* [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5)
@ 2025-10-30 15:20 syzbot
2026-01-04 7:03 ` syzbot
` (3 more replies)
0 siblings, 4 replies; 13+ messages in thread
From: syzbot @ 2025-10-30 15:20 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 6fab32bb6508 MAINTAINERS: add Mark Brown as a linux-next m..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10d0ed42580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1ce99afe6f71855
dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-6fab32bb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/38b1c3a2c170/vmlinux-6fab32bb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6a6377b85494/bzImage-6fab32bb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e69c25cf38a53d0cf64c@syzkaller.appspotmail.com
input: CM109 USB driver as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.8/input/input39
list_add double add: new=ffff888047968c18, prev=ffff888047968c18, next=ffff88803609c078.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:35!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 3 UID: 0 PID: 34 Comm: kworker/3:0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:__list_add_valid_or_report+0x143/0x190 lib/list_debug.c:35
Code: 89 f1 48 c7 c7 c0 6e f0 8b 48 89 ee e8 a6 0d ef fc 90 0f 0b 48 89 f2 48 89 e9 4c 89 e6 48 c7 c7 40 6f f0 8b e8 8e 0d ef fc 90 <0f> 0b 48 89 f7 48 89 34 24 e8 1f 46 79 fd 48 8b 34 24 e9 07 ff ff
RSP: 0018:ffffc900006ded50 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff888047968c00 RCX: ffffffff819b7079
RDX: 0000000000000000 RSI: ffffffff819beba6 RDI: 0000000000000005
RBP: ffff88803609c078 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000002 R11: 0000000000002b91 R12: ffff888047968c18
R13: ffff88803609c080 R14: 0000000000000000 R15: ffff888047968c18
FS: 0000000000000000(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3c92d9 CR3: 00000000320a4000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__list_add_valid include/linux/list.h:96 [inline]
__list_add include/linux/list.h:158 [inline]
list_add_tail include/linux/list.h:191 [inline]
usb_hcd_link_urb_to_ep+0x220/0x3a0 drivers/usb/core/hcd.c:1158
dummy_urb_enqueue+0x2a7/0x920 drivers/usb/gadget/udc/dummy_hcd.c:1288
usb_hcd_submit_urb+0x25b/0x1c60 drivers/usb/core/hcd.c:1546
usb_submit_urb+0x89f/0x1990 drivers/usb/core/urb.c:587
cm109_input_open+0x27a/0x490 drivers/input/misc/cm109.c:566
input_open_device+0x24c/0x3d0 drivers/input/input.c:601
kbd_connect+0x103/0x160 drivers/tty/vt/keyboard.c:1584
input_attach_handler.isra.0+0x176/0x250 drivers/input/input.c:994
input_register_device+0xab9/0x1180 drivers/input/input.c:2378
cm109_usb_probe+0x122f/0x17c0 drivers/input/misc/cm109.c:797
usb_probe_interface+0x303/0xa40 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1031
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1aa0 drivers/base/core.c:3689
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1031
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1aa0 drivers/base/core.c:3689
usb_new_device+0xd07/0x1a60 drivers/usb/core/hub.c:2694
hub_port_connect drivers/usb/core/hub.c:5566 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5870 [inline]
hub_event+0x2f34/0x4fe0 drivers/usb/core/hub.c:5952
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
process_scheduled_works kernel/workqueue.c:3346 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0x143/0x190 lib/list_debug.c:35
Code: 89 f1 48 c7 c7 c0 6e f0 8b 48 89 ee e8 a6 0d ef fc 90 0f 0b 48 89 f2 48 89 e9 4c 89 e6 48 c7 c7 40 6f f0 8b e8 8e 0d ef fc 90 <0f> 0b 48 89 f7 48 89 34 24 e8 1f 46 79 fd 48 8b 34 24 e9 07 ff ff
RSP: 0018:ffffc900006ded50 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff888047968c00 RCX: ffffffff819b7079
RDX: 0000000000000000 RSI: ffffffff819beba6 RDI: 0000000000000005
RBP: ffff88803609c078 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000002 R11: 0000000000002b91 R12: ffff888047968c18
R13: ffff88803609c080 R14: 0000000000000000 R15: ffff888047968c18
