* [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
@ 2025-10-25 7:30 syzbot
2026-03-07 10:52 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2025-10-25 7:30 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 566771afc7a8 Merge tag 'v6.18-rc2-smb-server-fixes' of git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13956e7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8345ce4ce316ca28
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/52417ef1f782/disk-566771af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/66730a263bf1/vmlinux-566771af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1fe0762efb1f/bzImage-566771af.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
usb 1-1: new full-speed USB device number 6 using dummy_hcd
usb 1-1: unable to read config index 0 descriptor/all
usb 1-1: can't read configurations, error -110
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 5869 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1195
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 3e 6b fb fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 bb 22 5d fb 4d 8b 1e 48 89 df 2e 2e
RSP: 0018:ffffc900051b7260 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888143b54c40 RCX: dffffc0000000000
RDX: ffffc9001a01b000 RSI: 0000000000002b35 RDI: 0000000000002b36
RBP: ffff8880305aa66c R08: ffffffff8ed62877 R09: 1ffffffff1dac50e
R10: dffffc0000000000 R11: fffffbfff1dac50f R12: ffff888143b54c40
R13: 1ffff11004eceaa1 R14: 0000000000000040 R15: 1ffff1102876a987
FS: 0000000000000000(0000) GS:ffff888126efc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce4efb4f98 CR3: 000000004a02e000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
dummy_hub_control+0xcc0/0x1760 drivers/usb/gadget/udc/dummy_hcd.c:2327
rh_call_control drivers/usb/core/hcd.c:656 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:821 [inline]
usb_hcd_submit_urb+0xde9/0x1a80 drivers/usb/core/hcd.c:1542
usb_start_wait_urb+0x114/0x4c0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:470 [inline]
hub_port_reset+0x390/0x1740 drivers/usb/core/hub.c:3082
hub_port_init+0x2b0/0x2800 drivers/usb/core/hub.c:4938
hub_port_connect drivers/usb/core/hub.c:5495 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5870 [inline]
hub_event+0x2532/0x4a20 drivers/usb/core/hub.c:5952
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1195
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 3e 6b fb fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 bb 22 5d fb 4d 8b 1e 48 89 df 2e 2e
RSP: 0018:ffffc900051b7260 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888143b54c40 RCX: dffffc0000000000
RDX: ffffc9001a01b000 RSI: 0000000000002b35 RDI: 0000000000002b36
RBP: ffff8880305aa66c R08: ffffffff8ed62877 R09: 1ffffffff1dac50e
R10: dffffc0000000000 R11: fffffbfff1dac50f R12: ffff888143b54c40
R13: 1ffff11004eceaa1 R14: 0000000000000040 R15: 1ffff1102876a987
FS: 0000000000000000(0000) GS:ffff888126efc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce4efb4f98 CR3: 000000004a02e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 41 56 push %r14
9: 53 push %rbx
a: 49 89 f6 mov %rsi,%r14
d: 48 89 fb mov %rdi,%rbx
10: e8 3e 6b fb fa call 0xfafb6b53
15: 49 83 c6 40 add $0x40,%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 bb 22 5d fb call 0xfb5d22f3
38: 4d 8b 1e mov (%r14),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 26+ messages in thread* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2025-10-25 7:30 [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) syzbot @ 2026-03-07 10:52 ` syzbot 2026-03-08 15:36 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-07 10:52 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 651690480a96 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11ec0806580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b2db5a580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fed8d6580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/0e393fccfaa3/disk-65169048.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/2930e8c98c89/vmlinux-65169048.xz kernel image: https://storage.googleapis.com/syzbot-assets/34e9e7d322b1/bzImage-65169048.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com usb 1-1: reset high-speed USB device number 2 using dummy_hcd usb 1-1: device descriptor read/8, error -32 Oops: general protection fault, probably [ 120.351719][ T6052] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 0 UID: 0 PID: 6052 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0018:ffffc9000415e4c8 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029facc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880341b2b6c R08: ffffffff8f6a4eb7 R09: 1ffffffff1ed49d6 R10: dffffc0000000000 R11: fffffbfff1ed49d7 R12: ffff888029facc40 R13: 1ffff110053f38a1 R14: 0000000000000040 R15: 1ffff110053f5987 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007eff7c4020c0 CR3: 00000000324ce000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 usb_reset_and_verify_device+0x1661/0x1af0 drivers/usb/core/hub.c:6215 usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410 sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221 gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0018:ffffc9000415e4c8 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029facc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880341b2b6c R08: ffffffff8f6a4eb7 R09: 1ffffffff1ed49d6 R10: dffffc0000000000 R11: fffffbfff1ed49d7 R12: ffff888029facc40 R13: 1ffff110053f38a1 R14: 0000000000000040 R15: 1ffff110053f5987 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007eff7c4020c0 CR3: 00000000379ee000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: f3 0f 1e fa endbr64 7: 41 56 push %r14 9: 53 push %rbx a: 49 89 f6 mov %rsi,%r14 d: 48 89 fb mov %rdi,%rbx 10: e8 6e 5c c0 fa call 0xfac05c83 15: 49 83 c6 40 add $0x40,%r14 19: 4c 89 f0 mov %r14,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 cb 74 26 fb call 0xfb267503 38: 4d 8b 1e mov (%r14),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: e8 .byte 0xe8 --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-07 10:52 ` syzbot @ 2026-03-08 15:36 ` Alan Stern 2026-03-08 16:01 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-08 15:36 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Sat, Mar 07, 2026 at 02:52:24AM -0800, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 651690480a96 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=11ec0806580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 > dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b2db5a580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fed8d6580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/0e393fccfaa3/disk-65169048.