[syzbot] [input?] [usb?] WARNING: ODEBUG bug in devres_release_group

[syzbot] [input?] [usb?] WARNING: ODEBUG bug in devres_release_group

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    c4b9570cfb63 Merge tag 'audit-pr-20250121' of git://git.ke..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14d2cab0580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5d46425e33fe266e
dashboard link: https://syzkaller.appspot.com/bug?extid=cf5f2dd02bbd4d2d411c
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14f89824580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1331c9f8580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e34aaf236292/disk-c4b9570c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9fa1c2b70c0a/vmlinux-c4b9570c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12feb0aae53d/bzImage-c4b9570c.xz

The issue was bisected to:

commit 6ea2a6fd3872e60a4d500b548ad65ed94e459ddd
Author: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Date:   Tue Oct 8 23:30:29 2024 +0000

    HID: corsair-void: Add Corsair Void headset family driver

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=10afcab0580000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=12afcab0580000
console output: https://syzkaller.appspot.com/x/log.txt?x=14afcab0580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cf5f2dd02bbd4d2d411c@syzkaller.appspotmail.com
Fixes: 6ea2a6fd3872 ("HID: corsair-void: Add Corsair Void headset family driver")

WARNING: CPU: 0 PID: 1206 at lib/debugobjects.c:615 debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
Modules linked in:
CPU: 0 UID: 0 PID: 1206 Comm: kworker/0:2 Not tainted 6.13.0-syzkaller-02526-gc4b9570cfb63 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: usb_hub_wq hub_event
RIP: 0010:debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
Code: e8 4b 10 38 fd 4c 8b 0b 48 c7 c7 40 1e 60 8c 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f8 ff 34 24 e8 bb 3e 92 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 28 de 4c 0b 48 83 c4 10 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc9000451eeb8 EFLAGS: 00010286
RAX: 6e3a10eb39cc4d00 RBX: ffffffff8c0ca540 RCX: ffff8880279c8000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffffff8c601fc0 R08: ffffffff81603132 R09: fffffbfff1cfa638
R10: dffffc0000000000 R11: fffffbfff1cfa638 R12: 0000000000000000
R13: ffffffff8c601ed8 R14: dffffc0000000000 R15: ffff8880309f51a8
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555571005650 CR3: 0000000032228000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x45b/0x580 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2284 [inline]
 slab_free mm/slub.c:4613 [inline]
 kfree+0x115/0x430 mm/slub.c:4761
 release_nodes drivers/base/devres.c:506 [inline]
 devres_release_group+0x328/0x350 drivers/base/devres.c:689
 hid_device_remove+0x250/0x370 drivers/hid/hid-core.c:2779
 device_remove drivers/base/dd.c:567 [inline]
 __device_release_driver drivers/base/dd.c:1273 [inline]
 device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
 bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
 device_del+0x57a/0x9b0 drivers/base/core.c:3854
 hid_remove_device drivers/hid/hid-core.c:2958 [inline]
 hid_destroy_device+0x6a/0x1b0 drivers/hid/hid-core.c:2980
 usbhid_disconnect+0x9e/0xc0 drivers/hid/usbhid/hid-core.c:1458
 usb_unbind_interface+0x25b/0x940 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:569 [inline]
 __device_release_driver drivers/base/dd.c:1273 [inline]
 device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1296
 bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
 device_del+0x57a/0x9b0 drivers/base/core.c:3854
 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418
 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304
 hub_port_connect drivers/usb/core/hub.c:5363 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
 port_event drivers/usb/core/hub.c:5823 [inline]
 hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5905
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[PATCH] HID: corsair-void: cancel delayed status work if device removed

[Lizhi Xu]

syzbot reported a WARNING: ODEBUG bug in devres_release_group. [1]

Missing a cancel delayed work for the "delayed_status_work" in
corsair_void_remove.

