* [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
@ 2025-10-25 7:30 syzbot
2026-03-07 10:52 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2025-10-25 7:30 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 566771afc7a8 Merge tag 'v6.18-rc2-smb-server-fixes' of git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13956e7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8345ce4ce316ca28
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/52417ef1f782/disk-566771af.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/66730a263bf1/vmlinux-566771af.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1fe0762efb1f/bzImage-566771af.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
usb 1-1: new full-speed USB device number 6 using dummy_hcd
usb 1-1: unable to read config index 0 descriptor/all
usb 1-1: can't read configurations, error -110
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 5869 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1195
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 3e 6b fb fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 bb 22 5d fb 4d 8b 1e 48 89 df 2e 2e
RSP: 0018:ffffc900051b7260 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888143b54c40 RCX: dffffc0000000000
RDX: ffffc9001a01b000 RSI: 0000000000002b35 RDI: 0000000000002b36
RBP: ffff8880305aa66c R08: ffffffff8ed62877 R09: 1ffffffff1dac50e
R10: dffffc0000000000 R11: fffffbfff1dac50f R12: ffff888143b54c40
R13: 1ffff11004eceaa1 R14: 0000000000000040 R15: 1ffff1102876a987
FS: 0000000000000000(0000) GS:ffff888126efc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce4efb4f98 CR3: 000000004a02e000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
dummy_hub_control+0xcc0/0x1760 drivers/usb/gadget/udc/dummy_hcd.c:2327
rh_call_control drivers/usb/core/hcd.c:656 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:821 [inline]
usb_hcd_submit_urb+0xde9/0x1a80 drivers/usb/core/hcd.c:1542
usb_start_wait_urb+0x114/0x4c0 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:470 [inline]
hub_port_reset+0x390/0x1740 drivers/usb/core/hub.c:3082
hub_port_init+0x2b0/0x2800 drivers/usb/core/hub.c:4938
hub_port_connect drivers/usb/core/hub.c:5495 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
port_event drivers/usb/core/hub.c:5870 [inline]
hub_event+0x2532/0x4a20 drivers/usb/core/hub.c:5952
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1195
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 3e 6b fb fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 bb 22 5d fb 4d 8b 1e 48 89 df 2e 2e
RSP: 0018:ffffc900051b7260 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888143b54c40 RCX: dffffc0000000000
RDX: ffffc9001a01b000 RSI: 0000000000002b35 RDI: 0000000000002b36
RBP: ffff8880305aa66c R08: ffffffff8ed62877 R09: 1ffffffff1dac50e
R10: dffffc0000000000 R11: fffffbfff1dac50f R12: ffff888143b54c40
R13: 1ffff11004eceaa1 R14: 0000000000000040 R15: 1ffff1102876a987
FS: 0000000000000000(0000) GS:ffff888126efc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce4efb4f98 CR3: 000000004a02e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 41 56 push %r14
9: 53 push %rbx
a: 49 89 f6 mov %rsi,%r14
d: 48 89 fb mov %rdi,%rbx
10: e8 3e 6b fb fa call 0xfafb6b53
15: 49 83 c6 40 add $0x40,%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 bb 22 5d fb call 0xfb5d22f3
38: 4d 8b 1e mov (%r14),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2025-10-25 7:30 [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) syzbot
@ 2026-03-07 10:52 ` syzbot
2026-03-08 15:36 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-07 10:52 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 651690480a96 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11ec0806580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b2db5a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fed8d6580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e393fccfaa3/disk-65169048.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2930e8c98c89/vmlinux-65169048.xz
kernel image: https://storage.googleapis.com/syzbot-assets/34e9e7d322b1/bzImage-65169048.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
usb 1-1: reset high-speed USB device number 2 using dummy_hcd
usb 1-1: device descriptor read/8, error -32
Oops: general protection fault, probably [ 120.351719][ T6052] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 0 UID: 0 PID: 6052 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0018:ffffc9000415e4c8 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029facc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880341b2b6c R08: ffffffff8f6a4eb7 R09: 1ffffffff1ed49d6
R10: dffffc0000000000 R11: fffffbfff1ed49d7 R12: ffff888029facc40
R13: 1ffff110053f38a1 R14: 0000000000000040 R15: 1ffff110053f5987
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff7c4020c0 CR3: 00000000324ce000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
usb_reset_and_verify_device+0x1661/0x1af0 drivers/usb/core/hub.c:6215
usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410
sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221
gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0018:ffffc9000415e4c8 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029facc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880341b2b6c R08: ffffffff8f6a4eb7 R09: 1ffffffff1ed49d6
R10: dffffc0000000000 R11: fffffbfff1ed49d7 R12: ffff888029facc40
R13: 1ffff110053f38a1 R14: 0000000000000040 R15: 1ffff110053f5987
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007eff7c4020c0 CR3: 00000000379ee000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 41 56 push %r14
9: 53 push %rbx
a: 49 89 f6 mov %rsi,%r14
d: 48 89 fb mov %rdi,%rbx
10: e8 6e 5c c0 fa call 0xfac05c83
15: 49 83 c6 40 add $0x40,%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 cb 74 26 fb call 0xfb267503
38: 4d 8b 1e mov (%r14),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: e8 .byte 0xe8
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-07 10:52 ` syzbot