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/2930e8c98c89/vmlinux-65169048.xz > kernel image: https://storage.googleapis.com/syzbot-assets/34e9e7d322b1/bzImage-65169048.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > > usb 1-1: reset high-speed USB device number 2 using dummy_hcd > usb 1-1: device descriptor read/8, error -32 > Oops: general protection fault, probably [ 120.351719][ T6052] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI > KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] > CPU: 0 UID: 0 PID: 6052 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 > Workqueue: usb_hub_wq hub_event > RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 > Call Trace: > <TASK> > set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469 It's a little hard to tell exactly what is wrong here, but it looks like the driver argument to usb_gadget_udc_reset() may be NULL. Let's see if that's really the problem. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -465,7 +465,9 @@ static void set_link_state(struct dummy_ stop_activity(dum); ++dum->callback_usage; spin_unlock(&dum->lock); - if (reset) + if (!dum->driver) + dev_err(dummy_dev(dum_hcd), "**** NO DRIVER!\n"); + else if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else dum->driver->disconnect(&dum->gadget); ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-08 15:36 ` Alan Stern @ 2026-03-08 16:01 ` syzbot 2026-03-09 14:25 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-08 16:01 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=133f3fe6580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=178dc8ba580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-08 16:01 ` syzbot @ 2026-03-09 14:25 ` Alan Stern 2026-03-09 14:55 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-09 14:25 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Sun, Mar 08, 2026 at 09:01:01AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > > Tested on: > > commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > console output: https://syzkaller.appspot.com/x/log.txt?x=133f3fe6580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 > dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > patch: https://syzkaller.appspot.com/x/patch.diff?x=178dc8ba580000 > > Note: testing is done by a robot and is best-effort only. That's not very helpful. Let's try a slightly different approach. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/core.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/core.c +++ usb-devel/drivers/usb/gadget/udc/core.c @@ -1192,7 +1192,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); void usb_gadget_udc_reset(struct usb_gadget *gadget, struct usb_gadget_driver *driver) { + dev_info(&gadget->dev, "Reset #1, driver %p\n", driver); driver->reset(gadget); + dev_info(&gadget->dev, "Reset #2\n"); usb_gadget_set_state(gadget, USB_STATE_DEFAULT); } EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-09 14:25 ` Alan Stern @ 2026-03-09 14:55 ` syzbot 2026-03-09 15:24 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-09 14:55 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset raw-gadget.0 gadget.1: Reset #2 usb 2-1: device descriptor read/64, error -32 gadget gadget.1: Reset #1, driver 0000000000000000 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 0 UID: 0 PID: 5814 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x42/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 01 00 00 4c 89 f7 48 c7 c6 a0 d2 fb 8b 4c 89 fa e8 23 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 f0 da fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90004be64c0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029e78c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880348cba6c R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff5200097cc01 R12: ffff888029e78c40 R13: 1ffff110053ee2a1 R14: ffff888029e78d58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f16fca6890f CR3: 000000003df2e000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 usb_reset_and_verify_device+0x105d/0x1af0 drivers/usb/core/hub.c:6215 usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410 sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221 gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x42/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 01 00 00 4c 89 f7 48 c7 c6 a0 d2 fb 8b 4c 89 fa e8 23 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 f0 da fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90004be64c0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029e78c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880348cba6c R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff5200097cc01 R12: ffff888029e78c40 R13: 1ffff110053ee2a1 R14: ffff888029e78d58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f16fca6890f CR3: 000000003df2e000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 01 00 add %eax,(%rax) 2: 00 4c 89 f7 add %cl,-0x9(%rcx,%rcx,4) 6: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi d: 4c 89 fa mov %r15,%rdx 10: e8 23 5b fd ff call 0xfffd5b38 15: 49 83 c7 40 add $0x40,%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 f0 da fb 00 call 0xfbdb28 38: 4d 8b 1f mov (%r15),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: 2e cs Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=144e6016580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=131c375a580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-09 14:55 ` syzbot @ 2026-03-09 15:24 ` Alan Stern 2026-03-09 15:43 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-09 15:24 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Mon, Mar 09, 2026 at 07:55:02AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > raw-gadget.0 gadget.1: Reset #2 > usb 2-1: device descriptor read/64, error -32 > gadget gadget.1: Reset #1, driver 0000000000000000 > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI > KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] > CPU: 0 UID: 0 PID: 5814 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 > Workqueue: usb_hub_wq hub_event > RIP: 0010:usb_gadget_udc_reset+0x42/0x80 drivers/usb/gadget/udc/core.c:1201 That's a little weird. All the new debugging messages in the console log are of the form "raw-gadget.0 gadget.1 Reset ...", but the last, failing one says "gadget gadget.1 Reset ...". I wonder what that indicates. Maybe this next test will help find out. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/core.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/core.c +++ usb-devel/drivers/usb/gadget/udc/core.c @@ -1192,7 +1192,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); void usb_gadget_udc_reset(struct usb_gadget *gadget, struct usb_gadget_driver *driver) { + dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver); driver->reset(gadget); + dev_info(&gadget->dev, "Reset #2\n"); usb_gadget_set_state(gadget, USB_STATE_DEFAULT); } EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-09 15:24 ` Alan Stern @ 2026-03-09 15:43 ` syzbot 2026-03-10 15:50 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-09 15:43 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset usb 2-1: reset high-speed USB device number 8 using dummy_hcd usb 2-1: device descriptor read/8, error -32 gadget gadget.1: Reset #1, gadget ffff888029d60c40 driver 0000000000000000 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 1 UID: 0 PID: 6630 Comm: kworker/1:8 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc900049464c0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029d60c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888025502d6c R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029d60c40 R13: 1ffff110053d16a1 R14: ffff888029d60d58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055c90080a138 CR3: 00000000114f4000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 usb_reset_and_verify_device+0x1661/0x1af0 drivers/usb/core/hub.c:6215 usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410 sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221 gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc900049464c0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029d60c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888025502d6c R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029d60c40 R13: 1ffff110053d16a1 R14: ffff888029d60d58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055c90080a138 CR3: 00000000114f4000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 4c 89 f7 mov %r14,%rdi 3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi a: 48 89 da mov %rbx,%rdx d: 4c 89 f9 mov %r15,%rcx 10: e8 20 5b fd ff call 0xfffd5b35 15: 49 83 c7 40 add $0x40,%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 ed da fb 00 call 0xfbdb25 38: 4d 8b 1f mov (%r15),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: 2e cs Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=10828d52580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=1019a3aa580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-09 15:43 ` syzbot @ 2026-03-10 15:50 ` Alan Stern 2026-03-10 16:09 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-10 15:50 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Mon, Mar 09, 2026 at 08:43:01AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > usb 2-1: reset high-speed USB device number 8 using dummy_hcd > usb 2-1: device descriptor read/8, error -32 > gadget gadget.1: Reset #1, gadget ffff888029d60c40 driver 0000000000000000 > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI That's helpful. And it turns out the reason that "raw-gadget.0" changes to "gadget" right before the crash is because the raw-gadget driver has been unbound, and when no driver is bound the dev_xxxx() calls use the bus-type name instead. An audit shows that the untimely driver unbinding occurs because of an error in synchronization. The code in dummy-hcd which emulates synchronize_irq() should run after the emulated interrupts are disabled, not before. That code needs to be moved from dummy_pullup() to dummy_udc_async_callbacks(). Let's see if this fixes the bug. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/core.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/core.c +++ usb-devel/drivers/usb/gadget/udc/core.c @@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); void usb_gadget_udc_reset(struct usb_gadget *gadget, struct usb_gadget_driver *driver) { + dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver); driver->reset(gadget); + dev_info(&gadget->dev, "Reset #2\n"); usb_gadget_set_state(gadget, USB_STATE_DEFAULT); } EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -908,21 +908,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +930,23 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + if (!enable) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + } spin_unlock_irq(&dum->lock); } ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-10 15:50 ` Alan Stern @ 2026-03-10 16:09 ` syzbot 2026-03-10 19:02 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-10 16:09 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset gadget gadget.4: Reset #1, gadget ffff8880294bcc40 driver 0000000000000000 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 0 UID: 0 PID: 5912 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90004c064c0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff8880294bcc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880206be26c R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff52000980c01 R12: ffff8880294bcc40 R13: 1ffff110052caca1 R14: ffff8880294bcd58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000563d3bdf1be0 CR3: 000000002872c000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 usb_reset_and_verify_device+0x105d/0x1af0 drivers/usb/core/hub.c:6215 usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410 sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221 gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90004c064c0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff8880294bcc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880206be26c R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff52000980c01 R12: ffff8880294bcc40 R13: 1ffff110052caca1 R14: ffff8880294bcd58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000563d3bdf1be0 CR3: 000000002872c000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 4c 89 f7 mov %r14,%rdi 3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi a: 48 89 da mov %rbx,%rdx d: 4c 89 f9 mov %r15,%rcx 10: e8 20 5b fd ff call 0xfffd5b35 15: 49 83 c7 40 add $0x40,%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 ed da fb 00 call 0xfbdb25 38: 4d 8b 1f mov (%r15),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: 2e cs Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=1023f8d6580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=1793d016580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-10 16:09 ` syzbot @ 2026-03-10 19:02 ` Alan Stern 2026-03-10 19:32 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-10 19:02 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Tue, Mar 10, 2026 at 09:09:02AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > gadget gadget.4: Reset #1, gadget ffff8880294bcc40 driver 0000000000000000 > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI That's a little surprising. Here's a test with more debugging printouts, along with a delay to make a race more likely to occur. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/core.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/core.c +++ usb-devel/drivers/usb/gadget/udc/core.c @@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); void usb_gadget_udc_reset(struct usb_gadget *gadget, struct usb_gadget_driver *driver) { + dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver); driver->reset(gadget); + dev_info(&gadget->dev, "Reset #2\n"); usb_gadget_set_state(gadget, USB_STATE_DEFAULT); } EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -464,7 +464,9 @@ static void set_link_state(struct dummy_ if (dum->ints_enabled && (disconnect || reset)) { stop_activity(dum); ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Reset usage %d\n", dum->callback_usage); spin_unlock(&dum->lock); + udelay(1000); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else @@ -908,21 +910,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +932,25 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + if (!enable) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + dev_info(&_gadget->dev, "Disable usage %d\n", dum->callback_usage); + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + dev_info(&_gadget->dev, "Disable done\n"); + } spin_unlock_irq(&dum->lock); } @@ -1034,6 +1040,7 @@ static int dummy_udc_stop(struct usb_gad dum->ints_enabled = 0; stop_activity(dum); dum->driver = NULL; + dev_info(&g->dev, "Dummy stop\n"); spin_unlock_irq(&dum->lock); return 0; ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-10 19:02 ` Alan Stern @ 2026-03-10 19:32 ` syzbot 2026-03-11 1:50 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-10 19:32 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset gadget gadget.2: Reset usage 1 gadget gadget.2: Reset #1, gadget ffff888029b6cc40 driver 0000000000000000 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 1 UID: 0 PID: 6660 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90003de64c8 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029b6cc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029b6cc40 R13: ffff888029cac50b R14: ffff888029b6cd58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc51d195fb3 CR3: 000000005ff3a000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0xad6/0xff0 drivers/usb/gadget/udc/dummy_hcd.c:471 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 usb_reset_and_verify_device+0x105d/0x1af0 drivers/usb/core/hub.c:6215 usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410 sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221 gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90003de64c8 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029b6cc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029b6cc40 R13: ffff888029cac50b R14: ffff888029b6cd58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc51d195fb3 CR3: 00000000364fe000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 4c 89 f7 mov %r14,%rdi 3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi a: 48 89 da mov %rbx,%rdx d: 4c 89 f9 mov %r15,%rcx 10: e8 20 5b fd ff call 0xfffd5b35 15: 49 83 c7 40 add $0x40,%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 ed ea fb 00 call 0xfbeb25 38: 4d 8b 1f mov (%r15),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: 2e cs Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=1490d3aa580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=1016975a580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-10 19:32 ` syzbot @ 2026-03-11 1:50 ` Alan Stern 2026-03-11 3:16 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-11 1:50 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Tue, Mar 10, 2026 at 12:32:03PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset I'm getting the impression from the console log that this isn't a race between unbind and reset after all, but between bind and reset. The log contains these two lines: [ 250.845916][ T7233] raw-gadget.4 gadget.2: Dummy stop [ 250.847972][ T6660] gadget gadget.2: Reset usage 1 The dummy_udc_stop() routine sets ints_enabled to 0, but the "Reset usage 1" line is printed only if ints_enabled != 0. The only way for ints_enabled to be set to a nonzero value is through a call to usb_gadget_enable_async_callbacks(), which happens only in gadget_bind_driver(). So let's add more debugging messages to track binding as well as unbinding events. Alan Stern #syz test: upstream 651690480a96 2 files changed, 26 insertions(+), 15 deletions(-) Index: usb-devel/drivers/usb/gadget/udc/core.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/core.c +++ usb-devel/drivers/usb/gadget/udc/core.c @@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); void usb_gadget_udc_reset(struct usb_gadget *gadget, struct usb_gadget_driver *driver) { + dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver); driver->reset(gadget); + dev_info(&gadget->dev, "Reset #2\n"); usb_gadget_set_state(gadget, USB_STATE_DEFAULT); } EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -464,7 +464,9 @@ static void set_link_state(struct dummy_ if (dum->ints_enabled && (disconnect || reset)) { stop_activity(dum); ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Reset usage %d\n", dum->callback_usage); spin_unlock(&dum->lock); + udelay(1000); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else @@ -906,23 +908,9 @@ static int dummy_pullup(struct usb_gadge dum_hcd = gadget_to_dummy_hcd(_gadget); spin_lock_irqsave(&dum->lock, flags); + dev_info(&_gadget->dev, "Dummy pullup %d\n", value); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +933,25 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + dev_info(&_gadget->dev, "Dummy ints_enabled %d\n", enable); + if (!enable) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + dev_info(&_gadget->dev, "Disable done\n"); + } spin_unlock_irq(&dum->lock); } @@ -1020,6 +1027,7 @@ static int dummy_udc_start(struct usb_ga spin_lock_irq(&dum->lock); dum->devstatus = 