WARNING at usb_submit_urb from ce6230_ctrl_msg on v7.3-rc2

WARNING at usb_submit_urb from ce6230_ctrl_msg on v7.3-rc2

[CJ]

Hi,

I am reporting a WARNING at usb_submit_urb, reached from ce6230_ctrl_msg. It is still reproducible on
Linux v7.3-rc2 (HEAD df2908090cda368b01ff43709f51890076c56157) with a syzkaller reproducer.
syzbot originally reported "WARNING in ADDR_ctrl_msg/usb_submit_urb" on linux-6.1
(https://syzkaller.appspot.com/bug?extid=1cdb4aa9bf14f8a9230b). The target console shows a matching failure signature.

The reproducer opens an emulated CE6230 DVB USB device through the i2c-dev interface and issues an I2C transfer, which the driver forwards as a control message to the USB device.

The original syzbot title uses ADDR_ctrl_msg; the target stack resolves this driver path as ce6230_ctrl_msg.

On the target, the kernel reports:
  WARNING: drivers/usb/core/urb.c:411 at usb_submit_urb+0x14a9/0x18e0, CPU#0: syz.0.17/10604

The diagnostic path is usb_control_msg -> ce6230_ctrl_msg -> ce6230_i2c_master_xfer -> __i2c_transfer.
It shares 8 key stack frames with the original WARNING
report, including usb_start_wait_urb, usb_control_msg, ce6230_ctrl_msg, ce6230_i2c_master_xfer.

The warning is raised while the control message is submitted. One possible cause is an invalid URB or pipe state on this driver path.

This is a follow-up for an existing syzbot report and describes an
observed failure, not a bisected root cause.

Reproducer:
  syz reproducer: 

syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0x88, 0x5, 0x20, 0x8086, 0x9500, 0xb6d8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0x15, 0xcc, 0x1c}}]}}]}}, 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x2003)
r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x2, 0x2003)
r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x3, 0x2003)
r4 = syz_open_dev$I2C(&(0x7f0000000040), 0x4, 0x2003)
r5 = syz_open_dev$I2C(&(0x7f0000000040), 0x5, 0x2003)
r6 = syz_open_dev$I2C(&(0x7f0000000040), 0x6, 0x2003)
r7 = syz_open_dev$I2C(&(0x7f0000000040), 0x7, 0x2003)
ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0xa201, 0x0, 0x0}], 0x2})


console output: https://pastebin.com/raw/crts01Qu
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=7eb38bd5021fec61

Kernel:
  HEAD commit: df2908090cda368b01ff43709f51890076c56157
  git tree: linux-stable
  kernel version: 7.3.0-rc2
  tested tag: v7.3-rc2

Let me know if you need more details or testing.

Thanks.