From: syzbot <syzbot+56962eb32ba0136cd330@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [usb?] memory leak in uss720_probe
Date: Thu, 16 Jul 2026 15:15:03 -0700 [thread overview]
Message-ID: <6a5957e7.42649fcc.a68e.05cf.GAE@google.com> (raw)
In-Reply-To: <20260716120914.9099-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in kill_all_async_requests_priv
Oops: general protection fault, probably for non-canonical address 0x6230343037302d77: 0000 [#1] SMP PTI
CPU: 0 UID: 0 PID: 6530 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_kill_urb+0x30/0x140 drivers/usb/core/urb.c:706
Code: 55 53 48 83 ec 30 65 48 8b 1d d4 4f dd 05 48 89 5c 24 28 48 89 fb e8 8f 03 c3 fd 2e 2e 2e 31 c0 48 85 db 74 4c e8 80 03 c3 fd <48> 83 7b 40 00 74 40 e8 74 03 c3 fd 48 83 7b 48 00 74 34 e8 68 03
RSP: 0018:ffffc900031ef680 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 6230343037302d37 RCX: ffffffff83c14112
RDX: ffff888109a6ec00 RSI: ffffffff83c14050 RDI: 6230343037302d37
RBP: 7369646632785c4c R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 7369646632785c4c
R13: ffff88812c3cd6f0 R14: ffff88812c3cd6e0 R15: 000000000000001f
FS: 0000000000000000(0000) GS:ffff8881b202b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561313ede480 CR3: 000000012f13a000 CR4: 00000000003526f0
Call Trace:
<TASK>
kill_all_async_requests_priv.isra.0+0x58/0x90 drivers/usb/misc/uss720.c:185
get_1284_register.cold+0x19/0x5b drivers/usb/misc/uss720.c:227
uss720_probe+0x1fa/0x2e0 drivers/usb/misc/uss720.c:735
usb_probe_interface+0x210/0x480 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:706
__driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1098
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
device_add+0x99f/0xc80 drivers/base/core.c:3772
usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:706
__driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1098
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
device_add+0x99f/0xc80 drivers/base/core.c:3772
usb_new_device.cold+0x115/0x626 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1723/0x2180 drivers/usb/core/hub.c:5953
process_one_work+0x277/0x5a0 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x255/0x4a0 kernel/workqueue.c:3486
kthread+0x14e/0x1a0 kernel/kthread.c:436
ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 55 push %rbp
1: 53 push %rbx
2: 48 83 ec 30 sub $0x30,%rsp
6: 65 48 8b 1d d4 4f dd mov %gs:0x5dd4fd4(%rip),%rbx # 0x5dd4fe2
d: 05
e: 48 89 5c 24 28 mov %rbx,0x28(%rsp)
13: 48 89 fb mov %rdi,%rbx
16: e8 8f 03 c3 fd call 0xfdc303aa
1b: 2e 2e 2e 31 c0 cs cs cs xor %eax,%eax
20: 48 85 db test %rbx,%rbx
23: 74 4c je 0x71
25: e8 80 03 c3 fd call 0xfdc303aa
* 2a: 48 83 7b 40 00 cmpq $0x0,0x40(%rbx) <-- trapping instruction
2f: 74 40 je 0x71
31: e8 74 03 c3 fd call 0xfdc303aa
36: 48 83 7b 48 00 cmpq $0x0,0x48(%rbx)
3b: 74 34 je 0x71
3d: e8 .byte 0xe8
3e: 68 .byte 0x68
3f: 03 .byte 0x3
Tested on:
commit: 481ed5dd Merge tag 'landlock-7.2-rc4' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=138b4b46580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b80376788da8bcda
dashboard link: https://syzkaller.appspot.com/bug?extid=56962eb32ba0136cd330
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=129ad4b9580000
next parent reply other threads:[~2026-07-16 22:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260716120914.9099-1-kartikey406@gmail.com>
2026-07-16 22:15 ` syzbot [this message]
[not found] <aljCxrwM8-f93NlL@michalis-linux>
2026-07-16 22:09 ` [syzbot] [usb?] memory leak in uss720_probe syzbot
2026-07-16 7:50 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a5957e7.42649fcc.a68e.05cf.GAE@google.com \
--to=syzbot+56962eb32ba0136cd330@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.