On Wed, 1 Apr 2020, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: 0fa84af8 Merge tag 'usb-serial-5.7-rc1' of https://git.ker.. > git tree: https://github.com/google/kasan.git usb-fuzzer > console output: https://syzkaller.appspot.com/x/log.txt?x=12aa8567e00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=6b9c154b0c23aecf > dashboard link: https://syzkaller.appspot.com/bug?extid=db339689b2101f6f6071 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1342740be00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+db339689b2101f6f6071@xxxxxxxxxxxxxxxxxxxxxxxxx > > ------------[ cut here ]------------ > usb 2-1: BOGUS urb xfer, pipe 2 != type 2 > WARNING: CPU: 0 PID: 9241 at drivers/usb/core/urb.c:478 usb_submit_urb+0x1188/0x1460 drivers/usb/core/urb.c:478 At last! Let's get some more information about this... Alan Stern #syz test: https://github.com/google/kasan.git 0fa84af8 Index: usb-devel/drivers/usb/core/urb.c =================================================================== --- usb-devel.orig/drivers/usb/core/urb.c +++ usb-devel/drivers/usb/core/urb.c @@ -475,8 +475,9 @@ int usb_submit_urb(struct urb *urb, gfp_ /* Check that the pipe's type matches the endpoint's type */ if (usb_urb_ep_type_check(urb)) - dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n", - usb_pipetype(urb->pipe), pipetypes[xfertype]); + dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x, ep addr 0x%02x, pipe 0x%x, xfertype %d\n", + usb_pipetype(urb->pipe), pipetypes[xfertype], + ep->desc.bEndpointAddress, urb->pipe, xfertype); /* Check against a simple/standard policy */ allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT | URB_DIR_MASK |
