From patchwork Tue Sep 12 03:42:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cameron Gutman X-Patchwork-Id: 9948329 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2089F6038F for ; Tue, 12 Sep 2017 03:42:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 16A1B28DC0 for ; Tue, 12 Sep 2017 03:42:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0A97528DE3; Tue, 12 Sep 2017 03:42:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7803D28DC0 for ; Tue, 12 Sep 2017 03:42:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751141AbdILDmQ (ORCPT ); Mon, 11 Sep 2017 23:42:16 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:33530 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751119AbdILDmP (ORCPT ); Mon, 11 Sep 2017 23:42:15 -0400 Received: by mail-pf0-f196.google.com with SMTP id h4so5739029pfk.0; Mon, 11 Sep 2017 20:42:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=npOWIxRTqRo7gwRAPOERZ9+lio/RQZ0DcWSqTqtK/O0=; b=Uo+hdGPfhyl25wdx4H2BOSFDneleni+ud8VX0zMAwJh4f3IqqKtjUIgCvt3DlIyc7j tLVyVyZ2bmjVH2CxWpsCMpFmDA2WU5jO9HIW5KKgRxcp2xrdVmmvcq5zVIu4IqBeYXYA 9bq/t7ShECInALlKISOMo0dRqtir+lgokCjU5iA8IgUmEuAKV/FGTtVhYuoObi23RdRs NmZs/3O1zpr0IgmbvyrLzamLzFx7WtAvh2kn5X8I0QBsKxBoLJm8bNlSNmXIBgGcw2DW OMu3J79N3e3CN2z3TQAgm66olfKbXlQhyAs1QYm9bCQQ44q/zSKuPInKZ/7G3WeAGrqB GjoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=npOWIxRTqRo7gwRAPOERZ9+lio/RQZ0DcWSqTqtK/O0=; b=QgyIXukCDuc8G8x24RHPEPIogxixhajha9RhepOT2J9T7/Ob55MajUopBhe1/rxmSq Y4VzcHQ5f4jmtUOC2sr34bythZWXjnyRHJQNLhabYasVFyd3MEd0xhhgK8VX7GFU/CC+ SKy+aPnERA3UwhrUeOw9ME0XMAsNymWVqV6sHls8+CgNEz6GgUKIFi0cBgXZKO5+ZWzM 18UtQXfWZMaa5XQOjHkC2rxvkZj/lZc0jC25AWi5WAtFmh9lk0nYJLfYj6VRDBNYya/q FySNyDxCOdBWSbRAfgjlzcy51P38tOff27ls5LZro47kJI5q2uGY+wHkqIUpJi90Jj7E RiSA== X-Gm-Message-State: AHPjjUjE9/iGAnPIeWoz1hszknMKAiviQcUjFAmkXDJJkjek/ayCH9d+ KAemSvbxon9+NA== X-Google-Smtp-Source: ADKCNb66clWZ9Kkx+57rGjxhojTD7idzxQ7zUFr1xhPqMHPtJD4acJsQsMwMQGYQ+u7oGH/siTwktQ== X-Received: by 10.84.129.226 with SMTP id b89mr15538891plb.36.1505187734491; Mon, 11 Sep 2017 20:42:14 -0700 (PDT) Received: from ?IPv6:2001:470:b:b46::1520? ([2001:470:b:b46::1520]) by smtp.gmail.com with ESMTPSA id l27sm17571249pfg.172.2017.09.11.20.42.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Sep 2017 20:42:13 -0700 (PDT) Subject: Re: usb/joystick: warnings in xpad_start_input and xpad_try_sending_next_out_packet To: Andrey Konovalov , Dmitry Torokhov , Benjamin Valentin , Pavel Rojtberg , Daniel Tobias , linux-input@vger.kernel.org, LKML Cc: Dmitry Vyukov , Kostya Serebryany , syzkaller References: From: Cameron Gutman Message-ID: <46e1a068-ae72-51f6-c2ef-977f4bc7493b@gmail.com> Date: Mon, 11 Sep 2017 20:42:12 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 09/11/2017 05:26 AM, Andrey Konovalov wrote: > Hi! > > I've got the following crashes while fuzzing the kernel with syzkaller. > > On commit 81a84ad3cb5711cec79f4dd53a4ce026b092c432 (Sep 3). > > usb 1-1: BOGUS urb xfer, pipe 1 != type 3 > WARNING: CPU: 1 PID: 2574 at drivers/usb/core/urb.c:449 > usb_submit_urb+0xf8a/0x11d0 > Modules linked in: > CPU: 1 PID: 2574 Comm: kworker/1:2 Not tainted 4.13.0+ #88 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Workqueue: usb_hub_wq hub_event > task: ffff880067ec9a00 task.stack: ffff880067988000 > RIP: 0010:usb_submit_urb+0xf8a/0x11d0 drivers/usb/core/urb.c:448 > RSP: 0018:ffff88006798e0b0 EFLAGS: 00010082 > RAX: 0000000000000029 RBX: ffff88006b9ca200 RCX: 0000000000000000 > RDX: 0000000000000029 RSI: ffff88006c915c78 RDI: ffffed000cf31c08 > RBP: ffff88006798e1b0 R08: fffffbfff0fe00ff R09: fffffbfff0fe00ff > R10: 0000000000000001 R11: fffffbfff0fe00fe R12: 1ffff1000cf31c1d > R13: 0000000000000003 R14: 0000000000000001 R15: ffff88006b164798 > FS: 0000000000000000(0000) GS:ffff88006c900000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007fde04686518 CR3: 000000006a539000 CR4: 00000000000006e0 > Call Trace: > xpad_try_sending_next_out_packet+0xe1/0x1d0 drivers/input/joystick/xpad.c:1000 > xpad_send_led_command drivers/input/joystick/xpad.c:1372 > xpad_led_set+0x465/0x6e0 drivers/input/joystick/xpad.c:1392 > __led_set_brightness drivers/leds/led-core.c:34 > led_set_brightness_nopm+0x53/0x100 drivers/leds/led-core.c:261 > led_set_brightness_nosleep+0x17f/0x220 drivers/leds/led-core.c:278 > led_set_brightness+0xfe/0x130 drivers/leds/led-core.c:253 > xpad_identify_controller drivers/input/joystick/xpad.c:1383 > xpad_led_probe drivers/input/joystick/xpad.c:1426 > xpad_init_input+0xd40/0xfe0 drivers/input/joystick/xpad.c:1667 > xpad_probe+0x13d4/0x1e00 drivers/input/joystick/xpad.c:1811 > usb_probe_interface+0x351/0x8d0 drivers/usb/core/driver.c:361 > really_probe drivers/base/dd.c:385 > driver_probe_device+0x610/0xa00 drivers/base/dd.c:529 > __device_attach_driver+0x230/0x290 drivers/base/dd.c:625 > bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463 > __device_attach+0x269/0x3c0 drivers/base/dd.c:682 > device_initial_probe+0x1f/0x30 drivers/base/dd.c:729 > bus_probe_device+0x1da/0x280 drivers/base/bus.c:523 > device_add+0xcf9/0x1640 drivers/base/core.c:1703 > usb_set_configuration+0x1064/0x1890 drivers/usb/core/message.c:1932 > generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 > usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 > really_probe drivers/base/dd.c:385 > driver_probe_device+0x610/0xa00 drivers/base/dd.c:529 > __device_attach_driver+0x230/0x290 drivers/base/dd.c:625 > bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463 > __device_attach+0x269/0x3c0 drivers/base/dd.c:682 > device_initial_probe+0x1f/0x30 drivers/base/dd.c:729 > bus_probe_device+0x1da/0x280 drivers/base/bus.c:523 > device_add+0xcf9/0x1640 drivers/base/core.c:1703 > usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 > hub_port_connect drivers/usb/core/hub.c:4890 > hub_port_connect_change drivers/usb/core/hub.c:4996 > port_event drivers/usb/core/hub.c:5102 > hub_event+0x23c8/0x37c0 drivers/usb/core/hub.c:5182 > process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097 > worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231 > kthread+0x324/0x3f0 kernel/kthread.c:231 > ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425 > Code: 48 8b 85 30 ff ff ff 48 8d b8 98 00 00 00 e8 8e 93 07 ff 45 89 > e8 44 89 f1 4c 89 fa 48 89 c6 48 c7 c7 a0 e5 55 86 e8 20 08 8f fd <0f> > ff e9 9b f7 ff ff e8 4a 04 d6 fd e9 80 f7 ff ff e8 60 11 a6 > ---[ end trace 5b20fc700a17a457 ]--- I assume you're doing some sort of USB emulation to fuzz these? I don't think we'd get that far with any real device that wasn't explicitly designed to trick us. In any case, this patch should take care of it. Regards, Cameron ---- Tested-by: Andrey Konovalov --- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c index f8e34ef643c7..d86e59515b9c 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -1764,10 +1764,12 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id struct usb_endpoint_descriptor *ep = &intf->cur_altsetting->endpoint[i].desc; - if (usb_endpoint_dir_in(ep)) - ep_irq_in = ep; - else - ep_irq_out = ep; + if (usb_endpoint_xfer_int(ep)) { + if (usb_endpoint_dir_in(ep)) + ep_irq_in = ep; + else + ep_irq_out = ep; + } } if (!ep_irq_in || !ep_irq_out) {