FS: 0000000000000000(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3c92d9 CR3: 00000000320a4000 CR4: 0000000000352ef0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2025-10-30 15:20 [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) syzbot @ 2026-01-04 7:03 ` syzbot 2026-01-05 4:07 ` Hillf Danton 2026-07-05 10:23 ` syzbot ` (2 subsequent siblings) 3 siblings, 1 reply; 13+ messages in thread From: syzbot @ 2026-01-04 7:03 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: aacb0a6d604a Merge tag 'pmdomain-v6.19-rc3' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16578f92580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765 dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1627369a580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/d70d8ecc100f/disk-aacb0a6d.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/905258eeaaeb/vmlinux-aacb0a6d.xz kernel image: https://storage.googleapis.com/syzbot-assets/92f24a766750/bzImage-aacb0a6d.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e69c25cf38a53d0cf64c@syzkaller.appspotmail.com list_add double add: new=ffff888028dc3118, prev=ffff888028dc3118, next=ffff8880761de078. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 7322 Comm: syz.2.605 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__list_add_valid_or_report+0x143/0x190 lib/list_debug.c:35 Code: 89 f1 48 c7 c7 c0 b6 f2 8b 48 89 ee e8 d6 9a e7 fc 90 0f 0b 48 89 f2 48 89 e9 4c 89 e6 48 c7 c7 40 b7 f2 8b e8 be 9a e7 fc 90 <0f> 0b 48 89 f7 48 89 34 24 e8 cf db 73 fd 48 8b 34 24 e9 07 ff ff RSP: 0018:ffffc90004ca7580 EFLAGS: 00010086 RAX: 0000000000000058 RBX: ffff888028dc3100 RCX: ffffffff819c8fa5 RDX: 0000000000000000 RSI: ffffffff819d0b89 RDI: 0000000000000005 RBP: ffff8880761de078 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000004 R11: 0000000000000001 R12: ffff888028dc3118 R13: ffff8880761de080 R14: 0000000000000000 R15: ffff888028dc3118 FS: 00007fa72ab066c0(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002000 CR3: 000000007860f000 CR4: 00000000003526f0 Call Trace: <TASK> __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add_tail include/linux/list.h:191 [inline] usb_hcd_link_urb_to_ep+0x220/0x3a0 drivers/usb/core/hcd.c:1158 dummy_urb_enqueue+0x2a7/0x920 drivers/usb/gadget/udc/dummy_hcd.c:1288 usb_hcd_submit_urb+0x25b/0x1cf0 drivers/usb/core/hcd.c:1546 usb_submit_urb+0x899/0x1970 drivers/usb/core/urb.c:587 cm109_submit_buzz_toggle+0xd9/0x180 drivers/input/misc/cm109.c:351 cm109_toggle_buzzer_async drivers/input/misc/cm109.c:484 [inline] cm109_input_ev+0x23d/0x280 drivers/input/misc/cm109.c:615 input_event_dispose drivers/input/input.c:322 [inline] input_handle_event+0x151/0x14d0 drivers/input/input.c:370 input_inject_event+0x1e8/0x3b0 drivers/input/input.c:424 kd_sound_helper+0x17a/0x280 drivers/tty/vt/keyboard.c:256 input_handler_for_each_handle+0xd7/0x250 drivers/input/input.c:2520 kd_mksound+0x88/0x130 drivers/tty/vt/keyboard.c:280 handle_ascii drivers/tty/vt/vt.c:2327 [inline] do_con_trol drivers/tty/vt/vt.c:2644 [inline] do_con_write+0x3246/0x8280 drivers/tty/vt/vt.c:3228 con_write+0x23/0xb0 drivers/tty/vt/vt.c:3565 process_output_block drivers/tty/n_tty.c:557 [inline] n_tty_write+0x434/0x1280 drivers/tty/n_tty.c:2366 iterate_tty_write drivers/tty/tty_io.c:1006 [inline] file_tty_write.constprop.0+0x503/0x9b0 drivers/tty/tty_io.c:1081 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x7d3/0x11d0 fs/read_write.c:686 ksys_write+0x12a/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa729b8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa72ab06038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa729de5fa0 RCX: 00007fa729b8f749 RDX: 0000000000001006 RSI: 0000200000001980 RDI: 0000000000000005 RBP: 00007fa729c13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa729de6038 R14: 00007fa729de5fa0 R15: 00007ffdb843d7a8 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0x143/0x190 lib/list_debug.c:35 Code: 89 f1 48 c7 c7 c0 b6 f2 8b 48 89 ee e8 d6 9a e7 fc 90 0f 0b 48 89 f2 48 89 e9 4c 89 e6 48 c7 c7 40 b7 f2 8b e8 be 9a e7 fc 