[syzbot] [staging?] [usb?] WARNING in r8712_usb_write_mem/usb_submit_urb (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1722389b0d86 Merge tag 'net-6.11-rc1' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=12d2a623980000
kernel config: https://syzkaller.appspot.com/x/.config?x=e3044dca4d5f6dbe
dashboard link: https://syzkaller.appspot.com/bug?extid=ca2eaaadab55de6a5a42
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123da96d980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1560c223980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/78a5695ed7e2/disk-1722389b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1507b4c5000d/vmlinux-1722389b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/449aa9e94d6b/bzImage-1722389b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ca2eaa...@syzkaller.appspotmail.com

------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
Modules linked in:
CPU: 0 UID: 0 PID: 2583 Comm: dhcpcd Not tainted 6.10.0-syzkaller-g1722389b0d86 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
Code: 84 3c 02 00 00 e8 a5 eb fe fc 4c 89 ef e8 2d 21 d7 fe 45 89 e0 89 e9 4c 89 f2 48 89 c6 48 c7 c7 e0 17 a0 87 e8 96 dc c4 fc 90 <0f> 0b 90 90 e9 e9 f8 ff ff e8 77 eb fe fc 49 81 c4 c0 05 00 00 e9
RSP: 0018:ffffc900015b7678 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888103e8ad00 RCX: ffffffff81194ce9
RDX: ffff88810e70ba00 RSI: ffffffff81194cf6 RDI: 0000000000000001
RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888100fec0a8 R14: ffff888109f01e00 R15: ffff888103e8ad7c
FS: 00007f3757320740(0000) GS:ffff8881f6200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd527ba8870 CR3: 000000010c766000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170
rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203
rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394
netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397
__dev_open+0x2d4/0x4e0 net/core/dev.c:1474
__dev_change_flags+0x561/0x720 net/core/dev.c:8837
dev_change_flags+0x8f/0x160 net/core/dev.c:8909
devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177
inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003
sock_do_ioctl+0x116/0x280 net/socket.c:1222
sock_ioctl+0x22e/0x6c0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f37573eed49
Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
RSP: 002b:00007ffe0c834f48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f37573206c0 RCX: 00007f37573eed49
RDX: 00007ffe0c845138 RSI: 0000000000008914 RDI: 0000000000000005
RBP: 00007ffe0c8552f8 R08: 00007ffe0c8450f8 R09: 00007ffe0c8450a8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe0c845138 R14: 0000000000000028 R15: 0000000000008914
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Nam Cao]

On Fri, Aug 02, 2024 at 08:01:38PM -0700, syzbot wrote:
> usb 1-1: BOGUS urb xfer, pipe 3 != type 1
> WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503

...

> Call Trace:
> <TASK>
> r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170
> rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203
> rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
> rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394
> netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 1722389b0d86

diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c
index 1148075f0cd6..80d8c462fafa 100644
--- a/drivers/staging/rtl8712/hal_init.c
+++ b/drivers/staging/rtl8712/hal_init.c
@@ -152,6 +152,10 @@ static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength)
return _SUCCESS;
}

+static const int pipetypes[4] = {
+ PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+};
+
static u8 rtl8712_dl_fw(struct _adapter *adapter)
{
sint i;
@@ -167,6 +171,29 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
u32 txdscp_sz = sizeof(struct tx_desc);
u8 ret = _FAIL;

+ struct intf_hdl *hdl = &adapter->pio_queue->intf;
+ struct intf_priv *pintfpriv = hdl->pintfpriv;
+ struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev;
+ struct usb_device *pusbd = pdvobj->pusbdev;
+
+ for (int i = 0; i < 16; ++i) {
+ struct usb_host_endpoint *ep = pusbd->ep_in[i];
+ if (!ep)
+ continue;
+ int xfertype = usb_endpoint_type(&ep->desc);
+ int type = pipetypes[xfertype];
+ pr_err("ep_in[%d] type=%d\n", i, type);
+ }
+
+ for (int i = 0; i < 16; ++i) {
+ struct usb_host_endpoint *ep = pusbd->ep_out[i];
+ if (!ep)
+ continue;
+ int xfertype = usb_endpoint_type(&ep->desc);
+ int type = pipetypes[xfertype];
+ pr_err("ep_out[%d] type=%d\n", i, type);
+ }
+
ulfilelength = rtl871x_open_fw(adapter, &mappedfw);
if (mappedfw && (ulfilelength > 0)) {
update_fwhdr(&fwhdr, mappedfw);
@@ -200,6 +227,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
txdesc->txdw0 |= cpu_to_le32(dump_imem_sz &
0x0000ffff);
memcpy(payload, ptr, dump_imem_sz);
+ pr_err("%s:%d\n", __func__, __LINE__);
r8712_write_mem(adapter, RTL8712_DMA_VOQ,
dump_imem_sz + TXDESC_SIZE,
(u8 *)txdesc);
@@ -229,6 +257,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
txdesc->txdw0 |= cpu_to_le32(dump_emem_sz &
0x0000ffff);
memcpy(payload, ptr, dump_emem_sz);
+ pr_err("%s:%d\n", __func__, __LINE__);
r8712_write_mem(adapter, RTL8712_DMA_VOQ,
dump_emem_sz + TXDESC_SIZE,
(u8 *)txdesc);
@@ -282,6 +311,7 @@ static u8 rtl8712_dl_fw(struct _adapter *adapter)
txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff);
txdesc->txdw0 |= cpu_to_le32(BIT(28));
memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz);
+ pr_err("%s:%d\n", __func__, __LINE__);
r8712_write_mem(adapter, RTL8712_DMA_VOQ,
fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in r8712_usb_write_mem/usb_submit_urb

