Linux-USB Archive on lore.kernel.org
 help / color / Atom feed
* WARNING in hif_usb_send/usb_submit_urb
@ 2020-10-05 10:59 syzbot
  2020-10-09 14:19 ` syzbot
  0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2020-10-05 10:59 UTC (permalink / raw)
  To: andreyknvl, eli.billauer, gregkh, gustavoars, ingrassia,
	linux-kernel, linux-usb, stern, syzkaller-bugs, tiwai

Hello,

syzbot found the following issue on:

HEAD commit:    168ae5a7 Merge 5.9-rc8 into usb-next
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=1073b7ff900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5429f3643ebc37a
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler:       gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f5378bcf0f0cab45c1c6@syzkaller.appspotmail.com

------------[ cut here ]------------
usb 4-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 10570 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 10570 Comm: kworker/0:9 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x16e lib/dump_stack.c:118
 panic+0x2cb/0x702 kernel/panic.c:231
 __warn.cold+0x20/0x44 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Code: 84 04 03 00 00 e8 3e 98 c6 fd 4c 89 ef e8 66 b6 12 ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 b3 5d 86 e8 d0 ba 9a fd <0f> 0b e9 c6 f8 ff ff e8 12 98 c6 fd 48 81 c5 40 06 00 00 e9 f2 f7
RSP: 0018:ffff8881ab1bf808 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8881ca76cbc0 RSI: ffffffff8129efa3 RDI: ffffed1035637ef3
RBP: ffff8881a27dfc00 R08: 0000000000000001 R09: ffff8881db22f50f
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff8881d8fab0a0 R14: ffff8881c7299168 R15: ffff8881cc24a700
 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
 hif_usb_send+0x4c1/0xcf0 drivers/net/wireless/ath/ath9k/hif_usb.c:470
 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
 htc_connect_service+0x705/0xa00 drivers/net/wireless/ath/ath9k/htc_hst.c:275
 ath9k_wmi_connect+0xc9/0x190 drivers/net/wireless/ath/ath9k/wmi.c:268
 ath9k_init_htc_services.constprop.0+0xb3/0x640 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
 ath9k_htc_probe_device+0x25f/0x1e10 drivers/net/wireless/ath/ath9k/htc_drv_init.c:962
 ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
 ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1220
 request_firmware_work_func+0x126/0x250 drivers/base/firmware_loader/main.c:1006
 process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x392/0x470 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-05 10:59 WARNING in hif_usb_send/usb_submit_urb syzbot
@ 2020-10-09 14:19 ` syzbot
  2020-10-09 18:55   ` Alan Stern
  0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2020-10-09 14:19 UTC (permalink / raw)
  To: andreyknvl, eli.billauer, gregkh, gustavoars, ingrassia,
	linux-kernel, linux-usb, oneukum, stern, syzkaller-bugs, tiwai

syzbot has found a reproducer for the following issue on:

HEAD commit:    6c8cf369 usb: typec: Add QCOM PMIC typec detection driver
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=14ea791b900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df3bb4023c36d114
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1087bfe7900000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1327b010500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f5378bcf0f0cab45c1c6@syzkaller.appspotmail.com

usb 1-1: Manufacturer: syz
usb 1-1: SerialNumber: syz
usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 1 PID: 72 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 72 Comm: kworker/1:2 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x16e lib/dump_stack.c:118
 panic+0x2cb/0x702 kernel/panic.c:231
 __warn.cold+0x20/0x44 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
Code: 84 04 03 00 00 e8 3e 98 c6 fd 4c 89 ef e8 66 b6 12 ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 b3 5d 86 e8 d0 ba 9a fd <0f> 0b e9 c6 f8 ff ff e8 12 98 c6 fd 48 81 c5 40 06 00 00 e9 f2 f7
RSP: 0018:ffff8881d4757808 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8881d4ffe500 RSI: ffffffff8129efa3 RDI: ffffed103a8eaef3
RBP: ffff8881cde7d800 R08: 0000000000000001 R09: ffff8881db32f50f
R10: 0000000000000000 R11: 0000000000003754 R12: 0000000000000001
R13: ffff8881d1edd0a0 R14: ffff8881d9bc9320 R15: ffff8881d9ba8600
 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
 hif_usb_send+0x4c1/0xcf0 drivers/net/wireless/ath/ath9k/hif_usb.c:470
 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
 htc_connect_service+0x705/0xa00 drivers/net/wireless/ath/ath9k/htc_hst.c:275
 ath9k_wmi_connect+0xc9/0x190 drivers/net/wireless/ath/ath9k/wmi.c:268
 ath9k_init_htc_services.constprop.0+0xb3/0x640 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
 ath9k_htc_probe_device+0x25f/0x1e10 drivers/net/wireless/ath/ath9k/htc_drv_init.c:962
 ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
 ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1220
 request_firmware_work_func+0x126/0x250 drivers/base/firmware_loader/main.c:1006
 process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x392/0x470 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Kernel Offset: disabled
Rebooting in 86400 seconds..