90 <0f> 0b 48 89 f7 48 89 34 24 e8 cf db 73 fd 48 8b 34 24 e9 07 ff ff RSP: 0018:ffffc90004ca7580 EFLAGS: 00010086 RAX: 0000000000000058 RBX: ffff888028dc3100 RCX: ffffffff819c8fa5 RDX: 0000000000000000 RSI: ffffffff819d0b89 RDI: 0000000000000005 RBP: ffff8880761de078 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000004 R11: 0000000000000001 R12: ffff888028dc3118 R13: ffff8880761de080 R14: 0000000000000000 R15: ffff888028dc3118 FS: 00007fa72ab066c0(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002000 CR3: 000000007860f000 CR4: 00000000003526f0 --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-01-04 7:03 ` syzbot @ 2026-01-05 4:07 ` Hillf Danton 2026-01-05 4:33 ` syzbot 0 siblings, 1 reply; 13+ messages in thread From: Hillf Danton @ 2026-01-05 4:07 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, syzkaller-bugs > Date: Sat, 03 Jan 2026 23:03:24 -0800 > syzbot has found a reproducer for the following issue on: > > HEAD commit: aacb0a6d604a Merge tag 'pmdomain-v6.19-rc3' of git://git.k.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=16578f92580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765 > dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c > compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1627369a580000 #syz test --- x/drivers/input/misc/cm109.c +++ y/drivers/input/misc/cm109.c @@ -562,15 +562,18 @@ static int cm109_input_open(struct input dev->ctl_data->byte[HID_OR2] = dev->keybit; dev->ctl_data->byte[HID_OR3] = 0x00; + spin_lock_irq(&dev->ctl_submit_lock); dev->ctl_urb_pending = 1; - error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL); + error = usb_submit_urb(dev->urb_ctl, GFP_ATOMIC); if (!error) { dev->open = 1; + spin_unlock_irq(&dev->ctl_submit_lock); return 0; } + dev->ctl_urb_pending = 0; + spin_unlock_irq(&dev->ctl_submit_lock); } - dev->ctl_urb_pending = 0; usb_autopm_put_interface(dev->intf); dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n", -- ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-01-05 4:07 ` Hillf Danton @ 2026-01-05 4:33 ` syzbot 0 siblings, 0 replies; 13+ messages in thread From: syzbot @ 2026-01-05 4:33 UTC (permalink / raw) To: hdanton, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+e69c25cf38a53d0cf64c@syzkaller.appspotmail.com Tested-by: syzbot+e69c25cf38a53d0cf64c@syzkaller.appspotmail.com Tested on: commit: 3609fa95 Merge tag 'devicetree-fixes-for-6.19-2' of gi.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=151ecf92580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765 dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=11414074580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2025-10-30 15:20 [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) syzbot 2026-01-04 7:03 ` syzbot @ 2026-07-05 10:23 ` syzbot 2026-07-07 18:43 ` Alan Stern 2026-07-09 8:17 ` Forwarded: Fixing BUG: corrupted list in usb_hcd_link_urb_to_ep syzbot 2026-07-09 9:53 ` Forwarded: [PATCH] Input: cm109 - fix URB double-submit due to missing open check syzbot 3 siblings, 1 reply; 13+ messages in thread From: syzbot @ 2026-07-05 10:23 UTC (permalink / raw) To: gregkh, hdanton, linux-kernel, linux-usb, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 2b763db0c276 Add linux-next specific files for 20260703 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=11f96ffe580000 kernel config: https://syzkaller.appspot.com/x/.config?x=bc069df559a09463 dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a9dffe580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103d8b1c580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/48dad133dd60/disk-2b763db0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/df274fd385d1/vmlinux-2b763db0.xz kernel image: https://storage.googleapis.com/syzbot-assets/f3a54c0c16ec/bzImage-2b763db0.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e69c25cf38a53d0cf64c@syzkaller.appspotmail.com list_add double add: new=ffff88801bf49818, prev=ffff88801bf49818, next=ffff888040cc4078. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:37! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 7510 Comm: syz.2.757 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35 Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 02 d7 79 06 cc 48 c7 c7 60 9c cb 8b 4c 89 fe 4c 89 f2 48 89 d9 e8 6c a0 50 fc 90 <0f> 0b 48 c7 c7 40 9a cb 8b e8 5d a0 50 fc 90 0f 0b 48 c7 c7 00 9b RSP: 0018:ffffc90005a3f320 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ffff888040cc4078 RCX: aa19a771139add00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 1ffff11008198810 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff52000b47e15 R12: 1ffff110037e9303 R13: dffffc0000000000 R14: ffff88801bf49818 R15: ffff88801bf49818 FS: 00007fadf887e6c0(0000) GS:ffff888125b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0f79a3b540 CR3: 000000003c4c0000 CR4: 00000000003526f0 Call Trace: <TASK> __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add_tail include/linux/list.h:191 [inline] usb_hcd_link_urb_to_ep+0x1d2/0x330 drivers/usb/core/hcd.c:1154 dummy_urb_enqueue+0x299/0x760 drivers/usb/gadget/udc/dummy_hcd.c:1292 usb_hcd_submit_urb+0x322/0x1b40 drivers/usb/core/hcd.c:1542 cm109_submit_buzz_toggle drivers/input/misc/cm109.c:351 [inline] cm109_toggle_buzzer_async drivers/input/misc/cm109.c:484 [inline] cm109_input_ev+0x1d1/0x3b0 drivers/input/misc/cm109.c:615 input_event_dispose+0x80/0x6b0 drivers/input/input.c:322 input_inject_event+0x1fa/0x310 drivers/input/input.c:424 kd_sound_helper+0x101/0x210 drivers/tty/vt/keyboard.c:257 input_handler_for_each_handle+0x101/0x1c0 drivers/input/input.c:2540 kd_mksound+0x96/0x130 drivers/tty/vt/keyboard.c:281 handle_ascii drivers/tty/vt/vt.c:2382 [inline] do_con_trol drivers/tty/vt/vt.c:2699 [inline] do_con_write+0x2f5a/0x5540 drivers/tty/vt/vt.c:3325 con_write+0x31/0x2e0 drivers/tty/vt/vt.c:3661 process_output_block drivers/tty/n_tty.c:557 [inline] n_tty_write+0xd4f/0x11e0 drivers/tty/n_tty.c:2366 iterate_tty_write drivers/tty/tty_io.c:1006 [inline] file_tty_write+0x50b/0x980 drivers/tty/tty_io.c:1081 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x61e/0xbb0 fs/read_write.c:687 ksys_write+0x156/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fadf921de59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fadf887e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fadf94a5fa0 RCX: 00007fadf921de59 RDX: 000000000000045c RSI: 00002000000004c0 RDI: 0000000000000005 RBP: 00007fadf92b3e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fadf94a6038 R14: 00007fadf94a5fa0 R15: 00007ffcbb190028 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35 Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 02 d7 79 06 cc 48 c7 c7 60 9c cb 8b 4c 89 fe 4c 89 f2 48 89 d9 e8 6c a0 50 fc 90 <0f> 0b 48 c7 c7 40 9a cb 8b e8 5d a0 50 fc 90 0f 0b 48 c7 c7 00 9b RSP: 0018:ffffc90005a3f320 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ffff888040cc4078 RCX: aa19a771139add00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 1ffff11008198810 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff52000b47e15 R12: 1ffff110037e9303 R13: dffffc0000000000 R14: ffff88801bf49818 R15: ffff88801bf49818 FS: 00007fadf887e6c0(0000) GS:ffff888125b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0f79a3b540 CR3: 000000003c4c0000 CR4: 00000000003526f0 --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-07-05 10:23 ` syzbot @ 2026-07-07 18:43 ` Alan Stern 2026-07-07 19:17 ` syzbot 2026-07-08 14:22 ` Alan Stern 0 siblings, 2 replies; 13+ messages in thread From: Alan Stern @ 2026-07-07 18:43 UTC (permalink / raw) To: syzbot; +Cc: gregkh, hdanton, linux-kernel, linux-usb, syzkaller-bugs On Sun, Jul 05, 2026 at 03:23:29AM -0700, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 2b763db0c276 Add linux-next specific files for 20260703 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=11f96ffe580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=bc069df559a09463 > dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a9dffe580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103d8b1c580000 