From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751653AbdKHRHA (ORCPT <rfc822;w@1wt.eu>);
        Wed, 8 Nov 2017 12:07:00 -0500
Received: from iolanthe.rowland.org ([192.131.102.54]:55876 "HELO
        iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with SMTP id S1751344AbdKHRG7 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 8 Nov 2017 12:06:59 -0500
Date: Wed, 8 Nov 2017 12:06:58 -0500 (EST)
From: Alan Stern <stern@rowland.harvard.edu>
X-X-Sender: stern@iolanthe.rowland.org
To: Dmitry Vyukov <dvyukov@google.com>
cc: Greg KH <gregkh@linuxfoundation.org>,
        syzbot 
        <bot+50d191d34989b5aa28596b0a2cb20c96f3ca4650@syzkaller.appspotmail.com>,
        <felipe.balbi@linux.intel.com>, <krinkin.m.u@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>,
        USB list <linux-usb@vger.kernel.org>,
        <syzkaller-bugs@googlegroups.com>, Takashi Iwai <tiwai@suse.de>,
        <vskrishn@codeaurora.org>
Subject: Re: WARNING in usb_submit_urb
In-Reply-To: <CACT4Y+b6Hv21Db5=RG3zU5xeJo0HA0CaEeQ7=bUTTmQ1re7ZXg@mail.gmail.com>
Message-ID: <Pine.LNX.4.44L0.1711081205460.3080-100000@iolanthe.rowland.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, 8 Nov 2017, Dmitry Vyukov wrote:

> > I don't understand how this could have happened.  The raw log explains
> > the problem:
> >
> >> [   15.138822] usb usb1: BOGUS urb flags, 2 --> 0
> >> [   15.139498] ------------[ cut here ]------------
> >> [   15.139955] WARNING: CPU: 3 PID: 2986 at drivers/usb/core/urb.c:498 usb_submit_urb+0xeb9/0x10f0
> > ...
> >> [   15.150280] RIP: 0010:usb_submit_urb+0xeb9/0x10f0
> > ...
> >> [   15.155166]  proc_do_submiturb+0x1f53/0x3860
> >
> > The "2 --> 0" means that proc_do_submiturb() tried to submit a control
> > URB (2 = PIPE_CONTROL) to an isochronous endpoint (0 = PIPE_ISOCHRONOUS).
> > But right near the start of the routine we have:
> >
> >         switch (uurb->type) {
> >         case USBDEVFS_URB_TYPE_CONTROL:
> >                 if (!usb_endpoint_xfer_control(&ep->desc))
> >                         return -EINVAL;
> >
> > So how was the warning triggered?
> 
> I don't know what happened there, but bot provided a repro for this.

Can you provide a reproducer that will run in a 32-bit userspace 
environment?

Alan Stern