lkml.org 
[lkml]   [2017]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: WARNING in usb_submit_urb
On Tue, Nov 7, 2017 at 6:58 PM, Alan Stern <stern@rowland.harvard.edu> wrote:
> On Tue, 7 Nov 2017, Greg KH wrote:
>
>> On Tue, Nov 07, 2017 at 08:11:13AM -0800, syzbot wrote:
>> > Hello,
>> >
>> > syzkaller hit the following crash on
>> > 36ef71cae353f88fd6e095e2aaa3e5953af1685d
>> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
>> > compiler: gcc (GCC) 7.1.1 20170620
>> > .config is attached
>> > Raw console output is attached.
>> > C reproducer is attached
>> > syzkaller reproducer is attached. See https://goo.gl/kgGztJ
>> > for information about syzkaller reproducers
>>
>> This is not a crash, you are doing a panic-on-warning, and you send
>> invalid data to the kernel and it warned about it properly and kept on
>> working :)
>>
>> Perhaps maybe not a full WARN_ON() is to be done here?
>
> I don't understand how this could have happened. The raw log explains
> the problem:
>
>> [ 15.138822] usb usb1: BOGUS urb flags, 2 --> 0
>> [ 15.139498] ------------[ cut here ]------------
>> [ 15.139955] WARNING: CPU: 3 PID: 2986 at drivers/usb/core/urb.c:498 usb_submit_urb+0xeb9/0x10f0
> ...
>> [ 15.150280] RIP: 0010:usb_submit_urb+0xeb9/0x10f0
> ...
>> [ 15.155166] proc_do_submiturb+0x1f53/0x3860
>
> The "2 --> 0" means that proc_do_submiturb() tried to submit a control
> URB (2 = PIPE_CONTROL) to an isochronous endpoint (0 = PIPE_ISOCHRONOUS).
> But right near the start of the routine we have:
>
> switch (uurb->type) {
> case USBDEVFS_URB_TYPE_CONTROL:
> if (!usb_endpoint_xfer_control(&ep->desc))
> return -EINVAL;
>
> So how was the warning triggered?

This isn't the "BOGUS urb xfer" warning, this is "BOGUS urb flags". So
2 means the URB_ISO_ASAP flag, which is passed in urb->transfer_flags
but not allowed. And as far as I understand, it gets set because uurb
(which is passed from user space) has USBDEVFS_URB_ISO_ASAP flag set
when passed to proc_do_submiturb().

>
> Alan Stern
>

\
 
 \ /
  Last update: 2017-11-09 13:20    [W:0.062 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site