This driver has a lot of bugs. This is a partial fix for some of them. #syz test: linux-next 2b763db0c276 Index: usb-devel/drivers/input/misc/cm109.c =================================================================== --- usb-devel.orig/drivers/input/misc/cm109.c +++ usb-devel/drivers/input/misc/cm109.c @@ -349,10 +349,14 @@ static void cm109_submit_buzz_toggle(str dev->ctl_data->byte[HID_OR0] &= ~BUZZER_ON; error = usb_submit_urb(dev->urb_ctl, GFP_ATOMIC); - if (error) + if (error) { dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n", __func__, error); + } else { + dev->ctl_urb_pending = 1; + dev->buzzer_pending = 0; + } } static void cm109_submit_ctl(struct cm109_dev *dev) @@ -361,9 +365,7 @@ static void cm109_submit_ctl(struct cm10 guard(spinlock_irqsave)(&dev->ctl_submit_lock); - dev->irq_urb_pending = 0; - - if (unlikely(dev->shutdown)) + if (unlikely(dev->shutdown) || dev->ctl_urb_pending) return; if (dev->buzzer_state) @@ -374,14 +376,15 @@ static void cm109_submit_ctl(struct cm10 dev->ctl_data->byte[HID_OR1] = dev->keybit; dev->ctl_data->byte[HID_OR2] = dev->keybit; - dev->buzzer_pending = 0; - dev->ctl_urb_pending = 1; - error = usb_submit_urb(dev->urb_ctl, GFP_ATOMIC); - if (error) + if (error) { dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n", __func__, error); + } else { + dev->ctl_urb_pending = 1; + dev->buzzer_pending = 0; + } } /* @@ -428,6 +431,7 @@ static void cm109_urb_irq_callback(struc } out: + dev->irq_urb_pending = 0; cm109_submit_ctl(dev); } @@ -458,17 +462,16 @@ static void cm109_urb_ctl_callback(struc return; if (dev->buzzer_pending || status) { - dev->buzzer_pending = 0; - dev->ctl_urb_pending = 1; cm109_submit_buzz_toggle(dev); } else if (likely(!dev->irq_urb_pending)) { /* ask for key data */ - dev->irq_urb_pending = 1; error = usb_submit_urb(dev->urb_irq, GFP_ATOMIC); if (error) dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_irq) failed %d\n", __func__, error); + else + dev->irq_urb_pending = 1; } } @@ -480,7 +483,6 @@ static void cm109_toggle_buzzer_async(st /* URB completion will resubmit */ dev->buzzer_pending = 1; } else { - dev->ctl_urb_pending = 1; cm109_submit_buzz_toggle(dev); } } ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-07-07 18:43 ` Alan Stern @ 2026-07-07 19:17 ` syzbot 2026-07-07 19:28 ` Alan Stern 2026-07-08 14:22 ` Alan Stern 1 sibling, 1 reply; 13+ messages in thread From: syzbot @ 2026-07-07 19:17 UTC (permalink / raw) To: gregkh, hdanton, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: lost connection to test machine Tested on: commit: 2b763db0 Add linux-next specific files for 20260703 git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git console output: https://syzkaller.appspot.com/x/log.txt?x=15586b39580000 kernel config: https://syzkaller.appspot.com/x/.config?x=bc069df559a09463 dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=13aef31e580000 ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-07-07 19:17 ` syzbot @ 2026-07-07 19:28 ` Alan Stern 2026-07-09 5:16 ` Hillf Danton 0 siblings, 1 reply; 13+ messages in thread From: Alan Stern @ 2026-07-07 19:28 UTC (permalink / raw) To: syzbot; +Cc: gregkh, hdanton, linux-kernel, linux-usb, syzkaller-bugs On Tue, Jul 07, 2026 at 12:17:01PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > lost connection to test machine > > > > Tested on: > > commit: 2b763db0 Add linux-next specific files for 20260703 > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git > console output: https://syzkaller.appspot.com/x/log.txt?x=15586b39580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=bc069df559a09463 > dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > patch: https://syzkaller.appspot.com/x/patch.diff?x=13aef31e580000 > The console output says, in its entirety: ----------------------------------------------------------------------------- ci-upstream-rust-kasan-gce-test-job/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-rust-kasan-gce-test-job/syz-execprog -executor=ci-upstream-rust-kasan-gce-test-job/syz-executor -arch=amd64 -sandbox=none -procs=4 -repeat=0 -threaded=true -collide=false -optional=slowdown=1:sandbox_arg=0:type=gce ci-upstream-rust-kasan-gce-test-job/syzkaller4044572343 <...> Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts. FATAL: kernel too old [ 132.897272][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.897384][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 ----------------------------------------------------------------------------- What can I do about this? Alan Stern ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-07-07 19:28 ` Alan Stern @ 2026-07-09 5:16 ` Hillf Danton 0 siblings, 0 replies; 13+ messages in thread From: Hillf Danton @ 2026-07-09 5:16 UTC (permalink / raw) To: Alan Stern; +Cc: syzbot, linux-kernel, linux-usb, syzkaller-bugs On Tue, 7 Jul 2026 15:28:24 -0400 Alan Stern wrote: >On Tue, Jul 07, 2026 at 12:17:01PM -0700, syzbot wrote: >> Hello, >> >> syzbot has tested the proposed patch but the reproducer is still triggering an issue: >> lost connection to test machine >> >> >> >> Tested on: >> >> commit: 2b763db0 Add linux-next specific files for 20260703 >> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git >> console output: https://syzkaller.appspot.com/x/log.txt?x=15586b39580000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=bc069df559a09463 >> dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c >> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 >> patch: https://syzkaller.appspot.com/x/patch.diff?x=13aef31e580000 >> > >The console output says, in its entirety: ><...> >Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts. >FATAL: kernel too old >[ 132.897272][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 >[ 132.897384][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 > >----------------------------------------------------------------------------- > > What can I do about this? > Try the usb tree [1] if necessary? [1] https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-07-07 18:43 ` Alan Stern 2026-07-07 19:17 ` syzbot @ 2026-07-08 14:22 ` Alan Stern 2026-07-08 15:35 ` syzbot 1 sibling, 1 reply; 13+ messages in thread From: Alan Stern @ 2026-07-08 14:22 UTC (permalink / raw) To: syzbot; +Cc: gregkh, hdanton, linux-kernel, linux-usb, syzkaller-bugs On Sun, Jul 05, 2026 at 03:23:29AM -0700, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 2b763db0c276 Add linux-next specific files for 20260703 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=11f96ffe580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=bc069df559a09463 > dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a9dffe580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103d8b1c580000 Second try for this patch. Maybe the current -rc will work better than linux-next. Alan Stern #syz test: upstream v7.2-rc2 Index: usb-devel/drivers/input/misc/cm109.c =================================================================== --- usb-devel.orig/drivers/input/misc/cm109.c +++ usb-devel/drivers/input/misc/cm109.c @@ -349,10 +349,14 @@ static void cm109_submit_buzz_toggle(str dev->ctl_data->byte[HID_OR0] &= ~BUZZER_ON; error = usb_submit_urb(dev->urb_ctl, GFP_ATOMIC); - if (error) + if (error) { dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n", __func__, error); + } else { + dev->ctl_urb_pending = 1; + dev->buzzer_pending = 0; + } } static void cm109_submit_ctl(struct cm109_dev *dev) @@ -361,9 +365,7 @@ static void cm109_submit_ctl(struct cm10 guard(spinlock_irqsave)(&dev->ctl_submit_lock); - dev->irq_urb_pending = 0; - - if (unlikely(dev->shutdown)) + if (unlikely(dev->shutdown) || dev->ctl_urb_pending) return; if (dev->buzzer_state) @@ -374,14 +376,15 @@ static void cm109_submit_ctl(struct cm10 dev->ctl_data->byte[HID_OR1] = dev->keybit; dev->ctl_data->byte[HID_OR2] = dev->keybit; - dev->buzzer_pending = 0; - dev->ctl_urb_pending = 1; - error = usb_submit_urb(dev->urb_ctl, GFP_ATOMIC); - if (error) + if (error) { dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n", __func__, error); + } else { + dev->ctl_urb_pending = 1; + dev->buzzer_pending = 0; + } } /* @@ -428,6 +431,7 @@ static void cm109_urb_irq_callback(struc } out: + dev->irq_urb_pending = 0; cm109_submit_ctl(dev); } @@ -458,17 +462,16 @@ static void cm109_urb_ctl_callback(struc return; if (dev->buzzer_pending || status) { - dev->buzzer_pending = 0; - dev->ctl_urb_pending = 1; cm109_submit_buzz_toggle(dev); } else if (likely(!dev->irq_urb_pending)) { /* ask for key data */ - dev->irq_urb_pending = 1; error = usb_submit_urb(dev->urb_irq, GFP_ATOMIC); if (error) dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_irq) failed %d\n", __func__, error); + else + dev->irq_urb_pending = 1; } } @@ -480,7 +483,6 @@ static void cm109_toggle_buzzer_async(st /* URB completion will resubmit */ dev->buzzer_pending = 1; } else { - dev->ctl_urb_pending = 1; cm109_submit_buzz_toggle(dev); } } ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026-07-08 14:22 ` Alan Stern @ 2026-07-08 15:35 ` syzbot 0 siblings, 0 replies; 13+ messages in thread From: syzbot @ 2026-07-08 15:35 UTC (permalink / raw) To: gregkh, hdanton, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: lost connection to test machine Tested on: commit: 8cdeaa50 Linux 7.2-rc2 git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v7.2-rc2 console output: https://syzkaller.appspot.com/x/log.txt?x=15366739580000 kernel config: https://syzkaller.appspot.com/x/.config?x=abdd1c3924a3d690 dashboard link: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=16b7f739580000 ^ permalink raw reply [flat|nested] 13+ messages in thread
* Forwarded: Fixing BUG: corrupted list in usb_hcd_link_urb_to_ep 2025-10-30 15:20 [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) syzbot 2026-01-04 7:03 ` syzbot 2026-07-05 10:23 ` syzbot @ 2026-07-09 8:17 ` syzbot 2026-07-09 9:53 ` Forwarded: [PATCH] Input: cm109 - fix URB double-submit due to missing open check syzbot 3 siblings, 0 replies; 13+ messages in thread From: syzbot @ 2026-07-09 8:17 UTC (permalink / raw) To: linux-kernel, syzkaller-bugs For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Fixing BUG: corrupted list in usb_hcd_link_urb_to_ep Author: xue.lei@windriver.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master --- a/drivers/input/misc/cm109.c +++ b/drivers/input/misc/cm109.c @@ -601,6 +601,9 @@ static int cm109_input_ev(struct input_dev *idev, unsigned int type, { struct cm109_dev *dev = input_get_drvdata(idev); + if (!dev->open) + return -ENODEV; + dev_dbg(&dev->intf->dev, "input_ev: type=%u code=%u value=%d\n", type, code, value); -- 2.43.0 ^ permalink raw reply [flat|nested] 13+ messages in thread
* Forwarded: [PATCH] Input: cm109 - fix URB double-submit due to missing open check 2025-10-30 15:20 [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) syzbot ` (2 preceding siblings ...) 2026-07-09 8:17 ` Forwarded: Fixing BUG: corrupted list in usb_hcd_link_urb_to_ep syzbot @ 2026-07-09 9:53 ` syzbot 3 siblings, 0 replies; 13+ messages in thread From: syzbot @ 2026-07-09 9:53 UTC (permalink / raw) To: linux-kernel, syzkaller-bugs For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] Input: cm109 - fix URB double-submit due to missing open check Author: xue.lei@windriver.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master ^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2026-07-09 9:53 UTC | newest] Thread overview: 13+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-10-30 15:20 [syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) syzbot 2026-01-04 7:03 ` syzbot 2026-01-05 4:07 ` Hillf Danton 2026-01-05 4:33 ` syzbot 2026-07-05 10:23 ` syzbot 2026-07-07 18:43 ` Alan Stern 2026-07-07 19:17 ` syzbot 2026-07-07 19:28 ` Alan Stern 2026-07-09 5:16 ` Hillf Danton 2026-07-08 14:22 ` Alan Stern 2026-07-08 15:35 ` syzbot 2026-07-09 8:17 ` Forwarded: Fixing BUG: corrupted list in usb_hcd_link_urb_to_ep syzbot 2026-07-09 9:53 ` Forwarded: [PATCH] Input: cm109 - fix URB double-submit due to missing open check syzbot
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.