From: syzbot <syzbot+9a4aec827829942045ff@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [usb?] stack segment fault in __usb_hcd_giveback_urb
Date: Sat, 07 Jun 2025 02:19:03 -0700 [thread overview]
Message-ID: <68440407.a00a0220.29ac89.0052.GAE@google.com> (raw)
In-Reply-To: <20250607084517.897-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
stack segment fault in __usb_hcd_giveback_urb
Oops: stack segment: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5953 Comm: kworker/0:3 Not tainted 6.15.0-syzkaller-13655-gbdc7f8c5adad-dirty #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:__queue_work+0x9e/0xfe0 kernel/workqueue.c:2256
Code: 8b 1d fe 53 12 11 31 ff 89 de e8 5d 97 35 00 85 db 0f 85 fc 0c 00 00 e8 10 93 35 00 49 8d 97 c0 01 00 00 48 89 d5 48 c1 ed 03 <42> 0f b6 44 25 00 84 c0 48 89 54 24 08 0f 85 44 0d 00 00 8b 1a 89
RSP: 0018:ffffc90000007708 EFLAGS: 00010002
RAX: ffffffff818ac910 RBX: 0000000000000000 RCX: ffff88802f028000
RDX: 00000000000001c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000038 R08: ffff88807cca3bf7 R09: 1ffff1100f99477e
R10: dffffc0000000000 R11: ffffed100f99477f R12: dffffc0000000000
R13: ffff88807cca3bf0 R14: 0000000000000008 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888125c52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2c1ba76e90 CR3: 000000007655c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
queue_work_on+0x181/0x270 kernel/workqueue.c:2392
__usb_hcd_giveback_urb+0x41a/0x690 drivers/usb/core/hcd.c:1650
dummy_timer+0x862/0x4550 drivers/usb/gadget/udc/dummy_hcd.c:1994
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:194 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:246 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x37/0x90 kernel/kcov.c:314
Code: 08 e0 9c 92 65 8b 0d b8 7f dc 10 81 e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75 5b 83 ba 3c 16 00 00 00 74 52 8b 8a 18 16 00 00 <83> f9 03 75 47 48 8b 8a 20 16 00 00 44 8b 8a 1c 16 00 00 49 c1 e1
RSP: 0018:ffffc90003fdf4d0 EFLAGS: 00000246
RAX: ffffffff825d79a5 RBX: ffffffff825d787c RCX: 0000000000000000
RDX: ffff88802f028000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff825d787c
R10: dffffc0000000000 R11: ffffed100e5500d3 R12: dffffc0000000000
R13: 0000000000000001 R14: ffff88801b2ff000 R15: ffff88802fa68e10
rcu_read_unlock include/linux/rcupdate.h:869 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
kernfs_root+0x145/0x230 fs/kernfs/kernfs-internal.h:80
kernfs_put+0x57/0x480 fs/kernfs/dir.c:571
device_del+0x251/0x8e0 drivers/base/core.c:3856
device_unregister+0x20/0xc0 drivers/base/core.c:3922
usb_remove_ep_devs+0x50/0x80 drivers/usb/core/endpoint.c:189
remove_intf_ep_devs drivers/usb/core/message.c:1266 [inline]
usb_disable_device+0x36b/0x8a0 drivers/usb/core/message.c:1417
usb_disconnect+0x304/0x8f0 drivers/usb/core/hub.c:2314
hub_port_connect drivers/usb/core/hub.c:5373 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5673 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x1cdb/0x4a00 drivers/usb/core/hub.c:5915
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__queue_work+0x9e/0xfe0 kernel/workqueue.c:2256
Code: 8b 1d fe 53 12 11 31 ff 89 de e8 5d 97 35 00 85 db 0f 85 fc 0c 00 00 e8 10 93 35 00 49 8d 97 c0 01 00 00 48 89 d5 48 c1 ed 03 <42> 0f b6 44 25 00 84 c0 48 89 54 24 08 0f 85 44 0d 00 00 8b 1a 89
RSP: 0018:ffffc90000007708 EFLAGS: 00010002
RAX: ffffffff818ac910 RBX: 0000000000000000 RCX: ffff88802f028000
RDX: 00000000000001c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000038 R08: ffff88807cca3bf7 R09: 1ffff1100f99477e
R10: dffffc0000000000 R11: ffffed100f99477f R12: dffffc0000000000
R13: ffff88807cca3bf0 R14: 0000000000000008 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888125c52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2c1ba76e90 CR3: 000000007655c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 8b 1d fe 53 12 11 mov 0x111253fe(%rip),%ebx # 0x11125404
6: 31 ff xor %edi,%edi
8: 89 de mov %ebx,%esi
a: e8 5d 97 35 00 call 0x35976c
f: 85 db test %ebx,%ebx
11: 0f 85 fc 0c 00 00 jne 0xd13
17: e8 10 93 35 00 call 0x35932c
1c: 49 8d 97 c0 01 00 00 lea 0x1c0(%r15),%rdx
23: 48 89 d5 mov %rdx,%rbp
26: 48 c1 ed 03 shr $0x3,%rbp
* 2a: 42 0f b6 44 25 00 movzbl 0x0(%rbp,%r12,1),%eax <-- trapping instruction
30: 84 c0 test %al,%al
32: 48 89 54 24 08 mov %rdx,0x8(%rsp)
37: 0f 85 44 0d 00 00 jne 0xd81
3d: 8b 1a mov (%rdx),%ebx
3f: 89 .byte 0x89
Tested on:
commit: bdc7f8c5 Merge tag 'mm-stable-2025-06-06-16-09' of git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1052e20c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fd0cea6d0f67318f
dashboard link: https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=155f5570580000
next parent reply other threads:[~2025-06-07 9:19 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20250607084517.897-1-hdanton@sina.com>
2025-06-07 9:19 ` syzbot [this message]
[not found] <d8f04f74-283e-4acf-9e42-94fc0a047228@yandex.ru>
2025-06-16 18:10 ` [syzbot] [usb?] stack segment fault in __usb_hcd_giveback_urb syzbot
[not found] <e648f349-6bad-44fb-a5f6-5a72a4cc2953@yandex.ru>
2025-06-10 9:57 ` syzbot
[not found] <20250607074300.873-1-hdanton@sina.com>
2025-06-07 8:19 ` syzbot
2025-06-07 1:16 syzbot
2025-07-20 5:40 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68440407.a00a0220.29ac89.0052.GAE@google.com \
--to=syzbot+9a4aec827829942045ff@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.