general protection fault in __dev_printk

30 views

Skip to first unread message

syzbot

unread,

Apr 17, 2019, 7:26:06 AM4/17/19

to andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, syzkall...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan/tree/usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=1014aacb200000
kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15
dashboard link: https://syzkaller.appspot.com/bug?extid=2eb9121678bdb36e6d57
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1339c81d200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2eb912...@syzkaller.appspotmail.com

usb 2-1: USB disconnect, device number 5
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 1 PID: 5497 Comm: kworker/u4:7 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
RIP: 0010:dev_name include/linux/device.h:1087 [inline]
RIP: 0010:__dev_printk+0x3f/0x215 drivers/base/core.c:3208
Code: 89 f5 53 e8 6e fe 1b fc 48 85 ed 0f 84 c9 01 00 00 e8 60 fe 1b fc 48
8d 7d 50 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74
05 e8 11 0f 53 fc 4c 8b 7d 50 4d 85 ff 75 28 e8 33
RSP: 0018:ffff8880ad107970 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffffed1015a20f35 RCX: 00000000ffffffed
RDX: 0000000000000010 RSI: ffffffff8555c710 RDI: 0000000000000080
RBP: 0000000000000030 R08: ffff8880997ae200 R09: ffffed1015a24fc9
R10: ffffed1015a24fc8 R11: ffff8880ad127e47 R12: ffffffff8f031080
R13: ffff8880ad1079c8 R14: 0000000000000000 R15: ffff88809b373700
FS: 0000000000000000(0000) GS:ffff8880ad100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b5b78b000 CR3: 00000000a496c000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
_dev_err+0xdc/0x10e drivers/base/core.c:3251
yurex_interrupt.cold+0x12e/0x13d drivers/usb/misc/yurex.c:183
__usb_hcd_giveback_urb+0x1f4/0x470 drivers/usb/core/hcd.c:1758
usb_hcd_giveback_urb+0x346/0x400 drivers/usb/core/hcd.c:1823
dummy_timer+0x100b/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1968
call_timer_fn+0x161/0x5f0 kernel/time/timer.c:1325
expire_timers kernel/time/timer.c:1362 [inline]
__run_timers kernel/time/timer.c:1681 [inline]
__run_timers kernel/time/timer.c:1649 [inline]
run_timer_softirq+0x58b/0x1400 kernel/time/timer.c:1694
__do_softirq+0x22a/0x8cd kernel/softirq.c:293
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027
</IRQ>
do_softirq.part.0+0x60/0x70 kernel/softirq.c:338
do_softirq kernel/softirq.c:330 [inline]
__local_bh_enable_ip+0x183/0x1b0 kernel/softirq.c:190
spin_unlock_bh include/linux/spinlock.h:374 [inline]
batadv_nc_purge_paths+0x26b/0x380 net/batman-adv/network-coding.c:482
batadv_nc_worker+0x2d4/0x770 net/batman-adv/network-coding.c:733
process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
kthread+0x313/0x420 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 0f952022fa10fc7b ]---
RIP: 0010:dev_name include/linux/device.h:1087 [inline]
RIP: 0010:__dev_printk+0x3f/0x215 drivers/base/core.c:3208
Code: 89 f5 53 e8 6e fe 1b fc 48 85 ed 0f 84 c9 01 00 00 e8 60 fe 1b fc 48
8d 7d 50 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74
05 e8 11 0f 53 fc 4c 8b 7d 50 4d 85 ff 75 28 e8 33
RSP: 0018:ffff8880ad107970 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffffed1015a20f35 RCX: 00000000ffffffed
RDX: 0000000000000010 RSI: ffffffff8555c710 RDI: 0000000000000080
RBP: 0000000000000030 R08: ffff8880997ae200 R09: ffffed1015a24fc9
R10: ffffed1015a24fc8 R11: ffff8880ad127e47 R12: ffffffff8f031080
R13: ffff8880ad1079c8 R14: 0000000000000000 R15: ffff88809b373700
FS: 0000000000000000(0000) GS:ffff8880ad100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b5b78b000 CR3: 00000000a496c000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

syzbot

unread,

Apr 18, 2019, 1:07:07 PM4/18/19

to andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, syzkall...@googlegroups.com

syzbot has found a reproducer for the following crash on:

HEAD commit: d34f9519 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan/tree/usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=10adfe6b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c73d1bb5aeaeae20

dashboard link: https://syzkaller.appspot.com/bug?extid=2eb9121678bdb36e6d57
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145cb7e3200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f8bd2d200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2eb912...@syzkaller.appspotmail.com

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71
usb 1-1: USB disconnect, device number 112
yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI

CPU: 1 PID: 5402 Comm: udevd Not tainted 5.1.0-rc5-319617-gd34f951 #4

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

RIP: 0010:dev_name include/linux/device.h:1087 [inline]
RIP: 0010:__dev_printk+0x3f/0x215 drivers/base/core.c:3208

