WARNING in usb_submit_urb from gl861_ctrl_msg on v7.3-rc2

WARNING in usb_submit_urb from gl861_ctrl_msg on v7.3-rc2

[CJ]

Hi,


syzbot reported "WARNING in gl861_ctrl_msg/usb_submit_urb" on Linux 6.1. The same failure is still
reproducible on v7.3-rc2 with the adapted reproducer described below.


The reproducer connects an emulated GL861 DVB USB device over raw-gadget. During probe, the dvb-usb i2c adapter is registered only for a short window; the adapted C reproducer starts a concurrent poller before the USB connect, scans the i2c minors, and issues a zero-length I2C_RDWR read through the driver. The USB descriptors and ioctl payload are unchanged, and no fault injection is used.


The target console reports a WARNING at drivers/usb/core/urb.c:411 in usb_submit_urb, reached from gl861_ctrl_msg and gl861_i2c_master_xfer through the i2c-dev ioctl path.


The warning is raised while the driver submits the zero-length control URB. The available console does not establish which URB invariant is violated.


This is a follow-up for the existing syzbot report https://syzkaller.appspot.com/bug?extid=7e22553d3b4f7a3e2742, not a
bisected root cause. The target report shares
8 key frames with the source crash report.


Reproducer:
  C reproducer: https://pastebin.com/raw/JdFL62LL


console output: https://pastebin.com/raw/B23eKFB2
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6a5cbd268406bf43


Kernel:
  HEAD commit: df2908090cda368b01ff43709f51890076c56157
  git tree: linux-stable
  kernel version: 7.3.0-rc2
  tested tag: v7.3-rc2


Let me know if you need more details or testing.


Thanks.