From: syzbot <syzbot+d5fa3d224505c8610702@syzkaller.appspotmail.com>
To: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [usb?] WARNING in f_midi_free
Date: Fri, 31 Jul 2026 17:02:33 -0700 [thread overview]
Message-ID: <6a6d3799.2d659fcc.1d46f5.01a7.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 11028ab62899 Merge tag 'probes-fixes-v7.2-rc5' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17a425b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb17729fb04b1e3a
dashboard link: https://syzkaller.appspot.com/bug?extid=d5fa3d224505c8610702
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bc967be819a3/disk-11028ab6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6e9f003c9cc8/vmlinux-11028ab6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5c292926486f/bzImage-11028ab6.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d5fa3d224505c8610702@syzkaller.appspotmail.com
------------[ cut here ]------------
!work->func
WARNING: kernel/workqueue.c:4335 at __flush_work+0xc68/0xd70 kernel/workqueue.c:4335, CPU#0: syz.0.7/5816
Modules linked in:
CPU: 0 UID: 0 PID: 5816 Comm: syz.0.7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__flush_work+0xc68/0xd70 kernel/workqueue.c:4335
Code: 6b 8b e8 0b 7c 13 00 48 c7 c7 00 30 1c 8e 48 89 de e9 49 ff ff ff e8 c7 a5 37 00 90 0f 0b 90 e9 45 ff ff ff e8 b9 a5 37 00 90 <0f> 0b 90 31 c0 49 bd f8 f8 f8 f8 f8 f8 f8 f8 e9 2d ff ff ff e8 9f
RSP: 0018:ffffc9000595fa20 EFLAGS: 00010283
RAX: ffffffff818e3537 RBX: ffff888034a369b0 RCX: 0000000000080000
RDX: ffffc90013a3c000 RSI: 0000000000000a3c RDI: 0000000000000a3d
RBP: ffffc9000595fbd0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f5f307 R12: dffffc0000000000
R13: 1ffff11006946d36 R14: 1ffff92000b2bf4c R15: ffff888034a36998
FS: 00007f759d9f16c0(0000) GS:ffff888125c41000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6dfa95b680 CR3: 000000003ccda000 CR4: 00000000003526f0
Call Trace:
<TASK>
__cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4494
f_midi_free+0xac/0x1f0 drivers/usb/gadget/function/f_midi.c:1312
config_usb_cfg_unlink+0x236/0x260 drivers/usb/gadget/configfs.c:508
configfs_symlink+0xde9/0x1030 fs/configfs/symlink.c:202
vfs_symlink+0x18b/0x330 fs/namei.c:5660
filename_symlinkat+0x1cd/0x420 fs/namei.c:5685
__do_sys_symlinkat fs/namei.c:5705 [inline]
__se_sys_symlinkat+0x4e/0x2b0 fs/namei.c:5700
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f759fbfdf99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f759d9f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
RAX: ffffffffffffffda RBX: 00007f759fe86270 RCX: 00007f759fbfdf99
RDX: 0000200000000240 RSI: ffffffffffffff9c RDI: 0000200000000100
RBP: 00007f759fc94ec4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f759fe86308 R14: 00007f759fe86270 R15: 00007ffd5bc1f068
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-08-01 0:02 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a6d3799.2d659fcc.1d46f5.01a7.GAE@google.com \
--to=syzbot+d5fa3d224505c8610702@syzkaller.appspotmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.