Code: 89 f5 53 e8 1e 24 1c fc 48 85 ed 0f 84 c9 01 00 00 e8 10 24 1c fc 48

8d 7d 50 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74

05 e8 31 39 53 fc 4c 8b 7d 50 4d 85 ff 75 28 e8 e3
RSP: 0018:ffff8880ad107930 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffffed1015a20f2d RCX: 00000000ffffffed
RDX: 0000000000000010 RSI: ffffffff85559bf0 RDI: 0000000000000080
RBP: 0000000000000030 R08: ffff888091578000 R09: ffffed1015a24fc9
R10: ffffed1015a24fc8 R11: ffff8880ad127e47 R12: ffffffff8f031a00
R13: ffff8880ad107988 R14: 0000000000000000 R15: ffff88809b9b1600
FS: 00007fcff04907a0(0000) GS:ffff8880ad100000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fcff0496000 CR3: 0000000097678000 CR4: 00000000001406e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
_dev_err+0xdc/0x10e drivers/base/core.c:3251
yurex_interrupt.cold+0x12e/0x13d drivers/usb/misc/yurex.c:183
__usb_hcd_giveback_urb+0x1f4/0x470 drivers/usb/core/hcd.c:1758
usb_hcd_giveback_urb+0x346/0x400 drivers/usb/core/hcd.c:1823
dummy_timer+0x100b/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1968
call_timer_fn+0x161/0x5f0 kernel/time/timer.c:1325
expire_timers kernel/time/timer.c:1362 [inline]
__run_timers kernel/time/timer.c:1681 [inline]
__run_timers kernel/time/timer.c:1649 [inline]
run_timer_softirq+0x58b/0x1400 kernel/time/timer.c:1694
__do_softirq+0x22a/0x8cd kernel/softirq.c:293

invoke_softirq kernel/softirq.c:374 [inline]
irq_exit+0x187/0x1b0 kernel/softirq.c:414
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0xfe/0x4a0 arch/x86/kernel/apic/apic.c:1062
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
</IRQ>
RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:250 [inline]
RIP: 0010:do_syscall_64+0x115/0x4f0 arch/x86/entry/common.c:293
Code: 03 00 00 48 89 45 50 e8 99 2c 71 00 48 b8 00 00 00 00 00 fc ff df 65
48 8b 1c 25 00 ee 01 00 48 89 da 48 c1 ea 03 80 3c 02 00 <0f> 85 6f 03 00
00 4c 8b 23 9c 58 0f 1f 44 00 00 25 00 02 00 00 31
RSP: 0018:ffff88809fceff28 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff888091578000 RCX: 1ffff11013f9dff5
RDX: 1ffff110122af000 RSI: ffffffff81009367 RDI: ffff88809fceffa8
RBP: ffff88809fceff58 R08: 0000000000000000 R09: 0000000000000001
R10: ffffed1015a25c27 R11: ffff8880ad12e13b R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fcfefb99577
Code: f0 ff ff 77 02 f3 c3 48 8b 15 bd 38 2b 00 f7 d8 64 89 02 83 c8 ff c3
90 90 90 90 90 90 90 90 90 90 90 90 b8 59 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 8b 0d 91 38 2b 00 31 d2 48 29 c2 64
RSP: 002b:00007ffe20473c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000059
RAX: ffffffffffffffea RBX: 0000000000626250 RCX: 00007fcfefb99577
RDX: 0000000000000400 RSI: 00007ffe20473c30 RDI: 00007ffe20474110
RBP: 0000000000635fd0 R08: 0000000000635fd0 R09: 75642f6d726f6674
R10: 2e6364755f796d6d R11: 0000000000000246 R12: 00007ffe20474110
R13: 0000000000000400 R14: 0000000000626250 R15: 000000000000000b
Modules linked in:
---[ end trace 9119e43ae4e6c65e ]---

RIP: 0010:dev_name include/linux/device.h:1087 [inline]
RIP: 0010:__dev_printk+0x3f/0x215 drivers/base/core.c:3208

Code: 89 f5 53 e8 1e 24 1c fc 48 85 ed 0f 84 c9 01 00 00 e8 10 24 1c fc 48

8d 7d 50 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fcff0496000 CR3: 0000000097678000 CR4: 00000000001406e0

Alan Stern

unread,

Apr 19, 2019, 4:44:28 PM4/19/19

to syzbot, andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, syzkall...@googlegroups.com

The problem is that the device can be unregistered before the interrupt
URB is killed. I don't know if the patch below is the right way to fix
this, but it ought to do the job.