0; dum->driver = driver; + dev_info(&g->dev, "Dummy start\n"); spin_unlock_irq(&dum->lock); return 0; @@ -1034,6 +1042,7 @@ static int dummy_udc_stop(struct usb_gad dum->ints_enabled = 0; stop_activity(dum); dum->driver = NULL; + dev_info(&g->dev, "Dummy stop\n"); spin_unlock_irq(&dum->lock); return 0; ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-11 1:50 ` Alan Stern @ 2026-03-11 3:16 ` syzbot 2026-03-11 18:44 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-11 3:16 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset gadget gadget.0: Reset usage 1 gadget gadget.0: Reset #1, gadget ffff888027440c40 driver 0000000000000000 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 1 UID: 0 PID: 6315 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90003d77308 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888027440c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888027440c40 R13: ffff888029fe250b R14: ffff888027440d58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f168c5e3286 CR3: 0000000036838000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0xad6/0xff0 drivers/usb/gadget/udc/dummy_hcd.c:471 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 hub_port_connect drivers/usb/core/hub.c:5496 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201 Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e RSP: 0018:ffffc90003d77308 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888027440c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888027440c40 R13: ffff888029fe250b R14: ffff888027440d58 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f168c5e3286 CR3: 0000000036838000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 4c 89 f7 mov %r14,%rdi 3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi a: 48 89 da mov %rbx,%rdx d: 4c 89 f9 mov %r15,%rcx 10: e8 20 5b fd ff call 0xfffd5b35 15: 49 83 c7 40 add $0x40,%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 ed ea fb 00 call 0xfbeb25 38: 4d 8b 1f mov (%r15),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: 2e cs Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=15cd975a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=16e44d52580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-11 3:16 ` syzbot @ 2026-03-11 18:44 ` Alan Stern 2026-03-11 19:25 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-11 18:44 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Tue, Mar 10, 2026 at 08:16:03PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > gadget gadget.0: Reset usage 1 > gadget gadget.0: Reset #1, gadget ffff888027440c40 driver 0000000000000000 It looks like dum->ints_enabled is getting set to a nonzero value when it shouldn't be. Let's track all the places where it gets changed and the place where it gets tested. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -460,11 +460,15 @@ static void set_link_state(struct dummy_ unsigned int reset = USB_PORT_STAT_RESET & (~dum_hcd->old_status) & dum_hcd->port_status; + if (reset) + dev_info(&dum->gadget.dev, "Dummy %p reset, ints_enabled %d\n", dum, dum->ints_enabled); + /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { stop_activity(dum); ++dum->callback_usage; spin_unlock(&dum->lock); + udelay(1000); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else @@ -908,21 +912,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +934,26 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + dev_info(&_gadget->dev, "Dummy %p ints_enabled <- %d A\n", dum, dum->ints_enabled); + if (!enable) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + if (dum->ints_enabled) + dev_info(&_gadget->dev, "Dummy %p ints_enabled = %d !\n", dum, dum->ints_enabled); + } spin_unlock_irq(&dum->lock); } @@ -1032,6 +1041,7 @@ static int dummy_udc_stop(struct usb_gad spin_lock_irq(&dum->lock); dum->ints_enabled = 0; + dev_info(&g->dev, "Dummy %p ints_enabled <- %d B\n", dum, dum->ints_enabled); stop_activity(dum); dum->driver = NULL; spin_unlock_irq(&dum->lock); ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-11 18:44 ` Alan Stern @ 2026-03-11 19:25 ` syzbot 2026-03-12 17:56 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-11 19:25 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0000:ffffc90004e97308 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888027e5cc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888027e5c000 R08: ffffffff8f6a4fb7 R09: 1ffffffff1ed49f6 R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: ffff888027e5cc3c R13: ffff888027e5cbc0 R14: 0000000000000040 R15: 1ffff11004fcb987 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558766fe1070 CR3: 000000003a8c8000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0x81b/0x1340 drivers/usb/gadget/udc/dummy_hcd.c:473 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 hub_port_connect drivers/usb/core/hub.c:5496 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0000:ffffc90004e97308 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888027e5cc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888027e5c000 R08: ffffffff8f6a4fb7 R09: 1ffffffff1ed49f6 R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: ffff888027e5cc3c R13: ffff888027e5cbc0 R14: 0000000000000040 R15: 1ffff11004fcb987 FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558766fe1070 CR3: 0000000038c0e000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: f3 0f 1e fa endbr64 7: 41 56 push %r14 9: 53 push %rbx a: 49 89 f6 mov %rsi,%r14 d: 48 89 fb mov %rdi,%rbx 10: e8 6e 5c c0 fa call 0xfac05c83 15: 49 83 c6 40 add $0x40,%r14 19: 4c 89 f0 mov %r14,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 cb 74 26 fb call 0xfb267503 38: 4d 8b 1e mov (%r14),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: e8 .byte 0xe8 Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=143d04d6580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=1686575a580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-11 19:25 ` syzbot @ 2026-03-12 17:56 ` Alan Stern 2026-03-12 18:29 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-12 17:56 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Wed, Mar 11, 2026 at 12:25:04PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset The console log contains some very strange looking stuff. I need more debugging info. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -460,21 +460,28 @@ static void set_link_state(struct dummy_ unsigned int reset = USB_PORT_STAT_RESET & (~dum_hcd->old_status) & dum_hcd->port_status; + if (reset) + dev_info(&dum->gadget.dev, "Dummy %p reset, ints_enabled %d\n", dum, dum->ints_enabled); + /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { stop_activity(dum); ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d A\n", dum->callback_usage); spin_unlock(&dum->lock); + udelay(1000); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else dum->driver->disconnect(&dum->gadget); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d A\n", dum->callback_usage); } } else if (dum_hcd->active != dum_hcd->old_active && dum->ints_enabled) { ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d B\n", dum->callback_usage); spin_unlock(&dum->lock); if (dum_hcd->old_active && dum->driver->suspend) dum->driver->suspend(&dum->gadget); @@ -482,6 +489,7 @@ static void set_link_state(struct dummy_ dum->driver->resume(&dum->gadget); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d B\n", dum->callback_usage); } dum_hcd->old_status = dum_hcd->port_status; @@ -908,21 +916,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +938,27 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + dev_info(&_gadget->dev, "Dummy %p ints_enabled <- %d A\n", dum, dum->ints_enabled); + if (!enable) { + dev_info(&dum->gadget.dev, "Wait usage %d\n", dum->callback_usage); + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + if (dum->ints_enabled) + dev_info(&_gadget->dev, "Dummy %p ints_enabled = %d !\n", dum, dum->ints_enabled); + } spin_unlock_irq(&dum->lock); } @@ -1020,6 +1034,8 @@ static int dummy_udc_start(struct usb_ga spin_lock_irq(&dum->lock); dum->devstatus = 0; dum->driver = driver; + dev_info(&dum->gadget.dev, "Start on bus %d\n", + dummy_hcd_to_hcd(dum_hcd)->self.busnum); spin_unlock_irq(&dum->lock); return 0; @@ -1032,6 +1048,7 @@ static int dummy_udc_stop(struct usb_gad spin_lock_irq(&dum->lock); dum->ints_enabled = 0; + dev_info(&g->dev, "Dummy %p ints_enabled <- %d B\n", dum, dum->ints_enabled); stop_activity(dum); dum->driver = NULL; spin_unlock_irq(&dum->lock); @@ -1923,11 +1940,13 @@ restart: */ if (value > 0) { ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d C\n", dum->callback_usage); spin_unlock(&dum->lock); value = dum->driver->setup(&dum->gadget, &setup); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d C\n", dum->callback_usage); if (value >= 0) { /* no delays (max 64KB data stage) */ ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-12 17:56 ` Alan Stern @ 2026-03-12 18:29 ` syzbot 2026-03-13 2:05 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-12 18:29 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset raw-gadget.1 gadget.3: Inc usage: 1 A Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 1 UID: 0 PID: 5926 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0018:ffffc90004197310 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029ce8c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36 R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: 1ffff1100539d187 R13: ffff8880296b450b R14: 0000000000000040 R15: ffff888029ce8c40 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f21940fcff8 CR3: 0000000038eda000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0xa17/0x10c0 drivers/usb/gadget/udc/dummy_hcd.c:474 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939 hub_port_connect drivers/usb/core/hub.c:5496 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0018:ffffc90004197310 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff888029ce8c40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36 R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: 1ffff1100539d187 R13: ffff8880296b450b R14: 0000000000000040 R15: ffff888029ce8c40 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f21940fcff8 CR3: 00000000348ae000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: f3 0f 1e fa endbr64 7: 41 56 push %r14 9: 53 push %rbx a: 49 89 f6 mov %rsi,%r14 d: 48 89 fb mov %rdi,%rbx 10: e8 6e 5c c0 fa call 0xfac05c83 15: 49 83 c6 40 add $0x40,%r14 19: 4c 89 f0 mov %r14,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 cb 74 26 fb call 0xfb267503 38: 4d 8b 1e mov (%r14),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: e8 .byte 0xe8 Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=153e775a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=162dd75a580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-12 18:29 ` syzbot @ 2026-03-13 2:05 ` Alan Stern 2026-03-13 2:42 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-13 2:05 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Thu, Mar 12, 2026 at 11:29:03AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > raw-gadget.1 gadget.3: Inc usage: 1 A > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI Apparently one of the events I thought was a reset is actually a disconnect? Let's get even more info. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -460,21 +460,27 @@ static void set_link_state(struct dummy_ unsigned int reset = USB_PORT_STAT_RESET & (~dum_hcd->old_status) & dum_hcd->port_status; + dev_info(&dum->gadget.dev, "Dummy disconnect %d reset %d, ints_enabled %d\n", disconnect, reset, dum->ints_enabled); + /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { stop_activity(dum); ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d X\n", dum->callback_usage); spin_unlock(&dum->lock); + udelay(1000); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else dum->driver->disconnect(&dum->gadget); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d X\n", dum->callback_usage); } } else if (dum_hcd->active != dum_hcd->old_active && dum->ints_enabled) { ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d Y\n", dum->callback_usage); spin_unlock(&dum->lock); if (dum_hcd->old_active && dum->driver->suspend) dum->driver->suspend(&dum->gadget); @@ -482,6 +488,7 @@ static void set_link_state(struct dummy_ dum->driver->resume(&dum->gadget); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d Y\n", dum->callback_usage); } dum_hcd->old_status = dum_hcd->port_status; @@ -908,21 +915,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +937,27 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + dev_info(&_gadget->dev, "Dummy ints_enabled <- %d A\n", dum->ints_enabled); + if (!enable) { + dev_info(&dum->gadget.dev, "Wait usage %d\n", dum->callback_usage); + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + if (dum->ints_enabled) + dev_info(&_gadget->dev, "Dummy ints_enabled = %d !