From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754731AbcBGX1c (ORCPT ); Sun, 7 Feb 2016 18:27:32 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:47313 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750749AbcBGX1a (ORCPT ); Sun, 7 Feb 2016 18:27:30 -0500 To: Ruslan Bilovol , Maxime Ripard , Marek Szyprowski , Peter Chen , Felipe Balbi From: Vegard Nossum Subject: gadgetfs regression (NULL ptr deref) since v4.4-rc7 Cc: Greg Kroah-Hartman , LKML , linux-usb@vger.kernel.org Message-ID: <56B7D2C9.5070301@oracle.com> Date: Mon, 8 Feb 2016 00:27:05 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, Using gadgetfs on latest mainline, I get the following NULL pointer dereference: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] __list_del_entry+0x29/0xc0 PGD 34f067 PUD 355067 PMD 0 Oops: 0000 [#1] DEBUG_PAGEALLOC CPU: 0 PID: 35 Comm: afl-fuzz Not tainted 4.5.0-rc2 #1 task: ffff8800002b1ec0 ti: ffff88000033c000 task.ti: ffff88000033c000 RIP: 0010:[] [] __list_del_entry+0x29/0xc0 RSP: 0018:ffff88000033fe30 EFLAGS: 00010207 RAX: 0000000000000000 RBX: ffffffff8138c108 RCX: dead000000000200 RDX: 0000000000000000 RSI: 0000000000000061 RDI: ffffffff8138c108 RBP: ffff88000033fe30 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffff8138b928 R13: ffffffff8138c040 R14: ffff88000ec0da20 R15: ffff88000033ff58 FS: 00007ffff7ff2740(0000) GS:ffffffff8135d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000000335000 CR4: 00000000001406b0 Stack: ffff88000033fe48 ffffffff81138f2d ffffffff8138bbd0 ffff88000033fe70 ffffffff811c880b ffff8800002f3000 ffff88000ec109a0 ffff880000298aa0 ffff88000033fe88 ffffffff811ce040 ffff88000034cdc0 ffff88000033feb8 Call Trace: [] list_del+0xd/0x30 [] usb_gadget_unregister_driver+0xdb/0xf0 [] dev_release+0x20/0x60 [] __fput+0x4c/0x130 [] ____fput+0x9/0x10 [] task_work_run+0x67/0xa0 [] exit_to_usermode_loop+0x8f/0xa0 [] syscall_return_slowpath+0x3d/0x40 [] int_ret_from_sys_call+0x25/0x8f Code: ff ff 55 48 8b 07 48 b9 00 01 00 00 00 00 ad de 48 8b 57 08 48 89 e5 48 39 c8 74 29 48 b9 00 02 00 00 00 00 ad de 48 39 ca 74 3a <4c> 8b 02 4c 39 c7 75 52 4c 8b 40 08 4c 39 c7 75 66 48 89 50 08 RIP [] __list_del_entry+0x29/0xc0 RSP CR2: 0000000000000000 ---[ end trace e6cfe1de661dcffe ]--- Reverting this commit fixes the problem for me: commit 855ed04a3758b205e84b269f92d26ab36ed8e2f7 Author: Ruslan Bilovol Date: Mon Nov 23 09:56:38 2015 +0100 usb: gadget: udc-core: independent registration of gadgets and gadget drivers Though I am still seeing some occasional lockups. Thanks, Vegard