ep_out[2] type=2
ep_out[3] type=0
ep_out[4] type=1
rtl8712_dl_fw:230
------------[ cut here ]------------

usb 1-1: BOGUS urb xfer, pipe 3 != type 1

WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
Modules linked in:
CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.10.0-syzkaller-12562-g1722389b0d86-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503

Code: 84 3c 02 00 00 e8 a5 eb fe fc 4c 89 ef e8 2d 21 d7 fe 45 89 e0 89 e9 4c 89 f2 48 89 c6 48 c7 c7 40 18 a0 87 e8 96 dc c4 fc 90 <0f> 0b 90 90 e9 e9 f8 ff ff e8 77 eb fe fc 49 81 c4 c0 05 00 00 e9
RSP: 0018:ffffc90004acf678 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888128648700 RCX: ffffffff81194ce9
RDX: ffff88810db70000 RSI: ffffffff81194cf6 RDI: 0000000000000001

RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001

R13: ffff888115b8f0a8 R14: ffff888103aa5560 R15: ffff88812864877c
FS: 00007f06eaa79740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055b92c582068 CR3: 000000010c70c000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:
<TASK>
r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170

rtl8712_dl_fw+0xa03/0x1310 drivers/staging/rtl8712/hal_init.c:231
rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:360 [inline]
rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:424

netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397
__dev_open+0x2d4/0x4e0 net/core/dev.c:1474
__dev_change_flags+0x561/0x720 net/core/dev.c:8837
dev_change_flags+0x8f/0x160 net/core/dev.c:8909
devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177
inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003
sock_do_ioctl+0x116/0x280 net/socket.c:1222
sock_ioctl+0x22e/0x6c0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f06eab47d49

Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8

RSP: 002b:00007fffa5c56198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f06eaa796c0 RCX: 00007f06eab47d49
RDX: 00007fffa5c66388 RSI: 0000000000008914 RDI: 0000000000000005
RBP: 00007fffa5c76548 R08: 00007fffa5c66348 R09: 00007fffa5c662f8

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fffa5c66388 R14: 0000000000000028 R15: 0000000000008914
</TASK>


Tested on:

commit: 1722389b Merge tag 'net-6.11-rc1' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=131843bd980000

kernel config: https://syzkaller.appspot.com/x/.config?x=e3044dca4d5f6dbe
dashboard link: https://syzkaller.appspot.com/bug?extid=ca2eaaadab55de6a5a42
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10b25b03980000

[Nam Cao]

On Fri, Aug 02, 2024 at 08:01:38PM -0700, syzbot wrote:

> usb 1-1: BOGUS urb xfer, pipe 3 != type 1
> WARNING: CPU: 0 PID: 2583 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503

...

> Call Trace:
> <TASK>
> r8712_usb_write_mem+0x2e4/0x3f0 drivers/staging/rtl8712/usb_ops_linux.c:170
> rtl8712_dl_fw+0x7ab/0xfe0 drivers/staging/rtl8712/hal_init.c:203
> rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
> rtl871x_hal_init+0xb3/0x190 drivers/staging/rtl8712/hal_init.c:394
> netdev_open+0xea/0x800 drivers/staging/rtl8712/os_intfs.c:397