\n", dum->ints_enabled); + } spin_unlock_irq(&dum->lock); } @@ -1020,6 +1033,8 @@ static int dummy_udc_start(struct usb_ga spin_lock_irq(&dum->lock); dum->devstatus = 0; dum->driver = driver; + dev_info(&dum->gadget.dev, "Start on bus %d\n", + dummy_hcd_to_hcd(dum_hcd)->self.busnum); spin_unlock_irq(&dum->lock); return 0; @@ -1032,6 +1047,7 @@ static int dummy_udc_stop(struct usb_gad spin_lock_irq(&dum->lock); dum->ints_enabled = 0; + dev_info(&g->dev, "Dummy ints_enabled <- %d B\n", dum->ints_enabled); stop_activity(dum); dum->driver = NULL; spin_unlock_irq(&dum->lock); @@ -1923,11 +1939,13 @@ restart: */ if (value > 0) { ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d Z\n", dum->callback_usage); spin_unlock(&dum->lock); value = dum->driver->setup(&dum->gadget, &setup); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d Z\n", dum->callback_usage); if (value >= 0) { /* no delays (max 64KB data stage) */ ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-13 2:05 ` Alan Stern @ 2026-03-13 2:42 ` syzbot 2026-03-13 16:07 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-13 2:42 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in usb_gadget_udc_reset raw-gadget.1 gadget.0: Dummy disconnect 0 reset 16, ints_enabled 1 raw-gadget.1 gadget.0: Inc usage: 1 X Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 1 UID: 0 PID: 6645 Comm: kworker/1:10 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0000:ffffc900045f64d0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff88802702cc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36 R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: dffffc0000000000 R13: ffff888029a7850b R14: 0000000000000040 R15: 0000000000000010 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feeb9ff20c0 CR3: 000000003a1fe000 CR4: 00000000003526f0 Call Trace: <TASK> set_link_state+0xb30/0x1080 drivers/usb/gadget/udc/dummy_hcd.c:473 dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1 rh_call_control drivers/usb/core/hcd.c:652 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline] usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538 usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59 usb_internal_control_msg drivers/usb/core/message.c:103 [inline] usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154 set_port_feature drivers/usb/core/hub.c:466 [inline] hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083 hub_port_init+0xf50/0x28c0 drivers/usb/core/hub.c:5056 usb_reset_and_verify_device+0x4ea/0x1af0 drivers/usb/core/hub.c:6215 usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410 sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221 gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:661 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803 driver_probe_device+0x4f/0x240 drivers/base/dd.c:833 __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1033 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088 bus_probe_device+0x12d/0x220 drivers/base/bus.c:574 device_add+0x7b6/0xb80 drivers/base/core.c:3689 usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200 Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8 RSP: 0000:ffffc900045f64d0 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff88802702cc40 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36 R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: dffffc0000000000 R13: ffff888029a7850b R14: 0000000000000040 R15: 0000000000000010 FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feeb9ff20c0 CR3: 0000000038f62000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: f3 0f 1e fa endbr64 7: 41 56 push %r14 9: 53 push %rbx a: 49 89 f6 mov %rsi,%r14 d: 48 89 fb mov %rdi,%rbx 10: e8 6e 5c c0 fa call 0xfac05c83 15: 49 83 c6 40 add $0x40,%r14 19: 4c 89 f0 mov %r14,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 cb 74 26 fb call 0xfb267503 38: 4d 8b 1e mov (%r14),%r11 3b: 48 89 df mov %rbx,%rdi 3e: 2e cs 3f: e8 .byte 0xe8 Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=105044d6580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=12442602580000 ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-13 2:42 ` syzbot @ 2026-03-13 16:07 ` Alan Stern 2026-03-13 16:32 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-13 16:07 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Thu, Mar 12, 2026 at 07:42:03PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > raw-gadget.1 gadget.0: Dummy disconnect 0 reset 16, ints_enabled 1 > raw-gadget.1 gadget.0: Inc usage: 1 X > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI I believe I have found the problem. The code in question in dummy_hcd.c does this: dev_info(&dum->gadget.dev, "Dummy disconnect %d reset %d, ints_enabled %d\n", disconnect, reset, dum->ints_enabled); /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { stop_activity(dum); ++dum->callback_usage; dev_info(&dum->gadget.dev, "Inc usage: %d X\n", dum->callback_usage); spin_unlock(&dum->lock); The issue is that dum->callback_usage needs to be incremented after the dum->ints_enabled check and before the dum->lock spinlock is released, but stop_activity() drops the spinlock temporarily while giving back cancelled requests. Let's interchange the increment and the stop_activity() call. That's the only change here from the prior test patch. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -460,21 +460,27 @@ static void set_link_state(struct dummy_ unsigned int reset = USB_PORT_STAT_RESET & (~dum_hcd->old_status) & dum_hcd->port_status; + dev_info(&dum->gadget.dev, "Dummy disconnect %d reset %d, ints_enabled %d\n", disconnect, reset, dum->ints_enabled); + /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { - stop_activity(dum); ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d X\n", dum->callback_usage); + stop_activity(dum); spin_unlock(&dum->lock); + udelay(1000); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); else dum->driver->disconnect(&dum->gadget); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d X\n", dum->callback_usage); } } else if (dum_hcd->active != dum_hcd->old_active && dum->ints_enabled) { ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d Y\n", dum->callback_usage); spin_unlock(&dum->lock); if (dum_hcd->old_active && dum->driver->suspend) dum->driver->suspend(&dum->gadget); @@ -482,6 +488,7 @@ static void set_link_state(struct dummy_ dum->driver->resume(&dum->gadget); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d Y\n", dum->callback_usage); } dum_hcd->old_status = dum_hcd->port_status; @@ -908,21 +915,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +937,27 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + dev_info(&_gadget->dev, "Dummy ints_enabled <- %d A\n", dum->ints_enabled); + if (!enable) { + dev_info(&dum->gadget.dev, "Wait usage %d\n", dum->callback_usage); + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + if (dum->ints_enabled) + dev_info(&_gadget->dev, "Dummy ints_enabled = %d !