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-09 14:19 ` syzbot
@ 2020-10-09 18:55   ` Alan Stern
  2020-10-09 21:55     ` syzbot
  2020-10-12 12:58     ` Andrey Konovalov
  0 siblings, 2 replies; 9+ messages in thread
From: Alan Stern @ 2020-10-09 18:55 UTC (permalink / raw)
  To: syzbot, QCA ath9k Development
  Cc: andreyknvl, eli.billauer, gregkh, gustavoars, ingrassia,
	linux-kernel, linux-usb, oneukum, linux-wireless, syzkaller-bugs,
	tiwai

To the ath9k_htc maintainers:

This is an attempt to fix a bug detected by the syzbot fuzzer.  The bug 
arises when a USB device claims to be an ATH9K but doesn't have the 
expected endpoints.  (In this case there was a bulk endpoint where the 
driver expected an interrupt endpoint.)  The kernel needs to be able to 
handle such devices without getting an internal error.

On Fri, Oct 09, 2020 at 07:19:19AM -0700, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    6c8cf369 usb: typec: Add QCOM PMIC typec detection driver

Andrey, why doesn't syzbot put a 12-digit commit ID here?

> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=14ea791b900000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=df3bb4023c36d114
> dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
> compiler:       gcc (GCC) 10.1.0-syz 20200507
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1087bfe7900000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1327b010500000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+f5378bcf0f0cab45c1c6@syzkaller.appspotmail.com
> 
> usb 1-1: Manufacturer: syz
> usb 1-1: SerialNumber: syz
> usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
> usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
> ------------[ cut here ]------------
> usb 1-1: BOGUS urb xfer, pipe 1 != type 3
> WARNING: CPU: 1 PID: 72 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 72 Comm: kworker/1:2 Not tainted 5.9.0-rc8-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Workqueue: events request_firmware_work_func
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x107/0x16e lib/dump_stack.c:118
>  panic+0x2cb/0x702 kernel/panic.c:231
>  __warn.cold+0x20/0x44 kernel/panic.c:600
>  report_bug+0x1bd/0x210 lib/bug.c:198
>  handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
>  exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
>  asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
> RIP: 0010:usb_submit_urb+0xce2/0x14e0 drivers/usb/core/urb.c:493
> Code: 84 04 03 00 00 e8 3e 98 c6 fd 4c 89 ef e8 66 b6 12 ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 20 b3 5d 86 e8 d0 ba 9a fd <0f> 0b e9 c6 f8 ff ff e8 12 98 c6 fd 48 81 c5 40 06 00 00 e9 f2 f7
> RSP: 0018:ffff8881d4757808 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
> RDX: ffff8881d4ffe500 RSI: ffffffff8129efa3 RDI: ffffed103a8eaef3
> RBP: ffff8881cde7d800 R08: 0000000000000001 R09: ffff8881db32f50f
> R10: 0000000000000000 R11: 0000000000003754 R12: 0000000000000001
> R13: ffff8881d1edd0a0 R14: ffff8881d9bc9320 R15: ffff8881d9ba8600
>  hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
>  hif_usb_send+0x4c1/0xcf0 drivers/net/wireless/ath/ath9k/hif_usb.c:470
>  htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
>  htc_connect_service+0x705/0xa00 drivers/net/wireless/ath/ath9k/htc_hst.c:275
>  ath9k_wmi_connect+0xc9/0x190 drivers/net/wireless/ath/ath9k/wmi.c:268
>  ath9k_init_htc_services.constprop.0+0xb3/0x640 drivers/net/wireless/ath/ath9k/htc_drv_init.c:146
>  ath9k_htc_probe_device+0x25f/0x1e10 drivers/net/wireless/ath/ath9k/htc_drv_init.c:962
>  ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:501
>  ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1220
>  request_firmware_work_func+0x126/0x250 drivers/base/firmware_loader/main.c:1006
>  process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269
>  worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
>  kthread+0x392/0x470 kernel/kthread.c:292
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

I don't know if all the devices used by the ath9k_htc driver are 
expected to have all of these endpoints and no others.  I just added 
checks for the ones listed in the hif_usb.h file.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 6c8cf369

