From: syzbot <syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com>
To: andrzej.p@samsung.com, balbi@ti.com, bigeasy@linutronix.de,
frank.li@nxp.com, gregkh@linuxfoundation.org, hhhuuu@google.com,
jeffinphilip14@gmail.com, kai.aizen.dev@gmail.com,
kees@kernel.org, laurent.pinchart@ideasonboard.com,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
patches@lists.linux.dev, stable-commits@vger.kernel.org,
stable@vger.kernel.org, syzkaller-bugs@googlegroups.com,
xu.yang_2@nxp.com
Subject: Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in trace_event_raw_event_udc_log_req
Date: Wed, 16 Sep 2026 13:51:44 -0700 [thread overview]
Message-ID: <6aab0160.e91c2013.3bdb06.0005.GAE@google.com> (raw)
In-Reply-To: <6a74a7e9.01d0871a.3a0d52.0023.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 9b87fdc9af2f Merge tag 'sched_ext-for-7.3-rc3-fixes' of gi..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10073925580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f
dashboard link: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14073925580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
RBP: 00007ffd24c2deb0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b
R13: 64755f796d6d7564 R14: 00007f7ea170aa41 R15: 0000000000000000
</TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 UID: 0 PID: 6018 Comm: syz-executor177 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:do_trace_event_raw_event_udc_log_req drivers/usb/gadget/udc/trace.h:223 [inline]
RIP: 0010:trace_event_raw_event_udc_log_req+0x207/0x6c0 drivers/usb/gadget/udc/trace.h:223
Code: e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 7f 04 00 00 49 8d 7d 10 41 c6 04 24 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 4b 04 00 00 49 8d 7f 0c 41 8b
RSP: 0018:ffffc900055379e0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff8cda4a23 RDI: 0000000000000010
RBP: 1ffff92000aa6f3e R08: 0000000000000001 R09: ffffed1003ed2e25
R10: ffff88801f69712e R11: 0000000000000001 R12: ffff88801f69712f
R13: 0000000000000000 R14: ffffffff8cda4a20 R15: ffff88801f6970ec
FS: 000055558eb7d400(0000) GS:ffff8880d5c59000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d12b7cc300 CR3: 0000000036264000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__do_trace_usb_ep_alloc_request drivers/usb/gadget/udc/trace.h:264 [inline]
trace_usb_ep_alloc_request drivers/usb/gadget/udc/trace.h:264 [inline]
usb_ep_alloc_request+0x217/0x2e0 drivers/usb/gadget/udc/core.c:202
gadget_bind+0xe7/0x660 drivers/usb/gadget/legacy/raw_gadget.c:294
gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x210/0x460 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
driver_register+0x1e2/0x360 drivers/base/driver.c:174
usb_gadget_register_driver_owner+0x132/0x210 drivers/usb/gadget/udc/core.c:1752
raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
raw_ioctl+0x1a85/0x2b80 drivers/usb/gadget/legacy/raw_gadget.c:1307
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7ea16ae7bb
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffd24c2de50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7ea16ae7bb
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003
RBP: 00007ffd24c2deb0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b
R13: 64755f796d6d7564 R14: 00007f7ea170aa41 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:do_trace_event_raw_event_udc_log_req drivers/usb/gadget/udc/trace.h:223 [inline]
RIP: 0010:trace_event_raw_event_udc_log_req+0x207/0x6c0 drivers/usb/gadget/udc/trace.h:223
Code: e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 7f 04 00 00 49 8d 7d 10 41 c6 04 24 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 4b 04 00 00 49 8d 7f 0c 41 8b
RSP: 0018:ffffc900055379e0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff8cda4a23 RDI: 0000000000000010
RBP: 1ffff92000aa6f3e R08: 0000000000000001 R09: ffffed1003ed2e25
R10: ffff88801f69712e R11: 0000000000000001 R12: ffff88801f69712f
R13: 0000000000000000 R14: ffffffff8cda4a20 R15: ffff88801f6970ec
FS: 000055558eb7d400(0000) GS:ffff8880d5c59000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d12b7cc300 CR3: 0000000036264000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: e2 83 loop 0xffffff85
2: e2 07 loop 0xb
4: 38 d0 cmp %dl,%al
6: 7f 08 jg 0x10
8: 84 c0 test %al,%al
a: 0f 85 7f 04 00 00 jne 0x48f
10: 49 8d 7d 10 lea 0x10(%r13),%rdi
14: 41 c6 04 24 00 movb $0x0,(%r12)
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 4b 04 00 00 jle 0x485
3a: 49 8d 7f 0c lea 0xc(%r15),%rdi
3e: 41 rex.B
3f: 8b .byte 0x8b
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-09-16 20:51 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-06 15:27 [syzbot] [usb?] KASAN: slab-use-after-free Read in trace_event_raw_event_udc_log_req syzbot
2026-09-16 20:51 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aab0160.e91c2013.3bdb06.0005.GAE@google.com \
--to=syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com \
--cc=andrzej.p@samsung.com \
--cc=balbi@ti.com \
--cc=bigeasy@linutronix.de \
--cc=frank.li@nxp.com \
--cc=gregkh@linuxfoundation.org \
--cc=hhhuuu@google.com \
--cc=jeffinphilip14@gmail.com \
--cc=kai.aizen.dev@gmail.com \
--cc=kees@kernel.org \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=patches@lists.linux.dev \
--cc=stable-commits@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xu.yang_2@nxp.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.