* [syzbot] [usb?] WARNING: refcount bug in trace_suspend_resume (2)
@ 2026-08-09 19:13 syzbot
2026-08-11 4:49 ` Forwarded: " syzbot
2026-08-11 5:21 ` syzbot
0 siblings, 2 replies; 5+ messages in thread
From: syzbot @ 2026-08-09 19:13 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 3f008280327b Merge tag 'pinctrl-v7.2-3' of git://git.kerne..
git tree: https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master
console output: https://syzkaller.appspot.com/x/log.txt?x=16e7efb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa49d7bda29d9792
dashboard link: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
compiler: arm-linux-gnueabi-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17013fb9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1557a132580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/98a89b9f34e4/non_bootable_disk-3f008280.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ac9e46e45e52/vmlinux-3f008280.xz
kernel image: https://storage.googleapis.com/syzbot-assets/491a8a3d010a/zImage-3f008280.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com
udc dummy_udc.1: failed to start USB Gadget filesystem: -12
gadgetfs gadget.1: probe with driver gadgetfs failed with error -12
UDC core: USB Gadget filesystem: couldn't find an available UDC
------------[ cut here ]------------
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x134/0x170 lib/refcount.c:28, CPU#0: syz.2.17/4036
refcount_t: underflow; use-after-free.
Modules linked in:
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 0 UID: 0 PID: 4036 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT
Hardware name: ARM-Versatile Express
Call trace:
[<80201998>] (dump_backtrace) from [<80201a8c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
r7:82a20f78 r6:00000000 r5:82333190 r4:00000001
[<80201a74>] (show_stack) from [<8021e60c>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201a74>] (show_stack) from [<8021e60c>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e5b0>] (dump_stack_lvl) from [<8021e638>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
r7:82a20f78 r6:00000000 r5:83e0c980 r4:82c83d40
[<8021e620>] (dump_stack) from [<80202590>] (vpanic+0x114/0x320 kernel/panic.c:651)
[<8020247c>] (vpanic) from [<802027d0>] (trace_suspend_resume+0x0/0x100 kernel/panic.c:788)
r7:809300ec
[<8020279c>] (panic) from [<80250a80>] (check_panic_on_warn kernel/panic.c:525 [inline])
[<8020279c>] (panic) from [<80250a80>] (get_taint+0x0/0x1c kernel/panic.c:520)
r3:82a0b144 r2:00000001 r1:82318ef4 r0:82320850
[<80250a08>] (check_panic_on_warn) from [<80250bfc>] (__warn+0x98/0x1a4 kernel/panic.c:1104)
[<80250b64>] (__warn) from [<80250ef0>] (warn_slowpath_fmt+0x1e8/0x1f4 kernel/panic.c:1144)
r8:00000009 r7:8238cee4 r6:e0259da4 r5:83e0c980 r4:00000000
[<80250d0c>] (warn_slowpath_fmt) from [<809300ec>] (refcount_warn_saturate+0x134/0x170 lib/refcount.c:28)
r10:8475ea00 r9:00000000 r8:838acb10 r7:8553bc80 r6:835f77f8 r5:00000000
r4:85c7f600
[<8092ffb8>] (refcount_warn_saturate) from [<81120650>] (__refcount_sub_and_test include/linux/refcount.h:400 [inline])
[<8092ffb8>] (refcount_warn_saturate) from [<81120650>] (__refcount_dec_and_test include/linux/refcount.h:432 [inline])
[<8092ffb8>] (refcount_warn_saturate) from [<81120650>] (refcount_dec_and_test include/linux/refcount.h:450 [inline])
[<8092ffb8>] (refcount_warn_saturate) from [<81120650>] (put_dev+0x4c/0x6c drivers/usb/gadget/legacy/inode.c:165)
[<81120604>] (put_dev) from [<81120718>] (dev_release+0x48/0x6c drivers/usb/gadget/legacy/inode.c:1215)
[<811206d0>] (dev_release) from [<805a1bcc>] (__fput+0xd8/0x2f4 fs/file_table.c:512)
r5:040f801b r4:85a2ef00
[<805a1af4>] (__fput) from [<805a1e7c>] (____fput+0x14/0x18 fs/file_table.c:540)
r9:00000000 r8:83e0d214 r7:82c846ac r6:83e0c980 r5:83e0d1e0 r4:00000000
[<805a1e68>] (____fput) from [<8027d7c8>] (task_work_run+0x8c/0xb4 kernel/task_work.c:233)
[<8027d73c>] (task_work_run) from [<80257888>] (exit_task_work include/linux/task_work.h:40 [inline])
[<8027d73c>] (task_work_run) from [<80257888>] (do_exit+0x2ac/0xadc kernel/exit.c:1009)