Index: usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1307,6 +1307,20 @@ static int ath9k_hif_usb_probe(struct us
 	struct usb_device *udev = interface_to_usbdev(interface);
 	struct hif_device_usb *hif_dev;
 	int ret = 0;
+	struct usb_host_interface *alt;
+	struct usb_endpoint_descriptor *epd;
+
+	/* Verify the expected endpoints are present */
+	alt = interface->cur_altsetting;
+	if (!usb_find_int_in_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_REG_IN_PIPE ||
+	    !usb_find_int_out_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_REG_OUT_PIPE ||
+	    !usb_find_bulk_in(endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_WLAN_RX_PIPE ||
+	    !usb_find_bulk_out(endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_WLAN_TX_PIPE)
+		return -ENODEV;
 
 	if (id->driver_info == STORAGE_DEVICE)
 		return send_eject_command(interface);



^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-09 18:55   ` Alan Stern
@ 2020-10-09 21:55     ` syzbot
  2020-10-10  0:49       ` Alan Stern
  2020-10-12 12:58     ` Andrey Konovalov
  1 sibling, 1 reply; 9+ messages in thread
From: syzbot @ 2020-10-09 21:55 UTC (permalink / raw)
  To: andreyknvl, ath9k-devel, eli.billauer, gregkh, gustavoars,
	ingrassia, linux-kernel, linux-usb, linux-wireless, oneukum,
	stern, syzkaller-bugs, tiwai

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

drivers/net/wireless/ath/ath9k/hif_usb.c:1319:7: error: implicit declaration of function 'usb_find_bulk_in'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1319:24: error: implicit declaration of function 'endpoint' [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1321:7: error: implicit declaration of function 'usb_find_bulk_out'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1322:46: error: expected ')' before 'return'
drivers/net/wireless/ath/ath9k/hif_usb.c:1357:13: error: expected ')' before '}' token
drivers/net/wireless/ath/ath9k/hif_usb.c:1358:1: error: expected expression before '}' token


Tested on:

commit:         6c8cf369 usb: typec: Add QCOM PMIC typec detection driver
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler:       gcc (GCC) 10.1.0-syz 20200507
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12e0fd84500000


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-10  0:49       ` Alan Stern
@ 2020-10-10  0:56         ` syzbot
  2020-10-10  1:08           ` Alan Stern
  0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2020-10-10  0:56 UTC (permalink / raw)
  To: andreyknvl, ath9k-devel, eli.billauer, gregkh, gustavoars,
	ingrassia, linux-kernel, linux-usb, linux-wireless, oneukum,
	stern, syzkaller-bugs, tiwai

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

drivers/net/wireless/ath/ath9k/hif_usb.c:1319:7: error: implicit declaration of function 'usb_find_bulk_in'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1319:24: error: implicit declaration of function 'endpoint' [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1321:7: error: implicit declaration of function 'usb_find_bulk_out'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]
drivers/net/wireless/ath/ath9k/hif_usb.c:1322:46: error: expected ')' before 'return'
drivers/net/wireless/ath/ath9k/hif_usb.c:1357:13: error: expected ')' before '}' token
drivers/net/wireless/ath/ath9k/hif_usb.c:1358:1: error: expected expression before '}' token


Tested on:

commit:         549738f1 Linux 5.9-rc8
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.9-rc8
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler:       gcc (GCC) 10.1.0-syz 20200507
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1200b51b900000


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-10  0:56         ` syzbot
@ 2020-10-10  1:08           ` Alan Stern
  2020-10-10  1:27             ` syzbot
  0 siblings, 1 reply; 9+ messages in thread
From: Alan Stern @ 2020-10-10  1:08 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, ath9k-devel, eli.billauer, gregkh, gustavoars,
	ingrassia, linux-kernel, linux-usb, linux-wireless, oneukum,
	syzkaller-bugs, tiwai

On Fri, Oct 09, 2020 at 05:56:09PM -0700, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:

Oops.  One more try, with the typos fixed.

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.9-rc8

Index: usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1307,6 +1307,20 @@ static int ath9k_hif_usb_probe(struct us
 	struct usb_device *udev = interface_to_usbdev(interface);
 	struct hif_device_usb *hif_dev;
 	int ret = 0;
+	struct usb_host_interface *alt;
+	struct usb_endpoint_descriptor *epd;
+
+	/* Verify the expected endpoints are present */
+	alt = interface->cur_altsetting;
+	if (!usb_find_int_in_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_REG_IN_PIPE ||
+	    !usb_find_int_out_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_REG_OUT_PIPE ||
+	    !usb_find_bulk_in_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_WLAN_RX_PIPE ||
+	    !usb_find_bulk_out_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_WLAN_TX_PIPE)
+		return -ENODEV;
 
 	if (id->driver_info == STORAGE_DEVICE)
 		return send_eject_command(interface);


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-10  1:08           ` Alan Stern
@ 2020-10-10  1:27             ` syzbot
  0 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2020-10-10  1:27 UTC (permalink / raw)
  To: andreyknvl, ath9k-devel, eli.billauer, gregkh, gustavoars,
	ingrassia, linux-kernel, linux-usb, linux-wireless, oneukum,
	stern, syzkaller-bugs, tiwai