Alan Stern

#syz test: https://github.com/google/kasan.git usb-fuzzer

--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -314,6 +314,7 @@ static void yurex_disconnect(struct usb_
usb_deregister_dev(interface, &yurex_class);

/* prevent more I/O from starting */
+ usb_poison_urb(dev->urb);
mutex_lock(&dev->io_mutex);
dev->interface = NULL;
mutex_unlock(&dev->io_mutex);

syzbot

unread,

Apr 19, 2019, 5:22:01 PM4/19/19

to andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer still triggered
crash:
INFO: rcu detected stall in dummy_timer

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
rcu: INFO: rcu_sched self-detected stall on CPU
rcu: 0-....: (9525 ticks this GP) idle=b9e/1/0x4000000000000002
softirq=12303/12303 fqs=3519
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
rcu: (t=10501 jiffies g=8933 q=1449)
NMI backtrace for cpu 0
CPU: 0 PID: 5568 Comm: kworker/0:4 Not tainted 5.1.0-rc5-gd34f951-dirty #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

Workqueue: usb_hub_wq hub_event
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe8/0x16e lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x48/0x87 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1a6/0x1bd lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x16e/0x1b8 kernel/rcu/tree.c:1223
print_cpu_stall kernel/rcu/tree.c:1360 [inline]
check_cpu_stall kernel/rcu/tree.c:1434 [inline]
rcu_pending kernel/rcu/tree.c:3103 [inline]
rcu_sched_clock_irq.cold+0x4cf/0x7d0 kernel/rcu/tree.c:2544
update_process_times+0x2f/0x70 kernel/time/timer.c:1635
tick_sched_handle+0xa0/0x180 kernel/time/tick-sched.c:161
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x2d7/0xbd0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x2ed/0x740 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0xdd/0x4a0 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:767
[inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160
[inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x50/0x60
kernel/locking/spinlock.c:184
Code: 52 f3 f6 c7 02 75 19 48 89 df 57 9d 0f 1f 44 00 00 e8 04 d0 72 f3 65
ff 0d 3d f9 fb 71 5b 5d c3 e8 35 ce 72 f3 48 89 df 57 9d <0f> 1f 44 00 00
eb e5 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55
RSP: 0018:ffff8880ad007b60 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: 0000000000000206 RCX: 1ffff110130a543a
RDX: 0000000000000000 RSI: ffff88809852a1b0 RDI: 0000000000000206
RBP: ffff8882165f2100 R08: ffff888098529880 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809faa1a38
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880a60f5f00
spin_unlock_irqrestore include/linux/spinlock.h:384 [inline]
dummy_timer+0x146e/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1982

call_timer_fn+0x161/0x5f0 kernel/time/timer.c:1325
expire_timers kernel/time/timer.c:1362 [inline]
__run_timers kernel/time/timer.c:1681 [inline]
__run_timers kernel/time/timer.c:1649 [inline]
run_timer_softirq+0x58b/0x1400 kernel/time/timer.c:1694
__do_softirq+0x22a/0x8cd kernel/softirq.c:293

do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027
</IRQ>
do_softirq.part.0+0x60/0x70 kernel/softirq.c:338
do_softirq kernel/softirq.c:330 [inline]
__local_bh_enable_ip+0x183/0x1b0 kernel/softirq.c:190
spin_unlock_bh include/linux/spinlock.h:374 [inline]

peernet2id+0x94/0xc0 net/core/net_namespace.c:266
do_one_broadcast net/netlink/af_netlink.c:1471 [inline]
netlink_broadcast_filtered+0x51b/0xb70 net/netlink/af_netlink.c:1518
netlink_broadcast+0x3a/0x50 net/netlink/af_netlink.c:1542
uevent_net_broadcast_untagged lib/kobject_uevent.c:330 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:408 [inline]
kobject_uevent_env+0x82c/0x13d0 lib/kobject_uevent.c:589
driver_bound+0x1b9/0x320 drivers/base/dd.c:355
really_probe+0x373/0xb10 drivers/base/dd.c:542
driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
__device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
__device_attach+0x223/0x3a0 drivers/base/dd.c:844
bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
device_add+0xad2/0x16e0 drivers/base/core.c:2106
usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
really_probe+0x2da/0xb10 drivers/base/dd.c:509
driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
__device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
__device_attach+0x223/0x3a0 drivers/base/dd.c:844
bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
device_add+0xad2/0x16e0 drivers/base/core.c:2106
usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
hub_port_connect drivers/usb/core/hub.c:5089 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
port_event drivers/usb/core/hub.c:5350 [inline]
hub_event+0x1398/0x3b00 drivers/usb/core/hub.c:5432

process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
kthread+0x313/0x420 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 6-1:0.150: yurex_interrupt - unknown status received: -71

yurex 1-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 2-1

Tested on:

commit: d34f9519 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan/tree/usb-fuzzer

console output: https://syzkaller.appspot.com/x/log.txt?x=17b2c96b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c73d1bb5aeaeae20

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=134d3003200000

Alan Stern

unread,

Apr 22, 2019, 11:39:07 AM4/22/19

to syzbot, andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, syzkall...@googlegroups.com

Well, at least it's a different kind of crash from before. Now the
question is why isn't yurex_disconnect() doing its job. More debugging
is needed.