r9:00000000 r8:e0259e90 r7:83e0d210 r6:850c5d4c r5:83e0c980 r4:850c5c00
[<802575dc>] (do_exit) from [<8025828c>] (do_group_exit+0x40/0x8c kernel/exit.c:1152)
r7:00000004
[<8025824c>] (do_group_exit) from [<80269358>] (get_signal+0xa68/0xa90 kernel/signal.c:3046)
r7:00000004 r4:83e0c980
[<802688f0>] (get_signal) from [<8022a630>] (do_signal arch/arm/kernel/signal.c:579 [inline])
[<802688f0>] (get_signal) from [<8022a630>] (do_work_pending+0x124/0x4f0 arch/arm/kernel/signal.c:619)
r10:00000004 r9:83e0c980 r8:0000001f r7:00000004 r6:8020029c r5:e0259fb0
r4:83e0c980
[<8022a50c>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24)
Exception stack(0xe0259fb0 to 0xe0259ff8)
9fa0: 0000001f 20000400 0000001f 00000000
9fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 003562d8 003562e4
9fe0: 7ef7e798 7ef7e788 00018fa0 001309d0 60000010 00000003
r10:00000004 r9:83e0c980 r8:8020029c r7:00000004 r6:00356310 r5:00000000
r4:00000000
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Forwarded: Re: WARNING: refcount bug in trace_suspend_resume (2)
2026-08-09 19:13 [syzbot] [usb?] WARNING: refcount bug in trace_suspend_resume (2) syzbot
@ 2026-08-11 4:49 ` syzbot
2026-08-11 5:21 ` syzbot
1 sibling, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-11 4:49 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: WARNING: refcount bug in trace_suspend_resume (2)
Author: khiemtranzo532001@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next
From dc76c5bf35d3e11a56c1402294d11297165fec21 Mon Sep 17 00:00:00 2001
From: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Date: Tue, 11 Aug 2026 12:46:21 +0800
Subject: [PATCH] usb: gadget: fix refcount race in gadget_dev_open()
gadget_dev_open() accesses dev->lock and calls get_dev() without
holding sb_mutex, which is held by gadgetfs_kill_sb() when it calls
put_dev(the_device) and frees the device. This creates a race where
open() reads dev->lock after kill_sb() has already freed the dev_data
object, resulting in a refcount underflow and use-after-free.
Fix by wrapping gadget_dev_open() with scoped_guard(mutex, &sb_mutex)
to serialise against gadgetfs_kill_sb(), and check the_device inside
the guard before dereferencing dev.
Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/usb/gadget/legacy/inode.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51..719ea5c18 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1916,15 +1916,19 @@ gadget_dev_open (struct inode *inode, struct file *fd)
struct dev_data *dev = inode->i_private;
int value = -EBUSY;
- spin_lock_irq(&dev->lock);
- if (dev->state == STATE_DEV_DISABLED) {
- dev->ev_next = 0;
- dev->state = STATE_DEV_OPENED;
- fd->private_data = dev;
- get_dev (dev);
- value = 0;
+ scoped_guard(mutex, &sb_mutex) {
+ if (!the_device)
+ return -ENODEV;
+ spin_lock_irq(&dev->lock);
+ if (dev->state == STATE_DEV_DISABLED) {
+ dev->ev_next = 0;
+ dev->state = STATE_DEV_OPENED;
+ fd->private_data = dev;
+ get_dev (dev);
+ value = 0;
+ }
+ spin_unlock_irq(&dev->lock);
}
- spin_unlock_irq(&dev->lock);
return value;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: Re: WARNING: refcount bug in trace_suspend_resume (2)
2026-08-09 19:13 [syzbot] [usb?] WARNING: refcount bug in trace_suspend_resume (2) syzbot
2026-08-11 4:49 ` Forwarded: " syzbot
@ 2026-08-11 5:21 ` syzbot
1 sibling, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-11 5:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: WARNING: refcount bug in trace_suspend_resume (2)
Author: khiemtranzo532001@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next
From 7793c39a61d25917c6047a9b7fb4d666bcc2b227 Mon Sep 17 00:00:00 2001
From: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Date: Tue, 11 Aug 2026 12:46:21 +0800
Subject: [PATCH] usb: gadget: fix refcount underflow in gadgetfs_bind() error
path
gadgetfs_bind() calls get_dev() only on the success path, but
gadgetfs_unbind() called from the enomem error label unconditionally
calls put_dev(). When bind fails (e.g. ENOMEM), put_dev() fires
without a matching get_dev(), leaving the refcount unbalanced.
