* Re: WARNING in port100_send_cmd_async/usb_submit_urb
@ 2019-11-19 14:24 Oliver Neukum
2019-11-20 23:18 ` syzbot
0 siblings, 1 reply; 3+ messages in thread
From: Oliver Neukum @ 2019-11-19 14:24 UTC (permalink / raw)
To: syzbot+711468aa5c3a1eabf863; +Cc: alexios.zavras, linux-usb
#syz test: https://github.com/google/kasan.git 7829a896
From 4d4036dd03e08c3169850d1c37fc6b73b9b4ba7c Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 19 Nov 2019 15:08:53 +0100
Subject: [PATCH] nfc: port100: handle command failure cleanly
If starting the transfer of a command suceeds but the transfer for the reply
fails, it is not enough to initiate killing the transfer for the
command may still be running. You need to wait for the killing to finish
before you can reuse URB and buffer.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/nfc/port100.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index 145ddf3f0a45..604dba4f18af 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -783,7 +783,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
if (rc)
- usb_unlink_urb(dev->out_urb);
+ usb_kill_urb(dev->out_urb);
exit:
mutex_unlock(&dev->out_urb_lock);
--
2.16.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: WARNING in port100_send_cmd_async/usb_submit_urb
2019-11-19 14:24 WARNING in port100_send_cmd_async/usb_submit_urb Oliver Neukum
@ 2019-11-20 23:18 ` syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2019-11-20 23:18 UTC (permalink / raw)
To: alexios.zavras, linux-usb, oneukum, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger
crash:
Reported-and-tested-by:
syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com
Tested on:
commit: 7829a896 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git
kernel config: https://syzkaller.appspot.com/x/.config?x=f6d4561982f71f63
dashboard link: https://syzkaller.appspot.com/bug?extid=711468aa5c3a1eabf863
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1248258ce00000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 3+ messages in thread
* WARNING in port100_send_cmd_async/usb_submit_urb
@ 2019-07-10 11:07 syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2019-07-10 11:07 UTC (permalink / raw)
To: andreyknvl, gregkh, gustavo, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: 7829a896 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=1652b15fa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f6d4561982f71f63
dashboard link: https://syzkaller.appspot.com/bug?extid=711468aa5c3a1eabf863
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=166af1c4600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171a1627a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com
usb 1-1: config 0 interface 206 altsetting 0 bulk endpoint 0x8F has invalid
maxpacket 0
usb 1-1: New USB device found, idVendor=054c, idProduct=06c3,
bcdDevice=9c.72
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: config 0 descriptor??
------------[ cut here ]------------
URB 0000000007e26c9b submitted while active
WARNING: CPU: 0 PID: 107 at drivers/usb/core/urb.c:362
usb_submit_urb+0x10c1/0x13b0 drivers/usb/core/urb.c:362
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 107 Comm: kworker/0:2 Not tainted 5.2.0-rc6+ #13
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
panic+0x292/0x6c9 kernel/panic.c:219
__warn.cold+0x20/0x4b kernel/panic.c:576
report_bug+0x262/0x2a0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:179 [inline]
fixup_bug arch/x86/kernel/traps.c:174 [inline]
do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986
RIP: 0010:usb_submit_urb+0x10c1/0x13b0 drivers/usb/core/urb.c:362
Code: 89 de e8 72 dd e8 fd 84 db 0f 85 42 f6 ff ff e8 35 dc e8 fd 4c 89 fe
48 c7 c7 00 23 1a 86 c6 05 4b 78 57 04 01 e8 ca a0 be fd <0f> 0b e9 20 f6
ff ff c7 44 24 14 01 00 00 00 e9 d7 f6 ff ff 41 bd
RSP: 0018:ffff8881d422f090 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8127ef3d RDI: ffffed103a845e04
RBP: ffff8881d14dea20 R08: ffff8881d4220000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881d4163f00
R13: 00000000fffffff0 R14: ffff8881d0d0a7c8 R15: ffff8881d4163e00
port100_send_frame_async drivers/nfc/port100.c:780 [inline]
port100_send_cmd_async+0x801/0xb80 drivers/nfc/port100.c:876
port100_send_cmd_sync+0xaa/0x130 drivers/nfc/port100.c:916
port100_set_command_type drivers/nfc/port100.c:987 [inline]
port100_probe+0xa12/0xea0 drivers/nfc/port100.c:1567
usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
really_probe+0x281/0x660 drivers/base/dd.c:509
driver_probe_device+0x104/0x210 drivers/base/dd.c:670
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:843
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2111
usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
really_probe+0x281/0x660 drivers/base/dd.c:509
driver_probe_device+0x104/0x210 drivers/base/dd.c:670
__device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
__device_attach+0x217/0x360 drivers/base/dd.c:843
bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
device_add+0xae6/0x16f0 drivers/base/core.c:2111
usb_new_device.cold+0x8c1/0x1016 drivers/usb/core/hub.c:2534
hub_port_connect drivers/usb/core/hub.c:5089 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
port_event drivers/usb/core/hub.c:5350 [inline]
hub_event+0x1ada/0x3590 drivers/usb/core/hub.c:5432
process_one_work+0x905/0x1570 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x30b/0x410 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-11-20 23:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-19 14:24 WARNING in port100_send_cmd_async/usb_submit_urb Oliver Neukum
2019-11-20 23:18 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2019-07-10 11:07 syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).