From: Alan Stern <stern@rowland.harvard.edu>
To: syzbot <syzbot+db339689b2101f6f6071@syzkaller.appspotmail.com>
Cc: andreyknvl@google.com, <gregkh@linuxfoundation.org>,
<ingrassia@epigenesys.com>, <linux-kernel@vger.kernel.org>,
<linux-usb@vger.kernel.org>, <syzkaller-bugs@googlegroups.com>
Subject: Re: WARNING in usbhid_raw_request/usb_submit_urb (3)
Date: Thu, 2 Apr 2020 15:00:03 -0400 (EDT) [thread overview]
Message-ID: <Pine.LNX.4.44L0.2004021428320.852-100000@netrider.rowland.org> (raw)
In-Reply-To: <0000000000000e8b8005a2520af1@google.com>
On Thu, 2 Apr 2020, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer still triggered crash:
> WARNING in usbhid_raw_request/usb_submit_urb
>
> ------------[ cut here ]------------
> usb 3-1: BOGUS urb xfer, pipe 2 != type 2, ep addr 0x00, pipe 0x80001a00, xfertype 0
Not much help, I'm afraid. The pipe value decodes to:
Direction: OUT
Device address: 26 (which agrees with the console output)
Endpoint: 0
Pipe type: Control (which is appropriate for ep 0
and agrees with xfertype)
Unfortunately, the values printed here need not be the same as the
values checked by usb_urb_ep_type_check(), if either the URB or the
descriptor is modified concurrently by another thread.
Let's try a different approach. Since this modifies the code before
the test, it may not trigger the warning. But it's worth a try.
Alan Stern
#syz test: https://github.com/google/kasan.git 0fa84af8
Index: usb-devel/drivers/usb/core/urb.c
===================================================================
--- usb-devel.orig/drivers/usb/core/urb.c
+++ usb-devel/drivers/usb/core/urb.c
@@ -199,15 +199,27 @@ static const int pipetypes[4] = {
* given urb. It returns 0 if the urb contains a valid endpoint, otherwise
* a negative error code.
*/
+unsigned int alan_pipe, alan_epaddr, alan_epattr;
int usb_urb_ep_type_check(const struct urb *urb)
{
const struct usb_host_endpoint *ep;
+ unsigned int pipe, epattr;
- ep = usb_pipe_endpoint(urb->dev, urb->pipe);
- if (!ep)
+ pipe = READ_ONCE(urb->pipe);
+ ep = usb_pipe_endpoint(urb->dev, pipe);
+ if (!ep) {
+ alan_pipe = pipe;
+ alan_epattr = 0;
+ alan_epaddr = 0xff;
return -EINVAL;
- if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
+ }
+ epattr = READ_ONCE(ep->desc.bmAttributes);
+ if (usb_pipetype(pipe) != pipetypes[epattr & USB_ENDPOINT_XFERTYPE_MASK]) {
+ alan_pipe = pipe;
+ alan_epattr = epattr;
+ alan_epaddr = ep->desc.bEndpointAddress;
return -EINVAL;
+ }
return 0;
}
EXPORT_SYMBOL_GPL(usb_urb_ep_type_check);
@@ -475,8 +487,9 @@ int usb_submit_urb(struct urb *urb, gfp_
/* Check that the pipe's type matches the endpoint's type */
if (usb_urb_ep_type_check(urb))
- dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
- usb_pipetype(urb->pipe), pipetypes[xfertype]);
+ dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x, pipe 0x%x, ep attr 0x%02x, ep addr 0x%02x\n",
+ usb_pipetype(urb->pipe), pipetypes[xfertype],
+ alan_pipe, alan_epattr, alan_epaddr);
/* Check against a simple/standard policy */
allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT | URB_DIR_MASK |
next prev parent reply other threads:[~2020-04-02 19:00 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-14 13:04 WARNING in usbhid_raw_request/usb_submit_urb (3) syzbot
2020-04-01 20:49 ` syzbot
2020-04-02 15:35 ` Alan Stern
2020-04-02 15:53 ` syzbot
2020-04-02 15:57 ` Andrey Konovalov
2020-04-02 17:22 ` syzbot
2020-04-02 19:00 ` Alan Stern [this message]
2020-04-02 21:25 ` syzbot
2020-04-23 1:18 ` Alan Stern
2020-04-23 1:36 ` syzbot
2020-04-23 16:37 ` Alan Stern
2020-04-23 17:20 ` syzbot
2020-04-23 18:54 ` Alan Stern
2020-04-23 20:37 ` syzbot
2020-04-23 21:09 ` Alan Stern
2020-04-23 21:51 ` syzbot
2020-04-24 1:00 ` Alan Stern
2020-04-24 1:19 ` syzbot
2020-04-24 1:39 ` Alan Stern
2020-04-24 2:10 ` syzbot
2020-04-24 12:20 ` Alan Stern
2020-04-24 12:32 ` syzbot
2020-04-24 15:20 ` Alan Stern
2020-04-24 15:34 ` syzbot
2020-04-24 19:14 ` Alan Stern
2020-04-24 19:32 ` syzbot
2020-04-25 20:25 ` Alan Stern
2020-04-25 21:21 ` syzbot
2020-04-29 20:11 ` Alan Stern
2020-04-29 20:30 ` syzbot
2020-04-29 23:41 ` Alan Stern
2020-04-29 23:59 ` syzbot
2020-04-30 14:58 ` Alan Stern
2020-04-30 15:18 ` syzbot
2020-05-01 20:07 ` [PATCH] USB: core: Fix misleading driver bug report Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.2004021428320.852-100000@netrider.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=andreyknvl@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=ingrassia@epigenesys.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzbot+db339689b2101f6f6071@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.