From: syzbot <syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com>
To: andreyknvl@google.com, davem@davemloft.net, kvalo@codeaurora.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: WARNING in ath6kl_htc_pipe_rx_complete
Date: Thu, 07 Nov 2019 07:34:09 -0800 [thread overview]
Message-ID: <0000000000008123610596c36579@google.com> (raw)
Hello,
syzbot found the following crash on:
HEAD commit: d60bbfea usb: raw: add raw-gadget interface
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=1029829ae00000
kernel config: https://syzkaller.appspot.com/x/.config?x=79de80330003b5f7
dashboard link: https://syzkaller.appspot.com/bug?extid=555908813b2ea35dae9a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1388a2aae00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13aa35dce00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17 at drivers/net/wireless/ath/ath6kl/htc_pipe.c:963
ath6kl_htc_pipe_rx_complete+0xc58/0xef0
drivers/net/wireless/ath/ath6kl/htc_pipe.c:963
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events ath6kl_usb_io_comp_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
panic+0x2aa/0x6e1 kernel/panic.c:221
__warn.cold+0x2f/0x33 kernel/panic.c:582
report_bug+0x27b/0x2f0 lib/bug.c:195
fixup_bug arch/x86/kernel/traps.c:179 [inline]
fixup_bug arch/x86/kernel/traps.c:174 [inline]
do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:ath6kl_htc_pipe_rx_complete+0xc58/0xef0
drivers/net/wireless/ath/ath6kl/htc_pipe.c:963
Code: 45 31 ed e8 da 0f a6 02 e9 01 fb ff ff 4c 8b 74 24 70 4c 8b 6c 24 60
e8 f6 84 74 fe 8b 5c 24 6c e9 3b f9 ff ff e8 e8 84 74 fe <0f> 0b 48 c7 c7
40 53 03 86 41 bc ea ff ff ff e8 7f 83 fe ff e9 cb
RSP: 0018:ffff8881da267c00 EFLAGS: 00010293
RAX: ffff8881da24b000 RBX: ffff8881cf9d0ba0 RCX: 1ffffffff0c06a9e
RDX: 0000000000000000 RSI: ffffffff82c9a178 RDI: ffff8881cf9d0c10
RBP: dffffc0000000000 R08: ffff8881da24b000 R09: fffffbfff11ab3b5
R10: fffffbfff11ab3b4 R11: ffffffff88d59da7 R12: ffff8881cfc18000
R13: ffff8881d20ca280 R14: 0000000000000000 R15: 0000000000000000
ath6kl_usb_io_comp_work+0x11e/0x160
drivers/net/wireless/ath/ath6kl/usb.c:598
process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
worker_thread+0x96/0xe20 kernel/workqueue.c:2415
kthread+0x318/0x420 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
next reply other threads:[~2019-11-07 15:34 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-07 15:34 syzbot [this message]
2019-11-19 13:35 ` WARNING in ath6kl_htc_pipe_rx_complete Oliver Neukum
2019-11-20 23:00 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000008123610596c36579@google.com \
--to=syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.