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.6.y

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

INFO: task hung in r871xu_dev_remove

INFO: task kworker/1:1:28 blocked for more than 143 seconds.
Not tainted 6.6.44-syzkaller-g721391060066-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:1 state:D stack:27456 pid:28 ppid:2 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0xca5/0x30d0 kernel/sched/core.c:6698
schedule+0xe7/0x1b0 kernel/sched/core.c:6772
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x5bd/0x9d0 kernel/locking/mutex.c:747
unregister_netdev+0x12/0x30 net/core/dev.c:11102
r871xu_dev_remove+0x291/0x480 drivers/staging/rtl8712/usb_intf.c:596
usb_unbind_interface+0x1e0/0x8d0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:569 [inline]
device_remove+0x122/0x170 drivers/base/dd.c:561
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1295
bus_remove_device+0x22f/0x420 drivers/base/bus.c:574
device_del+0x39d/0xa60 drivers/base/core.c:3838
usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1416
usb_disconnect+0x2e1/0x890 drivers/usb/core/hub.c:2276
hub_port_connect drivers/usb/core/hub.c:5329 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5629 [inline]
port_event drivers/usb/core/hub.c:5789 [inline]
hub_event+0x1be4/0x4f50 drivers/usb/core/hub.c:5871
process_one_work+0x889/0x15e0 kernel/workqueue.c:2631
process_scheduled_works kernel/workqueue.c:2704 [inline]
worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2785
kthread+0x2c6/0x3b0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293
</TASK>

Showing all locks held in the system:
3 locks held by kworker/0:1/9:
#0: ffff888109ba9138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x789/0x15e0 kernel/workqueue.c:2606
#1: ffffc9000009fd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15e0 kernel/workqueue.c:2607
#2: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4684
6 locks held by kworker/1:1/28:
#0: ffff88810a64fd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x789/0x15e0 kernel/workqueue.c:2606
#1: ffffc900001e7d80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15e0 kernel/workqueue.c:2607
#2: ffff888104f2b190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:992 [inline]
#2: ffff888104f2b190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1be/0x4f50 drivers/usb/core/hub.c:5817
#3: ffff888114cd9190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:992 [inline]
#3: ffff888114cd9190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x10a/0x890 drivers/usb/core/hub.c:2267
#4: ffff888100f5b160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:992 [inline]
#4: ffff888100f5b160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
#4: ffff888100f5b160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa4/0x610 drivers/base/dd.c:1292
#5: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: unregister_netdev+0x12/0x30 net/core/dev.c:11102
1 lock held by khungtaskd/29:
#0: ffffffff888aece0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff888aece0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff888aece0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6614
1 lock held by kworker/u4:7/1043:
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:558 [inline]
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1375 [inline]
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1684 [inline]
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x290/0x30d0 kernel/sched/core.c:6613
3 locks held by kworker/1:2/1939:
#0: ffff888109ba9138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x789/0x15e0 kernel/workqueue.c:2606
#1: ffffc9000393fd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15e0 kernel/workqueue.c:2607
#2: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4684
1 lock held by klogd/2494:
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:558 [inline]
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1375 [inline]
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1684 [inline]
#0: ffff8881f653b318 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x290/0x30d0 kernel/sched/core.c:6613
2 locks held by dhcpcd/2543:
#0: ffffffff89ad6da8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x1d3/0x1f10 net/ipv4/devinet.c:1091
#1: ffff88811928cdb0 (&padapter->mutex_start){+.+.}-{3:3}, at: netdev_open+0x32/0x840 drivers/staging/rtl8712/os_intfs.c:392
2 locks held by getty/2563:
#0: ffff88810af530a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000432f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc9/0x1480 drivers/tty/n_tty.c:2216

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.6.44-syzkaller-g721391060066-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf87/0x1210 kernel/hung_task.c:379
kthread+0x2c6/0x3b0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:86 [inline]
NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt+0x1b/0x30 drivers/acpi/processor_idle.c:111


Tested on:

commit: 72139106 Linux 6.6.44
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17be7b65980000
kernel config: https://syzkaller.appspot.com/x/.config?x=cc2e57d9f035477b

dashboard link: https://syzkaller.appspot.com/bug?extid=ca2eaaadab55de6a5a42
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11be7b65980000

[Alan Stern]

You don't have to run all these tests to figure out what the problem is;
I can tell you.

The bug is connected to ffaddr2piphd() in usb_ops_linux.c. That routine
creates a bunch of Bulk pipe values with various endpoint numbers, based
on the addr argument passed by its caller. But the driver doesn't check
to make sure that these endpoints actually exist in the device or that
they are actually Bulk endpoints.

That's why the problem occurs. In this syzbot test the endpoint in
question is really Interrupt, not Bulk. That's why the warning message
appears about the pipe's type not matching the endpoint's type.

Alan Stern