* [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb
@ 2026-10-18 16:18 syzbot
2026-10-18 16:30 ` Alan Stern
0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2026-10-18 16:18 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4056b3c9d3c9 Merge tag 'nios2_update_for_v7.4' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11370ce1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7d1b274ca9837366
dashboard link: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114faaea580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=154faaea580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4056b3c9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/811a43c89106/vmlinux-4056b3c9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2bb4f3abea76/bzImage-4056b3c9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
------------[ cut here ]------------
usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0 drivers/usb/core/urb.c:411, CPU#0: syz.0.17/5521
Modules linked in:
CPU: 0 UID: 0 PID: 5521 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:usb_submit_urb+0x1100/0x18b0 drivers/usb/core/urb.c:411
Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
RSP: 0000:ffffc9000228f8d8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888044085800 RCX: 0000000080000280
RDX: ffff88801317fa20 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
R10: ffffc9000228f9c0 R11: fffff52000451f44 R12: 1ffff11003c397d4
R13: ffff88801e1cbea0 R14: ffff88801317fa20 R15: 0000000080000280
FS: 0000555560660500(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c3f68e000 CR3: 00000000440b1000 CR4: 0000000000352ef0
Call Trace:
<TASK>
usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
ec168_ctrl_msg+0x308/0x7c0 drivers/media/usb/dvb-usb-v2/ec168.c:73
ec168_i2c_xfer+0x10e/0x630 drivers/media/usb/dvb-usb-v2/ec168.c:127
__i2c_transfer+0x7bf/0x1fe0 drivers/i2c/i2c-core-base.c:-1
i2c_transfer+0x1cb/0x2d0 drivers/i2c/i2c-core-base.c:2350
i2cdev_ioctl_rdwr+0x460/0x740 drivers/i2c/i2c-dev.c:306
i2cdev_ioctl+0x6a5/0x880 drivers/i2c/i2c-dev.c:467
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa9f059e559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4b173ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa9f0825fa0 RCX: 00007fa9f059e559
RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
RBP: 00007fa9f06358b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa9f0825fac R14: 00007fa9f0825fa0 R15: 00007fa9f0825fa0
</TASK>
----------------
Code disassembly (best guess):
0: b8 00 00 00 00 mov $0x0,%eax
5: 00 fc add %bh,%ah
7: ff lcall (bad)
8: df 41 0f filds 0xf(%rcx)
b: b6 04 mov $0x4,%dh
d: 04 84 add $0x84,%al
f: c0 0f 85 rorb $0x85,(%rdi)
12: b2 05 mov $0x5,%dl
14: 00 00 add %al,(%rax)
16: 45 0f b6 45 00 movzbl 0x0(%r13),%r8d
1b: 48 8b 3c 24 mov (%rsp),%rdi
1f: 48 8b 74 24 18 mov 0x18(%rsp),%rsi
24: 4c 89 f2 mov %r14,%rdx
27: 44 89 f9 mov %r15d,%ecx
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
36: fc ff df
39: e9 ba f2 ff ff jmp 0xfffff2f8
3e: 44 rex.R
3f: 89 .byte 0x89
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb
2026-10-18 16:18 [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb syzbot
@ 2026-10-18 16:30 ` Alan Stern
2026-10-19 12:05 ` Andi Shyti
0 siblings, 1 reply; 3+ messages in thread
From: Alan Stern @ 2026-10-18 16:30 UTC (permalink / raw)
To: syzbot, Wolfram Sang, Andi Shyti
Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs, linux-i2c
On Sun, Oct 18, 2026 at 09:18:28AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 4056b3c9d3c9 Merge tag 'nios2_update_for_v7.4' of git://gi..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11370ce1580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7d1b274ca9837366
> dashboard link: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114faaea580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=154faaea580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4056b3c9.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/811a43c89106/vmlinux-4056b3c9.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2bb4f3abea76/bzImage-4056b3c9.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
This looks like another example of a 0-length I2C-over-USB read. It
would be nice if we could rule out these things at all at once, instead
of going after them piecemeal.
Alternatively, this WARN() in the USB core could be reduced to something
less severe in the case of length-0 control reads. We haven't been
seeing very many instances of it apart from I2C, and those have only
occurred during fuzzing.
Alan Stern
> ------------[ cut here ]------------
> usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
> WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0 drivers/usb/core/urb.c:411, CPU#0: syz.0.17/5521
> Modules linked in:
> CPU: 0 UID: 0 PID: 5521 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:usb_submit_urb+0x1100/0x18b0 drivers/usb/core/urb.c:411
> Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
> RSP: 0000:ffffc9000228f8d8 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff888044085800 RCX: 0000000080000280
> RDX: ffff88801317fa20 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
> RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
> R10: ffffc9000228f9c0 R11: fffff52000451f44 R12: 1ffff11003c397d4
> R13: ffff88801e1cbea0 R14: ffff88801317fa20 R15: 0000000080000280
> FS: 0000555560660500(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f1c3f68e000 CR3: 00000000440b1000 CR4: 0000000000352ef0
> Call Trace:
> <TASK>
> usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
> usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
> usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
> ec168_ctrl_msg+0x308/0x7c0 drivers/media/usb/dvb-usb-v2/ec168.c:73
> ec168_i2c_xfer+0x10e/0x630 drivers/media/usb/dvb-usb-v2/ec168.c:127
> __i2c_transfer+0x7bf/0x1fe0 drivers/i2c/i2c-core-base.c:-1
> i2c_transfer+0x1cb/0x2d0 drivers/i2c/i2c-core-base.c:2350
> i2cdev_ioctl_rdwr+0x460/0x740 drivers/i2c/i2c-dev.c:306
> i2cdev_ioctl+0x6a5/0x880 drivers/i2c/i2c-dev.c:467
> vfs_ioctl fs/ioctl.c:51 [inline]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb
2026-10-18 16:30 ` Alan Stern
@ 2026-10-19 12:05 ` Andi Shyti
0 siblings, 0 replies; 3+ messages in thread
From: Andi Shyti @ 2026-10-19 12:05 UTC (permalink / raw)
To: Alan Stern
Cc: syzbot, Wolfram Sang, gregkh, linux-kernel, linux-usb,
syzkaller-bugs, linux-i2c
Hi,
On Sun, Oct 18, 2026 at 12:30:24PM -0400, Alan Stern wrote:
> On Sun, Oct 18, 2026 at 09:18:28AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 4056b3c9d3c9 Merge tag 'nios2_update_for_v7.4' of git://gi..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11370ce1580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=7d1b274ca9837366
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
> > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114faaea580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=154faaea580000
> >
> > Downloadable assets:
> > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4056b3c9.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/811a43c89106/vmlinux-4056b3c9.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/2bb4f3abea76/bzImage-4056b3c9.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
>
> This looks like another example of a 0-length I2C-over-USB read. It
> would be nice if we could rule out these things at all at once, instead
> of going after them piecemeal.
>
> Alternatively, this WARN() in the USB core could be reduced to something
> less severe in the case of length-0 control reads. We haven't been
> seeing very many instances of it apart from I2C, and those have only
> occurred during fuzzing.
I am about to send a patch for it, we just need to disallow size
'0' read messages:
@@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
while (i < num) {
if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
if (msg[i].addr == ec168_ec100_config.demod_address) {
- if (msg[i].len < 1) {
+ if (msg[i].len < 1 || msg[i+1].len < 1) {
i = -EOPNOTSUPP;
break;
}
Thanks,
Andi
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-19 12:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-18 16:18 [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb syzbot
2026-10-18 16:30 ` Alan Stern
2026-10-19 12:05 ` Andi Shyti
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®