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+f5378bcf0f0cab45c1c6@syzkaller.appspotmail.com

Tested on:

commit:         549738f1 Linux 5.9-rc8
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.9-rc8
kernel config:  https://syzkaller.appspot.com/x/.config?x=1b79158db7761422
dashboard link: https://syzkaller.appspot.com/bug?extid=f5378bcf0f0cab45c1c6
compiler:       gcc (GCC) 10.1.0-syz 20200507
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16da8ffb900000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-09 18:55   ` Alan Stern
  2020-10-09 21:55     ` syzbot
@ 2020-10-12 12:58     ` Andrey Konovalov
  1 sibling, 0 replies; 9+ messages in thread
From: Andrey Konovalov @ 2020-10-12 12:58 UTC (permalink / raw)
  To: Alan Stern
  Cc: syzbot, QCA ath9k Development, eli.billauer, Greg Kroah-Hartman,
	gustavoars, ingrassia, LKML, USB list, Oliver Neukum,
	linux-wireless, syzkaller-bugs, Takashi Iwai

On Fri, Oct 9, 2020 at 8:55 PM Alan Stern <stern@rowland.harvard.edu> wrote:
>
> To the ath9k_htc maintainers:
>
> This is an attempt to fix a bug detected by the syzbot fuzzer.  The bug
> arises when a USB device claims to be an ATH9K but doesn't have the
> expected endpoints.  (In this case there was a bulk endpoint where the
> driver expected an interrupt endpoint.)  The kernel needs to be able to
> handle such devices without getting an internal error.
>
> On Fri, Oct 09, 2020 at 07:19:19AM -0700, syzbot wrote:
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit:    6c8cf369 usb: typec: Add QCOM PMIC typec detection driver
>
> Andrey, why doesn't syzbot put a 12-digit commit ID here?

No particular reason, I think. Makes sense to change it to 12, as it's
the recommended minimum AFAIU. I've a bug to track this here:
https://github.com/google/syzkaller/issues/2184

Thank you!

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: WARNING in hif_usb_send/usb_submit_urb
  2020-10-09 21:55     ` syzbot
@ 2020-10-10  0:49       ` Alan Stern
  2020-10-10  0:56         ` syzbot
  0 siblings, 1 reply; 9+ messages in thread
From: Alan Stern @ 2020-10-10  0:49 UTC (permalink / raw)
  To: syzbot
  Cc: andreyknvl, ath9k-devel, eli.billauer, gregkh, gustavoars,
	ingrassia, linux-kernel, linux-usb, linux-wireless, oneukum,
	syzkaller-bugs, tiwai

On Fri, Oct 09, 2020 at 02:55:08PM -0700, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
> drivers/net/wireless/ath/ath9k/hif_usb.c:1319:7: error: implicit declaration of function 'usb_find_bulk_in'; did you mean 'usb_fill_bulk_urb'? [-Werror=implicit-function-declaration]

Let's try again, using a different repository.

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.9-rc8

Index: usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
===================================================================
--- usb-devel.orig/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ usb-devel/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1307,6 +1307,20 @@ static int ath9k_hif_usb_probe(struct us
 	struct usb_device *udev = interface_to_usbdev(interface);
 	struct hif_device_usb *hif_dev;
 	int ret = 0;
+	struct usb_host_interface *alt;
+	struct usb_endpoint_descriptor *epd;
+
+	/* Verify the expected endpoints are present */
+	alt = interface->cur_altsetting;
+	if (!usb_find_int_in_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_REG_IN_PIPE ||
+	    !usb_find_int_out_endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_REG_OUT_PIPE ||
+	    !usb_find_bulk_in(endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_WLAN_RX_PIPE ||
+	    !usb_find_bulk_out(endpoint(alt, &epd) ||
+			usb_endpoint_num(epd) != USB_WLAN_TX_PIPE)
+		return -ENODEV;
 
 	if (id->driver_info == STORAGE_DEVICE)
 		return send_eject_command(interface);

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, back to index

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-05 10:59 WARNING in hif_usb_send/usb_submit_urb syzbot
2020-10-09 14:19 ` syzbot
2020-10-09 18:55   ` Alan Stern
2020-10-09 21:55     ` syzbot
2020-10-10  0:49       ` Alan Stern
2020-10-10  0:56         ` syzbot
2020-10-10  1:08           ` Alan Stern
2020-10-10  1:27             ` syzbot
2020-10-12 12:58     ` Andrey Konovalov

Linux-USB Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-usb/0 linux-usb/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-usb linux-usb/ https://lore.kernel.org/linux-usb \
		linux-usb@vger.kernel.org
	public-inbox-index linux-usb

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-usb


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git