndpoints; ++i) { > + if (ifp->endpoint[i].desc.bEndpointAddress == > + d->bEndpointAddress) { > + dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", > + cfgno, inum, asnum, d->bEndpointAddress); > + goto skip_to_next_endpoint_or_interface_descriptor; > + } > + } > + > endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; > ++ifp->desc.bNumEndpoints; > >