A subsequent close of the ep0 file descriptor calls dev_release() ->
put_dev() which hits zero and frees the object; then gadgetfs_kill_sb()
calls put_dev(the_device) again on the already-freed pointer, triggering
a refcount underflow and use-after-free.
Fix by calling get_dev() at the start of gadgetfs_bind(), before any
error path that invokes gadgetfs_unbind(), so the reference is always
balanced regardless of whether bind succeeds or fails.
Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/usb/gadget/legacy/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51..d6551a4ce 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1682,6 +1682,8 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
dev->gadget = gadget;
gadget->ep0->driver_data = dev;
+ get_dev (dev);
+
/* preallocate control response and buffer */
dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
if (!dev->req)
@@ -1696,7 +1698,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
spin_lock_irq(&dev->lock);
dev->state = STATE_DEV_UNCONNECTED;
spin_unlock_irq(&dev->lock);
- get_dev (dev);
return 0;
enomem:
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
[parent not found: <6a7aa9c4.c4d3d80a.193916.4813@mx.google.com>]
* Re: [syzbot] [usb?] WARNING: refcount bug in trace_suspend_resume (2)
[not found] <6a7aa9c4.c4d3d80a.193916.4813@mx.google.com>
@ 2026-08-11 5:12 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-11 5:12 UTC (permalink / raw)
To: khiemtranzo532001, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: refcount bug in trace_suspend_resume
udc dummy_udc.1: failed to start USB Gadget filesystem: -12
gadgetfs gadget.1: probe with driver gadgetfs failed with error -12
UDC core: USB Gadget filesystem: couldn't find an available UDC
------------[ cut here ]------------
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x134/0x170 lib/refcount.c:28, CPU#1: syz.2.17/5117
refcount_t: underflow; use-after-free.
Modules linked in:
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 1 UID: 0 PID: 5117 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT
Hardware name: ARM-Versatile Express
Call trace:
[<80201998>] (dump_backtrace) from [<80201a8c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
r7:82a20f78 r6:00000000 r5:823338f8 r4:00000001
[<80201a74>] (show_stack) from [<8021e5b8>] (__dump_stack lib/dump_stack.c:94 [inline])
[<80201a74>] (show_stack) from [<8021e5b8>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120)
[<8021e55c>] (dump_stack_lvl) from [<8021e5e4>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
r7:82a20f78 r6:00000000 r5:84166e40 r4:82c82d40
[<8021e5cc>] (dump_stack) from [<80202590>] (vpanic+0x114/0x320 kernel/panic.c:651)
[<8020247c>] (vpanic) from [<802027d0>] (trace_suspend_resume+0x0/0x100 kernel/panic.c:788)
r7:8092f5a8
[<8020279c>] (panic) from [<80250a80>] (check_panic_on_warn kernel/panic.c:525 [inline])
[<8020279c>] (panic) from [<80250a80>] (get_taint+0x0/0x1c kernel/panic.c:520)
r3:82a0b144 r2:00000001 r1:8231965c r0:82320fb8
[<80250a08>] (check_panic_on_warn) from [<80250bfc>] (__warn+0x98/0x1a4 kernel/panic.c:1104)
[<80250b64>] (__warn) from [<80250ef0>] (warn_slowpath_fmt+0x1e8/0x1f4 kernel/panic.c:1144)
r8:00000009 r7:8238d554 r6:dfa09da4 r5:84166e40 r4:00000000
[<80250d0c>] (warn_slowpath_fmt) from [<8092f5a8>] (refcount_warn_saturate+0x134/0x170 lib/refcount.c:28)
r10:850839c0 r9:00000000 r8:830e9c10 r7:8346cc00 r6:85e35660 r5:00000000
r4:8550ca00
[<8092f474>] (refcount_warn_saturate) from [<8111fd0c>] (__refcount_sub_and_test include/linux/refcount.h:400 [inline])
[<8092f474>] (refcount_warn_saturate) from [<8111fd0c>] (__refcount_dec_and_test include/linux/refcount.h:432 [inline])
[<8092f474>] (refcount_warn_saturate) from [<8111fd0c>] (refcount_dec_and_test include/linux/refcount.h:450 [inline])
[<8092f474>] (refcount_warn_saturate) from [<8111fd0c>] (put_dev+0x4c/0x6c drivers/usb/gadget/legacy/inode.c:165)
[<8111fcc0>] (put_dev) from [<8111fdd4>] (dev_release+0x48/0x6c drivers/usb/gadget/legacy/inode.c:1224)
[<8111fd8c>] (dev_release) from [<805a168c>] (__fput+0xd8/0x2f4 fs/file_table.c:512)
r5:040f801b r4:83981480
[<805a15b4>] (__fput) from [<805a193c>] (____fput+0x14/0x18 fs/file_table.c:540)
r9:00000000 r8:841676d4 r7:82c836ac r6:84166e40 r5:841676a0 r4:00000000
[<805a1928>] (____fput) from [<8027d7c8>] (task_work_run+0x8c/0xb4 kernel/task_work.c:233)
[<8027d73c>] (task_work_run) from [<80257888>] (exit_task_work include/linux/task_work.h:40 [inline])
[<8027d73c>] (task_work_run) from [<80257888>] (do_exit+0x2ac/0xadc kernel/exit.c:1009)
r9:00000000 r8:dfa09e90 r7:841676d0 r6:84ff1d4c r5:84166e40 r4:84ff1c00
[<802575dc>] (do_exit) from [<8025828c>] (do_group_exit+0x40/0x8c kernel/exit.c:1152)
r7:00000004
[<8025824c>] (do_group_exit) from [<80269358>] (get_signal+0xa68/0xa90 kernel/signal.c:3046)
r7:00000004 r4:84166e40
[<802688f0>] (get_signal) from [<8022a630>] (do_signal arch/arm/kernel/signal.c:579 [inline])
[<802688f0>] (get_signal) from [<8022a630>] (do_work_pending+0x124/0x4f0 arch/arm/kernel/signal.c:619)
r10:00000004 r9:84166e40 r8:0000001f r7:00000004 r6:8020029c r5:dfa09fb0
r4:84166e40
[<8022a50c>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24)
Exception stack(0xdfa09fb0 to 0xdfa09ff8)
9fa0: 0000001f 20000400 0000001f 00000000
9fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000001 76f4f0dc
9fe0: 76f4ee88 76f4ee78 00018fa0 001309d0 60000010 00000003
r10:00000004 r9:84166e40 r8:8020029c r7:00000004 r6:00356310 r5:00000000
r4:00000000
Rebooting in 86400 seconds..
Tested on:
commit: 5d5fd841 Merge 7.2-rc5 into usb-next
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next
console output: https://syzkaller.appspot.com/x/log.txt?x=162dca9e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db7ba9edb9755fc1
dashboard link: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
compiler: arm-linux-gnueabi-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm
patch: https://syzkaller.appspot.com/x/patch.diff?x=132112c6580000
^ permalink raw reply [flat|nested] 5+ messages in thread
[parent not found: <6a7ab147.dbb26164.13295f.f9f9@mx.google.com>]
end of thread, other threads:[~2026-08-11 6:05 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-09 19:13 [syzbot] [usb?] WARNING: refcount bug in trace_suspend_resume (2) syzbot
2026-08-11 4:49 ` Forwarded: " syzbot
2026-08-11 5:21 ` syzbot
[not found] <6a7aa9c4.c4d3d80a.193916.4813@mx.google.com>
2026-08-11 5:12 ` [syzbot] [usb?] " syzbot
[not found] <6a7ab147.dbb26164.13295f.f9f9@mx.google.com>
2026-08-11 6:05 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.