Alan Stern

#syz test: https://github.com/google/kasan.git usb-fuzzer

--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c

@@ -178,6 +178,10 @@ static void yurex_interrupt(struct urb *
}

exit:
+ if (!usb_get_intfdata(dev->interface)) {
+ dev_info(&dev->interface->dev "%s unbound\n", __func__);
+ return;
+ }
retval = usb_submit_urb(dev->urb, GFP_ATOMIC);
if (retval) {
dev_err(&dev->interface->dev, "%s - usb_submit_urb failed: %d\n",
@@ -309,11 +313,15 @@ static void yurex_disconnect(struct usb_

dev = usb_get_intfdata(interface);
usb_set_intfdata(interface, NULL);
+ dev_info(&interface->dev, "%s\n", __func__);

/* give back our minor */

usb_deregister_dev(interface, &yurex_class);

/* prevent more I/O from starting */

+ dev_info(&interface->dev, "Before poison\n");
+ usb_poison_urb(dev->urb);
+ dev_info(&interface->dev, "After poison\n");

syzbot

unread,

Apr 22, 2019, 11:55:01 AM4/22/19

to andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com

Hello,

syzbot tried to test the proposed patch but build/boot failed:

ers/net/ethernet/sfc/ethtool.o
CC drivers/net/ethernet/sun/cassini.o
CC drivers/scsi/qla2xxx/tcm_qla2xxx.o
CC drivers/net/ethernet/ti/tlan.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msppp/gt215.o
drivers/net/ethernet/tehuti/tehuti.c: In function ‘bdx_tx_map_skb’:
drivers/net/ethernet/tehuti/tehuti.c:1492:20: warning: taking address of
packed member of ‘struct txd_desc’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
1492 | struct pbl *pbl = &txdd->pbl[0];
| ^~~~~~~~~~~~~
CC drivers/net/ethernet/via/via-rhine.o
CC drivers/net/ethernet/via/via-velocity.o
CC drivers/scsi/qla4xxx/ql4_83xx.o
GEN drivers/scsi/scsi_devinfo_tbl.c
CC drivers/scsi/scsi_scan.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msppp/gf100.o
CC drivers/scsi/scsi_devinfo.o
CC drivers/scsi/scsi_netlink.o
CC drivers/scsi/scsi_sysctl.o
CC drivers/net/ethernet/sfc/ptp.o
CC drivers/scsi/scsi_proc.o
CC drivers/video/fbdev/efifb.o
CC drivers/video/fbdev/vga16fb.o
CC drivers/video/fbdev/vfb.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msvld/base.o
AR drivers/net/ethernet/qlogic/qed/built-in.a
CC drivers/scsi/scsi_debugfs.o
CC drivers/scsi/scsi_trace.o
CC drivers/scsi/scsi_logging.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msvld/g98.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msvld/gt215.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msvld/mcp89.o
CC drivers/xen/xlate_mmu.o
AR drivers/net/ethernet/qlogic/qlcnic/built-in.a
AR drivers/net/ethernet/qlogic/built-in.a
CC drivers/gpu/drm/nouveau/nvkm/engine/msvld/gf100.o
CC drivers/gpu/drm/nouveau/nvkm/engine/nvdec/base.o
CC drivers/gpu/drm/nouveau/nvkm/engine/msvld/gk104.o
AR drivers/net/ethernet/wiznet/built-in.a
CC drivers/net/ethernet/sfc/tx_tso.o
CC drivers/scsi/scsi_pm.o
CC drivers/scsi/scsi_dh.o
CC drivers/net/ethernet/sun/niu.o
AR drivers/net/ethernet/tehuti/built-in.a
CC drivers/scsi/scsi_common.o
CC drivers/xen/xen-front-pgdir-shbuf.o
CC drivers/scsi/raid_class.o
CC drivers/net/ethernet/sfc/mcdi.o
CC drivers/net/ethernet/xircom/xirc2ps_cs.o
CC drivers/scsi/scsi_transport_spi.o
CC drivers/gpu/drm/nouveau/nvkm/engine/nvdec/gp102.o
CC drivers/scsi/scsi_transport_fc.o
CC drivers/net/ethernet/sfc/mcdi_port.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/base.o
CC drivers/scsi/scsi_transport_iscsi.o
CC drivers/net/ethernet/jme.o
CC drivers/net/ethernet/sfc/mcdi_mon.o
CC drivers/net/ethernet/sfc/sriov.o
CC drivers/net/ethernet/fealnx.o
CC drivers/scsi/scsi_transport_sas.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/nv50.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.o
AR drivers/scsi/qla4xxx/built-in.a
CC drivers/scsi/scsi_transport_srp.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/g84.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/gt200.o