[1]
ODEBUG: free active (active state 0) object: ffff8880286e09a8 object type: timer_list hint: corsair_void_status_work_handler+0x0/0x190
WARNING: CPU: 1 PID: 5847 at lib/debugobjects.c:615 debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 5847 Comm: kworker/1:4 Not tainted 6.13.0-syzkaller-02526-gc4b9570cfb63 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: usb_hub_wq hub_event
RIP: 0010:debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
Code: e8 4b 10 38 fd 4c 8b 0b 48 c7 c7 40 1e 60 8c 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f8 ff 34 24 e8 bb 3e 92 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 28 de 4c 0b 48 83 c4 10 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc90003e3eeb8 EFLAGS: 00010286
RAX: 3d29b0c77a543200 RBX: ffffffff8c0ca540 RCX: ffff88801213da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffffff8c601fc0 R08: ffffffff81603132 R09: fffffbfff1cfa638
R10: dffffc0000000000 R11: fffffbfff1cfa638 R12: 0000000000000000
R13: ffffffff8c601ed8 R14: dffffc0000000000 R15: ffff8880286e09a8
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff5312cda0 CR3: 0000000034840000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x45b/0x580 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2284 [inline]
 slab_free mm/slub.c:4613 [inline]
 kfree+0x115/0x430 mm/slub.c:4761
 release_nodes drivers/base/devres.c:506 [inline]
 devres_release_group+0x328/0x350 drivers/base/devres.c:689
 hid_device_remove+0x250/0x370 drivers/hid/hid-core.c:2779
 device_remove drivers/base/dd.c:567 [inline]
 __device_release_driver drivers/base/dd.c:1273 [inline]
 device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
 bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
 device_del+0x57a/0x9b0 drivers/base/core.c:3854
 hid_remove_device drivers/hid/hid-core.c:2958 [inline]
 hid_destroy_device+0x6a/0x1b0 drivers/hid/hid-core.c:2980
 usbhid_disconnect+0x9e/0xc0 drivers/hid/usbhid/hid-core.c:1458
 usb_unbind_interface+0x25b/0x940 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:569 [inline]
 __device_release_driver drivers/base/dd.c:1273 [inline]
 device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1296
 bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
 device_del+0x57a/0x9b0 drivers/base/core.c:3854
 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418
 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304
 hub_port_connect drivers/usb/core/hub.c:5363 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
 port_event drivers/usb/core/hub.c:5823 [inline]
 hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5905
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Fixes: 6ea2a6fd3872 ("HID: corsair-void: Add Corsair Void headset family driver")
Reported-by: syzbot+cf5f2dd02bbd4d2d411c@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
---
 drivers/hid/hid-corsair-void.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-corsair-void.c b/drivers/hid/hid-corsair-void.c
index 6ece56b850fc..bd8f3d849b58 100644
--- a/drivers/hid/hid-corsair-void.c
+++ b/drivers/hid/hid-corsair-void.c
@@ -726,6 +726,7 @@ static void corsair_void_remove(struct hid_device *hid_dev)
 	if (drvdata->battery)
 		power_supply_unregister(drvdata->battery);
 
+	cancel_delayed_work_sync(&drvdata->delayed_status_work);
 	cancel_delayed_work_sync(&drvdata->delayed_firmware_work);
 	sysfs_remove_group(&hid_dev->dev.kobj, &corsair_void_attr_group);
 }
-- 
2.43.0

Re: [PATCH] HID: corsair-void: cancel delayed status work if device removed

[Greg KH]

