From: Alan Stern <stern@rowland.harvard.edu>
To: Andrey Konovalov <andreyknvl@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
USB list <linux-usb@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>,
Kostya Serebryany <kcc@google.com>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: usb/core: warning in usb_create_ep_devs/sysfs_create_dir_ns
Date: Fri, 16 Dec 2016 13:01:45 -0500 (EST) [thread overview]
Message-ID: <Pine.LNX.4.44L0.1612161300240.1533-100000@iolanthe.rowland.org> (raw)
In-Reply-To: <CAAeHK+wnfCUAuN9skpGFsc+diddt0=Vv1+Xq=rzpK3SuzKhQDw@mail.gmail.com>
On Mon, 12 Dec 2016, Andrey Konovalov wrote:
> Hi!
>
> While running the syzkaller fuzzer I've got the following error report.
>
> On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dev 2).
>
> WARNING: CPU: 2 PID: 865 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x8a/0xa0
> gadgetfs: disconnected
> sysfs: cannot create duplicate filename
> '/devices/platform/dummy_hcd.0/usb2/2-1/2-1:64.0/ep_05'
> Kernel panic - not syncing: panic_on_warn set ...
>
> CPU: 2 PID: 865 Comm: kworker/2:1 Not tainted 4.9.0-rc7+ #34
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: usb_hub_wq hub_event
> ffff88006bee64c8 ffffffff81f96b8a ffffffff00000001 1ffff1000d7dcc2c
> ffffed000d7dcc24 0000000000000001 0000000041b58ab3 ffffffff8598b510
> ffffffff81f968f8 ffffffff850fee20 ffffffff85cff020 dffffc0000000000
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff81f96b8a>] dump_stack+0x292/0x398 lib/dump_stack.c:51
> [<ffffffff8168c88e>] panic+0x1cb/0x3a9 kernel/panic.c:179
> [<ffffffff812b80b4>] __warn+0x1c4/0x1e0 kernel/panic.c:542
> [<ffffffff812b8195>] warn_slowpath_fmt+0xc5/0x110 kernel/panic.c:565
> [<ffffffff819e70ca>] sysfs_warn_dup+0x8a/0xa0 fs/sysfs/dir.c:30
> [<ffffffff819e7308>] sysfs_create_dir_ns+0x178/0x1d0 fs/sysfs/dir.c:59
> [< inline >] create_dir lib/kobject.c:71
> [<ffffffff81fa1b07>] kobject_add_internal+0x227/0xa60 lib/kobject.c:229
> [< inline >] kobject_add_varg lib/kobject.c:366
> [<ffffffff81fa2479>] kobject_add+0x139/0x220 lib/kobject.c:411
> [<ffffffff82737a63>] device_add+0x353/0x1660 drivers/base/core.c:1088
> [<ffffffff82738d8d>] device_register+0x1d/0x20 drivers/base/core.c:1206
> [<ffffffff82cb77d3>] usb_create_ep_devs+0x163/0x260
> drivers/usb/core/endpoint.c:195
> [<ffffffff82c9f27b>] create_intf_ep_devs+0x13b/0x200
> drivers/usb/core/message.c:1030
> [<ffffffff82ca39d3>] usb_set_configuration+0x1083/0x18d0
> drivers/usb/core/message.c:1937
Hi, Andrey:
Please check whether the patch below fixes this problem.
Alan Stern
Index: usb-4.x/drivers/usb/core/config.c
===================================================================
--- usb-4.x.orig/drivers/usb/core/config.c
+++ usb-4.x/drivers/usb/core/config.c
@@ -234,6 +234,16 @@ static int usb_parse_endpoint(struct dev
if (ifp->desc.bNumEndpoints >= num_ep)
goto skip_to_next_endpoint_or_interface_descriptor;
+ /* Check for duplicate endpoint addresses */
+ for (i = 0; i < ifp->desc.bNumEndpoints; ++i) {
+ if (ifp->endpoint[i].desc.bEndpointAddress ==
+ d->bEndpointAddress) {
+ dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
+ cfgno, inum, asnum, d->bEndpointAddress);
+ goto skip_to_next_endpoint_or_interface_descriptor;
+ }
+ }
+
endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
++ifp->desc.bNumEndpoints;
next prev parent reply other threads:[~2016-12-16 18:02 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-12 20:48 usb/core: warning in usb_create_ep_devs/sysfs_create_dir_ns Andrey Konovalov
2016-12-12 21:05 ` Alan Stern
2016-12-12 21:16 ` Dmitry Vyukov
2016-12-12 21:48 ` Alan Stern
2016-12-12 22:04 ` Alan Stern
2016-12-13 15:07 ` Dmitry Vyukov
2016-12-13 15:52 ` Alan Stern
2016-12-13 16:23 ` Dmitry Vyukov
2016-12-13 18:38 ` Alan Stern
2016-12-13 18:44 ` Dmitry Vyukov
2016-12-13 20:09 ` Alan Stern
2016-12-13 20:32 ` Dmitry Vyukov
2016-12-12 21:49 ` Greg Kroah-Hartman
2016-12-16 18:01 ` Alan Stern [this message]
2016-12-17 17:12 ` Andrey Konovalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.1612161300240.1533-100000@iolanthe.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=andreyknvl@google.com \
--cc=dvyukov@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).