AR drivers/video/fbdev/built-in.a
CC drivers/scsi/libiscsi.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/gt215.o
AR drivers/video/built-in.a
CC drivers/scsi/libiscsi_tcp.o
CC drivers/scsi/iscsi_tcp.o
AR drivers/net/ethernet/ti/built-in.a
CC drivers/scsi/iscsi_boot_sysfs.o
CC drivers/scsi/advansys.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/gf100.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/gf108.o
CC drivers/net/ethernet/sfc/siena_sriov.o
CC drivers/net/ethernet/sfc/ef10_sriov.o
CC drivers/scsi/BusLogic.o
AR drivers/xen/built-in.a
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/gf117.o
CC drivers/scsi/dpt_i2o.o
CC drivers/gpu/drm/nouveau/nvkm/engine/pm/gk104.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sec/g98.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sec2/gp102.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sec2/tu102.o
AR drivers/net/ethernet/via/built-in.a
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/base.o
AR drivers/net/ethernet/xircom/built-in.a
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/nv10.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/nv04.o
CC drivers/scsi/ips.o
CC drivers/scsi/qla1280.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/chan.o
CC drivers/gpu/drm/nouveau/nvkm/engine/sw/nvsw.o
CC drivers/scsi/dmx3191d.o
CC drivers/gpu/drm/nouveau/nvkm/engine/vp/g84.o
CC drivers/scsi/hpsa.o
CC drivers/scsi/dc395x.o
CC drivers/gpu/drm/nouveau/nouveau_acpi.o
CC drivers/gpu/drm/nouveau/nouveau_debugfs.o
CC drivers/gpu/drm/nouveau/nouveau_drm.o
CC drivers/gpu/drm/nouveau/nouveau_hwmon.o
CC drivers/gpu/drm/nouveau/nouveau_ioc32.o
CC drivers/gpu/drm/nouveau/nouveau_led.o
CC drivers/gpu/drm/nouveau/nouveau_nvif.o
CC drivers/scsi/esp_scsi.o
CC drivers/scsi/am53c974.o
CC drivers/scsi/megaraid.o
CC drivers/gpu/drm/nouveau/nouveau_usif.o
CC drivers/gpu/drm/nouveau/nouveau_vga.o
CC drivers/scsi/atp870u.o
CC drivers/gpu/drm/nouveau/nouveau_bo.o
CC drivers/scsi/gdth.o
CC drivers/scsi/initio.o
drivers/scsi/megaraid.c: In function ‘mega_build_cmd’:
drivers/scsi/megaraid.c:721:5: warning: taking address of packed member of
‘struct <anonymous>’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
721 | &pthru->dataxferaddr, &pthru->dataxferlen);
| ^~~~~~~~~~~~~~~~~~~~
drivers/scsi/megaraid.c:721:27: warning: taking address of packed member of
‘struct <anonymous>’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
721 | &pthru->dataxferaddr, &pthru->dataxferlen);
| ^~~~~~~~~~~~~~~~~~~
drivers/scsi/megaraid.c:856:6: warning: taking address of packed member of
‘struct mbox_out’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
856 | (u32 *)&mbox->m_out.xferaddr, &seg);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/megaraid.c: In function ‘mega_prepare_passthru’:
drivers/scsi/megaraid.c:999:5: warning: taking address of packed member of
‘struct <anonymous>’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
999 | &pthru->dataxferaddr, &pthru->dataxferlen);
| ^~~~~~~~~~~~~~~~~~~~
drivers/scsi/megaraid.c:999:27: warning: taking address of packed member of
‘struct <anonymous>’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
999 | &pthru->dataxferaddr, &pthru->dataxferlen);
| ^~~~~~~~~~~~~~~~~~~
drivers/scsi/megaraid.c: In function ‘mega_prepare_extpassthru’:
drivers/scsi/megaraid.c:1062:5: warning: taking address of packed member of
‘struct <anonymous>’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
1062 | &epthru->dataxferaddr, &epthru->dataxferlen);
| ^~~~~~~~~~~~~~~~~~~~~
drivers/scsi/megaraid.c:1062:28: warning: taking address of packed member
of ‘struct <anonymous>’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
1062 | &epthru->dataxferaddr, &epthru->dataxferlen);
