On Mon, Jun 24, 2024 at 04:30:26PM +0800, lcx wrote: > Dear Linux maintainers and reviewers: > > We would like to report a linux kernel bug, found by a modified version of syzkaller. > > Kernel Version: a3e18a540541325a8c8848171f71e0d45ad30b2c(6.10-rc3) > > Kernel Config: see attach, config > > reproducing program: see attach, repro.c > > Feel free to email us if any other information is needed. Hope the provided materials will help finding and fixing the bug. > > ------------------------- > > The full log crash log are as follows: > > > Syzkaller hit 'WARNING in usbtmc_probe/usb_submit_urb' bug. > > usb 1-1: config 0 descriptor?? > usb 1-1: usb_control_msg returned -71 > usbtmc 1-1:0.0: can't read capabilities > ------------[ cut here ]------------ > usb 1-1: BOGUS urb xfer, pipe 1 != type 3 > WARNING: CPU: 0 PID: 771 at drivers/usb/core/urb.c:503 usb_submit_urb+0xbf9/0x1490 drivers/usb/core/urb.c:503 > Modules linked in: > CPU: 0 PID: 771 Comm: kworker/0:2 Not tainted 6.10.0-rc3-00021-g2ef5971ff345-dirty #4 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 > Workqueue: usb_hub_wq hub_event > RIP: 0010:usb_submit_urb+0xbf9/0x1490 drivers/usb/core/urb.c:503 > Code: 84 36 02 00 00 e8 97 16 2c fb 4c 89 f7 e8 df 3c f4 fe 45 89 e8 89 e9 4c 89 fa 48 89 c6 48 c7 c7 00 47 3e 8b e8 68 89 f1 fa 90 <0f> 0b 90 90 e9 61 fa ff ff e8 69 16 2c fb 49 81 c5 c8 05 00 00 e9 > RSP: 0018:ffffc90003b87010 EFLAGS: 00010286 > RAX: 0000000000000000 RBX: ffff888017a59800 RCX: 0000000000000000 > RDX: ffff8880183c8000 RSI: ffffffff814af1dc RDI: 0000000000000001 > RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed1005905171 > R10: ffff88802c828b8b R11: 0000000000000001 R12: ffff888017a5985c > R13: 0000000000000003 R14: ffff88801539a0a8 R15: ffff88801f75e220 > FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f00c72d30a0 CR3: 000000000cd74000 CR4: 00000000000006f0 > Call Trace: > <TASK> > usbtmc_probe+0xd21/0x1a90 drivers/usb/class/usbtmc.c:2454 Ah, the usbtmc driver. Probably just needs to check for proper endpoints in the device descriptor. Can you make up a patch for this? thanks, greg k-h