On Fri, Jan 24, 2025 at 04:09:15PM +0800, Lizhi Xu wrote:
> syzbot reported a WARNING: ODEBUG bug in devres_release_group. [1]
> 
> Missing a cancel delayed work for the "delayed_status_work" in
> corsair_void_remove.
> 
> [1]
> ODEBUG: free active (active state 0) object: ffff8880286e09a8 object type: timer_list hint: corsair_void_status_work_handler+0x0/0x190
> WARNING: CPU: 1 PID: 5847 at lib/debugobjects.c:615 debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
> Modules linked in:
> CPU: 1 UID: 0 PID: 5847 Comm: kworker/1:4 Not tainted 6.13.0-syzkaller-02526-gc4b9570cfb63 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:debug_print_object+0x17a/0x1f0 lib/debugobjects.c:612
> Code: e8 4b 10 38 fd 4c 8b 0b 48 c7 c7 40 1e 60 8c 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f8 ff 34 24 e8 bb 3e 92 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 28 de 4c 0b 48 83 c4 10 5b 41 5c 41 5d 41 5e 41
> RSP: 0018:ffffc90003e3eeb8 EFLAGS: 00010286
> RAX: 3d29b0c77a543200 RBX: ffffffff8c0ca540 RCX: ffff88801213da00
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
> RBP: ffffffff8c601fc0 R08: ffffffff81603132 R09: fffffbfff1cfa638
> R10: dffffc0000000000 R11: fffffbfff1cfa638 R12: 0000000000000000
> R13: ffffffff8c601ed8 R14: dffffc0000000000 R15: ffff8880286e09a8
> FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fff5312cda0 CR3: 0000000034840000 CR4: 00000000003526f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>  <TASK>
>  __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
>  debug_check_no_obj_freed+0x45b/0x580 lib/debugobjects.c:1129
>  slab_free_hook mm/slub.c:2284 [inline]
>  slab_free mm/slub.c:4613 [inline]
>  kfree+0x115/0x430 mm/slub.c:4761
>  release_nodes drivers/base/devres.c:506 [inline]
>  devres_release_group+0x328/0x350 drivers/base/devres.c:689
>  hid_device_remove+0x250/0x370 drivers/hid/hid-core.c:2779
>  device_remove drivers/base/dd.c:567 [inline]
>  __device_release_driver drivers/base/dd.c:1273 [inline]
>  device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
>  bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
>  device_del+0x57a/0x9b0 drivers/base/core.c:3854
>  hid_remove_device drivers/hid/hid-core.c:2958 [inline]
>  hid_destroy_device+0x6a/0x1b0 drivers/hid/hid-core.c:2980
>  usbhid_disconnect+0x9e/0xc0 drivers/hid/usbhid/hid-core.c:1458
>  usb_unbind_interface+0x25b/0x940 drivers/usb/core/driver.c:458
>  device_remove drivers/base/dd.c:569 [inline]
>  __device_release_driver drivers/base/dd.c:1273 [inline]
>  device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1296
>  bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
>  device_del+0x57a/0x9b0 drivers/base/core.c:3854
>  usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418
>  usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304
>  hub_port_connect drivers/usb/core/hub.c:5363 [inline]
>  hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
>  port_event drivers/usb/core/hub.c:5823 [inline]
>  hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5905
>  process_one_work kernel/workqueue.c:3236 [inline]
>  process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
>  worker_thread+0x870/0xd30 kernel/workqueue.c:3398
>  kthread+0x7a9/0x920 kernel/kthread.c:464
>  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> 
> Fixes: 6ea2a6fd3872 ("HID: corsair-void: Add Corsair Void headset family driver")
> Reported-by: syzbot+cf5f2dd02bbd4d2d411c@syzkaller.appspotmail.com
> Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
> ---
>  drivers/hid/hid-corsair-void.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hid/hid-corsair-void.c b/drivers/hid/hid-corsair-void.c
> index 6ece56b850fc..bd8f3d849b58 100644
> --- a/drivers/hid/hid-corsair-void.c
> +++ b/drivers/hid/hid-corsair-void.c
> @@ -726,6 +726,7 @@ static void corsair_void_remove(struct hid_device *hid_dev)
>  	if (drvdata->battery)
>  		power_supply_unregister(drvdata->battery);
>  
> +	cancel_delayed_work_sync(&drvdata->delayed_status_work);
>  	cancel_delayed_work_sync(&drvdata->delayed_firmware_work);
>  	sysfs_remove_group(&hid_dev->dev.kobj, &corsair_void_attr_group);
>  }
> -- 
> 2.43.0
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- You have marked a patch with a "Fixes:" tag for a commit that is in an
  older released kernel, yet you do not have a cc: stable line in the
  signed-off-by area at all, which means that the patch will not be
  applied to any older kernel releases.  To properly fix this, please
  follow the documented rules in the
  Documentation/process/stable-kernel-rules.rst file for how to resolve
  this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

Re: [PATCH] HID: corsair-void: cancel delayed status work if device removed

[Stuart]

Hi,

This should already be covered by
https://lore.kernel.org/all/20250121200017.33966-1-stuart.a.hayhurst@gmail.com/

Thanks,
Stuart

Re: [syzbot] [usb?] [input?] WARNING: ODEBUG bug in devres_release_group

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 48e487b002891eb0aeaec704c9bed51f028deff1
Author: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Date:   Tue Jan 21 20:00:07 2025 +0000

    HID: corsair-void: Add missing delayed work cancel for headset status

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16abd478580000
start commit:   c4b9570cfb63 Merge tag 'audit-pr-20250121' of git://git.ke..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=5d46425e33fe266e
dashboard link: https://syzkaller.appspot.com/bug?extid=cf5f2dd02bbd4d2d411c
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1233c9f8580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=147eb618580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: HID: corsair-void: Add missing delayed work cancel for headset status

For information about bisection process see: https://goo.gl/tpsmEJ#bisection