| ^~~~~~~~~~~~~~~~~~~~
CC drivers/scsi/a100u2w.o
CC drivers/scsi/3w-xxxx.o
CC drivers/gpu/drm/nouveau/nouveau_gem.o
CC drivers/scsi/3w-9xxx.o
CC drivers/gpu/drm/nouveau/nouveau_mem.o
CC drivers/scsi/3w-sas.o
AR drivers/net/ethernet/sfc/built-in.a
CC drivers/gpu/drm/nouveau/nouveau_prime.o
CC drivers/gpu/drm/nouveau/nouveau_sgdma.o
CC drivers/scsi/hptiop.o
CC drivers/scsi/ipr.o
CC drivers/scsi/stex.o
CC drivers/gpu/drm/nouveau/nouveau_ttm.o
CC drivers/scsi/mvumi.o
CC drivers/scsi/pmcraid.o
CC drivers/scsi/virtio_scsi.o
CC drivers/scsi/vmw_pvscsi.o
drivers/scsi/ipr.c: In function ‘ipr_handle_config_change’:
drivers/scsi/ipr.c:1453:22: warning: taking address of packed member of
‘struct ipr_hostrcb_cfg_ch_not’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
1453 | cfgtew.u.cfgte64 = &hostrcb->hcam.u.ccn.u.cfgte64;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/ipr.c: In function ‘ipr_log_sis64_fabric_error’:
drivers/scsi/ipr.c:2401:23: warning: taking address of packed member of
‘struct ipr_hostrcb_type_30_error’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
2401 | for (i = 0, fabric = error->desc; i < error->num_entries; i++) {
| ^~~~~
drivers/scsi/ipr.c: In function ‘ipr_dump_ioa_type_data’:
drivers/scsi/ipr.c:3067:26: warning: taking address of packed member of
‘struct ipr_driver_dump’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
3067 | ipr_init_dump_entry_hdr(&driver_dump->ioa_type_entry.hdr);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/ipr.c: In function ‘ipr_dump_version_data’:
drivers/scsi/ipr.c:3091:26: warning: taking address of packed member of
‘struct ipr_driver_dump’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
3091 | ipr_init_dump_entry_hdr(&driver_dump->version_entry.hdr);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/ipr.c: In function ‘ipr_dump_trace_data’:
drivers/scsi/ipr.c:3112:26: warning: taking address of packed member of
‘struct ipr_driver_dump’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
3112 | ipr_init_dump_entry_hdr(&driver_dump->trace_entry.hdr);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/ipr.c: In function ‘ipr_dump_location_data’:
drivers/scsi/ipr.c:3133:26: warning: taking address of packed member of
‘struct ipr_dump_location_entry’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
3133 | ipr_init_dump_entry_hdr(&driver_dump->location_entry.hdr);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AR drivers/scsi/qla2xxx/built-in.a
drivers/scsi/ipr.c: In function ‘ipr_build_ioadl’:
drivers/scsi/ipr.c:6017:11: warning: taking address of packed member of
‘struct ipr_ioarcb_add_data’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
6017 | ioadl = ioarcb->u.add_data.u.ioadl;
| ^~~~~~
CC drivers/gpu/drm/nouveau/nouveau_vmm.o
CC drivers/gpu/drm/nouveau/nouveau_backlight.o
drivers/scsi/ipr.c: In function ‘ipr_check_term_power’:
drivers/scsi/ipr.c:7452:8: warning: taking address of packed member of
‘struct ipr_mode_page28’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
7452 | bus = mode_page->bus;
| ^~~~~~~~~
drivers/scsi/ipr.c: In function ‘ipr_modify_ioafp_mode_page_28’:
drivers/scsi/ipr.c:7514:20: warning: taking address of packed member of
‘struct ipr_mode_page28’ may result in an unaligned pointer value
[-Waddress-of-packed-member]
7514 | for (i = 0, bus = mode_page->bus;
| ^~~~~~~~~
CC drivers/gpu/drm/nouveau/nouveau_bios.o
CC drivers/scsi/xen-scsifront.o
CC drivers/gpu/drm/nouveau/nouveau_connector.o
CC drivers/gpu/drm/nouveau/nouveau_display.o
CC drivers/scsi/storvsc_drv.o
CC drivers/scsi/wd719x.o
drivers/scsi/storvsc_drv.c: In function ‘storvsc_on_channel_callback’:
drivers/scsi/storvsc_drv.c:1182:24: warning: taking address of packed
member of ‘struct vmpacket_descriptor’ may result in an unaligned pointer
