From: syzbot <syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tkdkei@outlook.jp
Subject: Re: [syzbot] WARNING in usb_composite_setup_continue
Date: Sun, 06 Sep 2026 20:28:03 -0700 [thread overview]
Message-ID: <6a9e2f43.a6639fcc.23b8b0.000f.GAE@google.com> (raw)
In-Reply-To: <OSZPR01MB9313C6A272CD4ACAD2097CF0B2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in __fsg_is_set
configfs-gadget.g1 gadget.2: common->fsg is NULL in fsg_setup at 466
------------[ cut here ]------------
1
WARNING: drivers/usb/gadget/function/f_mass_storage.c:315 at __fsg_is_set.part.0.isra.0+0x2c/0x3a drivers/usb/gadget/function/f_mass_storage.c:315, CPU#0: syz-executor104/5934
Modules linked in:
CPU: 0 UID: 0 PID: 5934 Comm: syz-executor104 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:__fsg_is_set.part.0.isra.0+0x2c/0x3a drivers/usb/gadget/function/f_mass_storage.c:315
Code: 41 89 d4 55 48 89 f5 53 48 89 fb e8 9e f8 b6 00 48 8d bb d8 00 00 00 44 89 e1 48 89 ea 48 c7 c6 c0 82 dc 8c e8 25 61 eb ff 90 <0f> 0b 90 31 c0 5b 5d 41 5c e9 c6 f2 7b 0a e8 71 f8 b6 00 4c 89 e2
RSP: 0018:ffffc90000007a40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88802b4f4c00 RCX: 0000000000000000
RDX: ffff888035554b00 RSI: ffffffff81404f89 RDI: fffff52000000f38
RBP: ffffffff8cdc9f60 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000101 R11: 0000000000000001 R12: 00000000000001d2
R13: ffff88805c34ace8 R14: 0000000000000000 R15: ffffc90000007de0
FS: 00007f788ec136c0(0000) GS:ffff888123b6f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f788dc10ff8 CR3: 000000002cb70000 CR4: 00000000003526f0
Call Trace:
<IRQ>
__fsg_is_set drivers/usb/gadget/function/f_mass_storage.c:864 [inline]
fsg_setup.cold+0x38/0x4c drivers/usb/gadget/function/f_mass_storage.c:466
composite_setup+0xad8/0x9290 drivers/usb/gadget/composite.c:2239
configfs_composite_setup+0xfb/0x130 drivers/usb/gadget/configfs.c:1877
dummy_timer+0x2039/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:1951
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x194/0x210 kernel/softirq.c:767
irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:unwind_next_frame+0xcb6/0x2090 arch/x86/kernel/unwind_orc.c:610
Code: 03 0f b6 04 02 4c 89 c2 83 e2 07 38 d0 7f 08 84 c0 0f 85 db 0d 00 00 0f b6 41 04 83 e0 0f 3c 09 0f 84 ef 0a 00 00 0f b6 41 05 <4c> 89 44 24 18 83 e0 07 3c 03 0f 84 cc 03 00 00 3c 04 0f 84 05 03
RSP: 0018:ffffc900035ef768 EFLAGS: 00000292
RAX: 0000000000000002 RBX: 0000000000000001 RCX: ffffffff9221d688
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffc900035ef820 R08: ffffffff9221d68c R09: 0000000000000007
R10: 0000000000000200 R11: 000000000003e7cf R12: ffffc900035ef828
R13: ffffc900035ef7d8 R14: ffffc900035efeb0 R15: ffffc900035efc38
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x32f/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
tomoyo_realpath_from_path+0xb6/0x690 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x23c/0x580 security/tomoyo/file.c:728
security_file_ioctl+0xd3/0x230 security/security.c:2512
__do_sys_ioctl fs/ioctl.c:591 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xb7/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f788ec4f93b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007f788ec130d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f788ec4f93b
RDX: 00007f788ec13148 RSI: 000000004008550c RDI: 0000000000000003
RBP: 000000008038550a R08: 0000000000000000 R09: 00007f788ec136c0
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000072062152
R13: 00007f788ec13160 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess):
0: 03 0f add (%rdi),%ecx
2: b6 04 mov $0x4,%dh
4: 02 4c 89 c2 add -0x3e(%rcx,%rcx,4),%cl
8: 83 e2 07 and $0x7,%edx
b: 38 d0 cmp %dl,%al
d: 7f 08 jg 0x17
f: 84 c0 test %al,%al
11: 0f 85 db 0d 00 00 jne 0xdf2
17: 0f b6 41 04 movzbl 0x4(%rcx),%eax
1b: 83 e0 0f and $0xf,%eax
1e: 3c 09 cmp $0x9,%al
20: 0f 84 ef 0a 00 00 je 0xb15
26: 0f b6 41 05 movzbl 0x5(%rcx),%eax
* 2a: 4c 89 44 24 18 mov %r8,0x18(%rsp) <-- trapping instruction
2f: 83 e0 07 and $0x7,%eax
32: 3c 03 cmp $0x3,%al
34: 0f 84 cc 03 00 00 je 0x406
3a: 3c 04 cmp $0x4,%al
3c: 0f .byte 0xf
3d: 84 .byte 0x84
3e: 05 .byte 0x5
3f: 03 .byte 0x3
Tested on:
commit: edc15184 usb: typec: hd3ss3220: Add support for supply..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=11e84a15580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec55b50193b453ea
dashboard link: https://syzkaller.appspot.com/bug?extid=a83a5a1ba9ff57935171
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
next parent reply other threads:[~2026-09-07 3:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <OSZPR01MB9313C6A272CD4ACAD2097CF0B2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 3:28 ` syzbot [this message]
[not found] <OSZPR01MB9313A6EAB14EA1A8E9C61EEBB2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 8:05 ` [syzbot] WARNING in usb_composite_setup_continue syzbot
[not found] <OSZPR01MB9313097803429A16EFC1BCCCB2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 5:00 ` syzbot
[not found] <OSZPR01MB9313EC5A624D7513F6801730B2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 4:24 ` syzbot
2026-08-17 11:04 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a9e2f43.a6639fcc.23b8b0.000f.GAE@google.com \
--to=syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tkdkei@outlook.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.