On Sun, Jul 28, 2024 at 02:37:25PM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 933069701c1b Merge tag '6.11-rc-smb3-server-fixes' of git:.. > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > console output: https://syzkaller.appspot.com/x/log.txt?x=10eb7dad980000 > kernel config: https://syzkaller.appspot.com/x/.config?x=8cdd6022e793d4ad > dashboard link: https://syzkaller.appspot.com/bug?extid=85e3ddbf0ddbfbc85f1e > compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10893645980000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10885779980000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/504e81a2120c/disk-93306970.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/320d2f3e66b3/vmlinux-93306970.xz > kernel image: https://storage.googleapis.com/syzbot-assets/65b8e1c28010/bzImage-93306970.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+85e3ddbf0ddbfbc85f1e@xxxxxxxxxxxxxxxxxxxxxxxxx > > smsusb:smsusb_probe: board id=15, interface number 6 > smsusb:siano_media_device_register: media controller created > ------------[ cut here ]------------ > usb 1-1: BOGUS urb xfer, pipe 3 != type 1 > WARNING: CPU: 0 PID: 42 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 > Call Trace: > <TASK> > smsusb_submit_urb+0x288/0x410 drivers/media/usb/siano/smsusb.c:173 > smsusb_start_streaming drivers/media/usb/siano/smsusb.c:197 [inline] > smsusb_init_device+0x856/0xe10 drivers/media/usb/siano/smsusb.c:477 > smsusb_probe+0x5e2/0x10b0 drivers/media/usb/siano/smsusb.c:575 #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 933069701c1b Index: usb-devel/drivers/media/usb/siano/smsusb.c =================================================================== --- usb-devel.orig/drivers/media/usb/siano/smsusb.c +++ usb-devel/drivers/media/usb/siano/smsusb.c @@ -410,10 +410,10 @@ static int smsusb_init_device(struct usb struct usb_endpoint_descriptor *desc = &intf->cur_altsetting->endpoint[i].desc; - if (desc->bEndpointAddress & USB_DIR_IN) { + if (usb_endpoint_is_bulk_in(desc)) { dev->in_ep = desc->bEndpointAddress; align = usb_endpoint_maxp(desc) - sizeof(struct sms_msg_hdr); - } else { + } else if (usb_endpoint_is_bulk_out(desc)) { dev->out_ep = desc->bEndpointAddress; } }