value [-Waddress-of-packed-member]
1182 | ((unsigned long)desc->trans_id);
| ~~~~^~~~~~~~~~
CC drivers/scsi/st.o
CC drivers/gpu/drm/nouveau/nouveau_dp.o
CC drivers/scsi/osst.o
CC drivers/gpu/drm/nouveau/nouveau_fbcon.o
CC drivers/scsi/sd.o
CC drivers/gpu/drm/nouveau/nv04_fbcon.o
CC drivers/scsi/sd_dif.o
CC drivers/scsi/sd_zbc.o
CC drivers/gpu/drm/nouveau/nv50_fbcon.o
CC drivers/gpu/drm/nouveau/nvc0_fbcon.o
CC drivers/gpu/drm/nouveau/dispnv04/arb.o
CC drivers/gpu/drm/nouveau/dispnv04/crtc.o
CC drivers/gpu/drm/nouveau/dispnv04/cursor.o
CC drivers/gpu/drm/nouveau/dispnv04/dac.o
CC drivers/scsi/sr.o
CC drivers/gpu/drm/nouveau/dispnv04/dfp.o
CC drivers/scsi/sr_ioctl.o
CC drivers/gpu/drm/nouveau/dispnv04/disp.o
CC drivers/scsi/sr_vendor.o
CC drivers/gpu/drm/nouveau/dispnv04/hw.o
CC drivers/scsi/sg.o
CC drivers/gpu/drm/nouveau/dispnv04/overlay.o
CC drivers/scsi/ch.o
CC drivers/scsi/ses.o
CC drivers/gpu/drm/nouveau/dispnv04/tvmodesnv17.o
CC drivers/scsi/scsi_sysfs.o
CC drivers/gpu/drm/nouveau/dispnv04/tvnv04.o
CC drivers/gpu/drm/nouveau/dispnv04/tvnv17.o
CC drivers/gpu/drm/nouveau/dispnv50/disp.o
CC drivers/gpu/drm/nouveau/dispnv50/lut.o
CC drivers/gpu/drm/nouveau/dispnv50/core.o
CC drivers/gpu/drm/nouveau/dispnv50/core507d.o
CC drivers/gpu/drm/nouveau/dispnv50/core907d.o
CC drivers/gpu/drm/nouveau/dispnv50/core827d.o
CC drivers/gpu/drm/nouveau/dispnv50/core917d.o
CC drivers/gpu/drm/nouveau/dispnv50/corec37d.o
CC drivers/gpu/drm/nouveau/dispnv50/corec57d.o
CC drivers/gpu/drm/nouveau/dispnv50/dac907d.o
CC drivers/gpu/drm/nouveau/dispnv50/dac507d.o
CC drivers/gpu/drm/nouveau/dispnv50/pior507d.o
CC drivers/gpu/drm/nouveau/dispnv50/sor507d.o
CC drivers/gpu/drm/nouveau/dispnv50/sor907d.o
CC drivers/gpu/drm/nouveau/dispnv50/sorc37d.o
CC drivers/gpu/drm/nouveau/dispnv50/head.o
CC drivers/gpu/drm/nouveau/dispnv50/head507d.o
CC drivers/gpu/drm/nouveau/dispnv50/head827d.o
CC drivers/gpu/drm/nouveau/dispnv50/head907d.o
CC drivers/gpu/drm/nouveau/dispnv50/head917d.o
CC drivers/gpu/drm/nouveau/dispnv50/headc37d.o
CC drivers/gpu/drm/nouveau/dispnv50/headc57d.o
CC drivers/gpu/drm/nouveau/dispnv50/wimm.o
CC drivers/gpu/drm/nouveau/dispnv50/wimmc37b.o
CC drivers/gpu/drm/nouveau/dispnv50/wndw.o
CC drivers/gpu/drm/nouveau/dispnv50/wndwc37e.o
AR drivers/net/ethernet/sun/built-in.a
AR drivers/net/ethernet/built-in.a
CC drivers/gpu/drm/nouveau/dispnv50/base.o
CC drivers/gpu/drm/nouveau/dispnv50/wndwc57e.o
CC drivers/gpu/drm/nouveau/dispnv50/base507c.o
AR drivers/net/built-in.a
CC drivers/gpu/drm/nouveau/dispnv50/base827c.o
CC drivers/gpu/drm/nouveau/dispnv50/base907c.o
CC drivers/gpu/drm/nouveau/dispnv50/base917c.o
CC drivers/gpu/drm/nouveau/dispnv50/curs.o
CC drivers/gpu/drm/nouveau/dispnv50/curs507a.o
CC drivers/gpu/drm/nouveau/dispnv50/curs907a.o
CC drivers/gpu/drm/nouveau/dispnv50/cursc37a.o
CC drivers/gpu/drm/nouveau/dispnv50/oimm.o
CC drivers/gpu/drm/nouveau/dispnv50/oimm507b.o
CC drivers/gpu/drm/nouveau/dispnv50/ovly.o
CC drivers/gpu/drm/nouveau/dispnv50/ovly507e.o
CC drivers/gpu/drm/nouveau/dispnv50/ovly827e.o
CC drivers/gpu/drm/nouveau/dispnv50/ovly907e.o
CC drivers/gpu/drm/nouveau/nouveau_abi16.o
CC drivers/gpu/drm/nouveau/dispnv50/ovly917e.o
CC drivers/gpu/drm/nouveau/nouveau_chan.o
CC drivers/gpu/drm/nouveau/nouveau_fence.o
CC drivers/gpu/drm/nouveau/nouveau_dma.o
CC drivers/gpu/drm/nouveau/nv04_fence.o
CC drivers/gpu/drm/nouveau/nv10_fence.o
CC drivers/gpu/drm/nouveau/nv17_fence.o
CC drivers/gpu/drm/nouveau/nv50_fence.o
CC drivers/gpu/drm/nouveau/nv84_fence.o
CC drivers/gpu/drm/nouveau/nvc0_fence.o
AR drivers/gpu/drm/nouveau/built-in.a
AR drivers/gpu/drm/built-in.a
AR drivers/gpu/built-in.a
AR drivers/scsi/built-in.a
Makefile:1051: recipe for target 'drivers' failed
make: *** [drivers] Error 2

Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15ba68b0a00000

Tested on:

commit: d34f9519 usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan/tree/usb-fuzzer

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=11daff08a00000

Alan Stern

unread,

Apr 22, 2019, 12:07:21 PM4/22/19

to syzbot, andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, syzkall...@googlegroups.com

On Mon, 22 Apr 2019, syzbot wrote:

> Hello,
>
> syzbot tried to test the proposed patch but build/boot failed:

Typo in the patch (missing comma). Let's try again.

Alan Stern

#syz test: https://github.com/google/kasan.git usb-fuzzer

--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -178,6 +178,10 @@ static void yurex_interrupt(struct urb *
}

exit:
+ if (!usb_get_intfdata(dev->interface)) {

+ dev_info(&dev->interface->dev, "%s unbound\n", __func__);

syzbot

unread,

Apr 22, 2019, 12:44:01 PM4/22/19

to andre...@google.com, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, raf...@kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer still triggered
crash:
INFO: rcu detected stall in dummy_timer

yurex 4-1:0.150: yurex_interrupt - unknown status received: -71

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71
yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

yurex 4-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71

rcu: INFO: rcu_sched self-detected stall on CPU

rcu: 0-....: (10463 ticks this GP) idle=9f6/1/0x4000000000000002
softirq=21841/21841 fqs=5155
rcu: (t=10500 jiffies g=24569 q=18693)

NMI backtrace for cpu 0

CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.1.0-rc5-gd34f951-dirty #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe8/0x16e lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x48/0x87 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1a6/0x1bd lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x16e/0x1b8 kernel/rcu/tree.c:1223
print_cpu_stall kernel/rcu/tree.c:1360 [inline]
check_cpu_stall kernel/rcu/tree.c:1434 [inline]
rcu_pending kernel/rcu/tree.c:3103 [inline]
rcu_sched_clock_irq.cold+0x4cf/0x7d0 kernel/rcu/tree.c:2544
update_process_times+0x2f/0x70 kernel/time/timer.c:1635
tick_sched_handle+0xa0/0x180 kernel/time/tick-sched.c:161
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x2d7/0xbd0 kernel/time/hrtimer.c:1451
hrtimer_interrupt+0x2ed/0x740 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0xdd/0x4a0 arch/x86/kernel/apic/apic.c:1060
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807

</IRQ>

RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:767
[inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160
[inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x50/0x60
kernel/locking/spinlock.c:184
Code: 52 f3 f6 c7 02 75 19 48 89 df 57 9d 0f 1f 44 00 00 e8 04 d0 72 f3 65
ff 0d 3d f9 fb 71 5b 5d c3 e8 35 ce 72 f3 48 89 df 57 9d <0f> 1f 44 00 00
eb e5 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55

RSP: 0018:ffff8880a84979e0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: 0000000000000206 RCX: 1ffff1101508ea3c
RDX: 0000000000000000 RSI: ffff8880a84751c0 RDI: 0000000000000206
RBP: ffff8882173b0000 R08: ffff8880a8474980 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888216c12c38
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880925d4200

spin_unlock_irqrestore include/linux/spinlock.h:384 [inline]
dummy_timer+0x146e/0x32c0 drivers/usb/gadget/udc/dummy_hcd.c:1982
call_timer_fn+0x161/0x5f0 kernel/time/timer.c:1325
expire_timers kernel/time/timer.c:1362 [inline]
__run_timers kernel/time/timer.c:1681 [inline]
__run_timers kernel/time/timer.c:1649 [inline]
run_timer_softirq+0x58b/0x1400 kernel/time/timer.c:1694
__do_softirq+0x22a/0x8cd kernel/softirq.c:293

run_ksoftirqd kernel/softirq.c:655 [inline]
run_ksoftirqd+0x30/0x60 kernel/softirq.c:647
smpboot_thread_fn+0x3f6/0x820 kernel/smpboot.c:164

kthread+0x313/0x420 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

yurex 3-1:0.150: yurex_interrupt - unknown status received: -71

yurex 4-1:0.150: yurex_interrupt - unknown status received: -71

yurex 5-1:0.150: yurex_interrupt - unknown status received: -71
yurex 3-1:0.150: yurex_interrupt - unknown status received: -71