\n", dum->ints_enabled); + } spin_unlock_irq(&dum->lock); } @@ -1020,6 +1033,8 @@ static int dummy_udc_start(struct usb_ga spin_lock_irq(&dum->lock); dum->devstatus = 0; dum->driver = driver; + dev_info(&dum->gadget.dev, "Start on bus %d\n", + dummy_hcd_to_hcd(dum_hcd)->self.busnum); spin_unlock_irq(&dum->lock); return 0; @@ -1032,6 +1047,7 @@ static int dummy_udc_stop(struct usb_gad spin_lock_irq(&dum->lock); dum->ints_enabled = 0; + dev_info(&g->dev, "Dummy ints_enabled <- %d B\n", dum->ints_enabled); stop_activity(dum); dum->driver = NULL; spin_unlock_irq(&dum->lock); @@ -1923,11 +1939,13 @@ restart: */ if (value > 0) { ++dum->callback_usage; + dev_info(&dum->gadget.dev, "Inc usage: %d Z\n", dum->callback_usage); spin_unlock(&dum->lock); value = dum->driver->setup(&dum->gadget, &setup); spin_lock(&dum->lock); --dum->callback_usage; + dev_info(&dum->gadget.dev, "Dec usage: %d Z\n", dum->callback_usage); if (value >= 0) { /* no delays (max 64KB data stage) */ ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-13 16:07 ` Alan Stern @ 2026-03-13 16:32 ` syzbot 2026-03-13 19:47 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-13 16:32 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=11535cd6580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=11de1def980000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-13 16:32 ` syzbot @ 2026-03-13 19:47 ` Alan Stern 2026-03-13 21:28 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-13 19:47 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Fri, Mar 13, 2026 at 09:32:02AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > > Tested on: > > commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > console output: https://syzkaller.appspot.com/x/log.txt?x=11535cd6580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 > dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > patch: https://syzkaller.appspot.com/x/patch.diff?x=11de1def980000 > > Note: testing is done by a robot and is best-effort only. Great! Here's the final form of the fix, just to make sure I haven't messed anything up. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -462,8 +462,13 @@ static void set_link_state(struct dummy_ /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { - stop_activity(dum); ++dum->callback_usage; + /* + * stop_activity() can drop dum->lock, so it must + * must not come between the dum->ints_enabled test + * and the ++dum->callback_usage. + */ + stop_activity(dum); spin_unlock(&dum->lock); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); @@ -908,21 +913,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +935,20 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + if (!enable) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This has to happen after emulated interrupts are disabled + * (dum->ints_enabled is clear) and before the unbind callback, + * just like the call to synchronize_irq() in + * gadget_unbind_driver(). + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + } spin_unlock_irq(&dum->lock); } ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-13 19:47 ` Alan Stern @ 2026-03-13 21:28 ` syzbot 2026-03-14 16:42 ` Alan Stern 0 siblings, 1 reply; 26+ messages in thread From: syzbot @ 2026-03-13 21:28 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=14ab954a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=113b1602580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-13 21:28 ` syzbot @ 2026-03-14 16:42 ` Alan Stern 2026-03-14 17:07 ` syzbot 0 siblings, 1 reply; 26+ messages in thread From: Alan Stern @ 2026-03-14 16:42 UTC (permalink / raw) To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs On Fri, Mar 13, 2026 at 02:28:02PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com > > Tested on: > > commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > console output: https://syzkaller.appspot.com/x/log.txt?x=14ab954a580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 > dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > patch: https://syzkaller.appspot.com/x/patch.diff?x=113b1602580000 > > Note: testing is done by a robot and is best-effort only. Just out of curiosity, let's see if this test crashes with only the second change (moving stop_activity()) and not the first (moving the synchronize_irq() emulation). Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -462,8 +462,13 @@ static void set_link_state(struct dummy_ /* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { - stop_activity(dum); ++dum->callback_usage; + /* + * stop_activity() can drop dum->lock, so it must + * must not come between the dum->ints_enabled test + * and the ++dum->callback_usage. + */ + stop_activity(dum); spin_unlock(&dum->lock); if (reset) usb_gadget_udc_reset(&dum->gadget, dum->driver); ^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) 2026-03-14 16:42 ` Alan Stern @ 2026-03-14 17:07 ` syzbot 0 siblings, 0 replies; 26+ messages in thread From: syzbot @ 2026-03-14 17:07 UTC (permalink / raw) To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Tested on: commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=141f18ba580000 kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692 dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=169b5d52580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 26+ messages in thread
end of thread, other threads:[~2026-03-14 17:07 UTC | newest] Thread overview: 26+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-10-25 7:30 [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) syzbot 2026-03-07 10:52 ` syzbot 2026-03-08 15:36 ` Alan Stern 2026-03-08 16:01 ` syzbot 2026-03-09 14:25 ` Alan Stern 2026-03-09 14:55 ` syzbot 2026-03-09 15:24 ` Alan Stern 2026-03-09 15:43 ` syzbot 2026-03-10 15:50 ` Alan Stern 2026-03-10 16:09 ` syzbot 2026-03-10 19:02 ` Alan Stern 2026-03-10 19:32 ` syzbot 2026-03-11 1:50 ` Alan Stern 2026-03-11 3:16 ` syzbot 2026-03-11 18:44 ` Alan Stern 2026-03-11 19:25 ` syzbot 2026-03-12 17:56 ` Alan Stern 2026-03-12 18:29 ` syzbot 2026-03-13 2:05 ` Alan Stern 2026-03-13 2:42 ` syzbot 2026-03-13 16:07 ` Alan Stern 2026-03-13 16:32 ` syzbot 2026-03-13 19:47 ` Alan Stern 2026-03-13 21:28 ` syzbot 2026-03-14 16:42 ` Alan Stern 2026-03-14 17:07 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox