From: syzbot <syzbot+788733b16e87faa63deb@syzkaller.appspotmail.com>
To: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [input?] general protection fault in input_ff_flush
Date: Fri, 16 Oct 2026 11:23:19 -0700 [thread overview]
Message-ID: <6ad26b97.7952420f.283480.034d.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 2f2f7eeef8b0 Merge tag 'soc-fixes-7.3-3' of git://git.kern..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=166b2d71580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c4b098695335c89f
dashboard link: https://syzkaller.appspot.com/bug?extid=788733b16e87faa63deb
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c9f67f980000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+788733b16e87faa63deb@syzkaller.appspotmail.com
Warning: Permanently added '10.128.1.172' (ED25519) to the list of known hosts.
[*] Reproducer for general protection fault in input_ff_flush
[+] opendir /sys/class/udc successful.
[+] closedir /sys/class/udc successful.
[+] Using UDC device: dummy_udc.2
[+] open /dev/raw-gadget successful (fd=3).
[+] USB_RAW_IOCTL_INIT successful.
[+] pthread_create ep0_loop successful.
[+] pthread_create ep_io_loop successful.
[+] USB_RAW_IOCTL_RUN successful.
[*] Waiting for Logitech G920 to enumerate and bind...
[+] Found Logitech G920 device: 0003:046D:C262.0001
[*] Starting deterministic fault injection rebind loop (1..100)...
[+] fail_n=1: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event4, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event4.
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[+] fail_n=6: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event4, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event4.
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[+] fail_n=7: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event4, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event4.
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[*] Tested fail_n=10
[+] fail_n=11: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event4, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event4.
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[+] fail_n=15: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event4, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event4.
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[*] Tested fail_n=20
[+] fail_n=30: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event4, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event4.
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[+] fail_n=34: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
[+] fail_n=37: bind succeeded, scanning /dev/input to trigger bug...
[*] Opened /dev/input/event3, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event3.
[*] Opened /dev/input/event2, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event2.
[*] Opened /dev/input/event1, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event1.
[*] Opened /dev/input/event0, closing now (should crash if ff teardown leaked flush)...
[*] Closed /dev/input/event0.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-10-16 18:23 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ad26b97.7952420f.283480.034d.GAE@google.com \
--to=syzbot+788733b16e87faa63deb@syzkaller.appspotmail.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.