@ 2026-03-08 15:36 ` Alan Stern
2026-03-08 16:01 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-08 15:36 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Sat, Mar 07, 2026 at 02:52:24AM -0800, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 651690480a96 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11ec0806580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
> dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b2db5a580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fed8d6580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/0e393fccfaa3/disk-65169048.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/2930e8c98c89/vmlinux-65169048.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/34e9e7d322b1/bzImage-65169048.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
>
> usb 1-1: reset high-speed USB device number 2 using dummy_hcd
> usb 1-1: device descriptor read/8, error -32
> Oops: general protection fault, probably [ 120.351719][ T6052] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
> CPU: 0 UID: 0 PID: 6052 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
> Call Trace:
> <TASK>
> set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
It's a little hard to tell exactly what is wrong here, but it looks like
the driver argument to usb_gadget_udc_reset() may be NULL. Let's see if
that's really the problem.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -465,7 +465,9 @@ static void set_link_state(struct dummy_
stop_activity(dum);
++dum->callback_usage;
spin_unlock(&dum->lock);
- if (reset)
+ if (!dum->driver)
+ dev_err(dummy_dev(dum_hcd), "**** NO DRIVER!\n");
+ else if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
dum->driver->disconnect(&dum->gadget);
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-08 15:36 ` Alan Stern
@ 2026-03-08 16:01 ` syzbot
2026-03-09 14:25 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-08 16:01 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=133f3fe6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=178dc8ba580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-08 16:01 ` syzbot
@ 2026-03-09 14:25 ` Alan Stern
2026-03-09 14:55 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-09 14:25 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Sun, Mar 08, 2026 at 09:01:01AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
> Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=133f3fe6580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
> dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> patch: https://syzkaller.appspot.com/x/patch.diff?x=178dc8ba580000
>
> Note: testing is done by a robot and is best-effort only.
That's not very helpful. Let's try a slightly different approach.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/core.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/core.c
+++ usb-devel/drivers/usb/gadget/udc/core.c
@@ -1192,7 +1192,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
void usb_gadget_udc_reset(struct usb_gadget *gadget,
struct usb_gadget_driver *driver)
{
+ dev_info(&gadget->dev, "Reset #1, driver %p\n", driver);
driver->reset(gadget);
+ dev_info(&gadget->dev, "Reset #2\n");
usb_gadget_set_state(gadget, USB_STATE_DEFAULT);
}
EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-09 14:25 ` Alan Stern
@ 2026-03-09 14:55 ` syzbot
2026-03-09 15:24 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-09 14:55 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
raw-gadget.0 gadget.1: Reset #2
usb 2-1: device descriptor read/64, error -32
gadget gadget.1: Reset #1, driver 0000000000000000
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 0 UID: 0 PID: 5814 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x42/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 01 00 00 4c 89 f7 48 c7 c6 a0 d2 fb 8b 4c 89 fa e8 23 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 f0 da fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90004be64c0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029e78c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880348cba6c R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff5200097cc01 R12: ffff888029e78c40
R13: 1ffff110053ee2a1 R14: ffff888029e78d58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f16fca6890f CR3: 000000003df2e000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
usb_reset_and_verify_device+0x105d/0x1af0 drivers/usb/core/hub.c:6215
usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410
sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221
gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x42/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 01 00 00 4c 89 f7 48 c7 c6 a0 d2 fb 8b 4c 89 fa e8 23 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 f0 da fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90004be64c0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029e78c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880348cba6c R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff5200097cc01 R12: ffff888029e78c40
R13: 1ffff110053ee2a1 R14: ffff888029e78d58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f16fca6890f CR3: 000000003df2e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 01 00 add %eax,(%rax)
2: 00 4c 89 f7 add %cl,-0x9(%rcx,%rcx,4)
6: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi
d: 4c 89 fa mov %r15,%rdx
10: e8 23 5b fd ff call 0xfffd5b38
15: 49 83 c7 40 add $0x40,%r15
19: 4c 89 f8 mov %r15,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 f0 da fb 00 call 0xfbdb28
38: 4d 8b 1f mov (%r15),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=144e6016580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=131c375a580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-09 14:55 ` syzbot
@ 2026-03-09 15:24 ` Alan Stern
2026-03-09 15:43 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-09 15:24 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Mon, Mar 09, 2026 at 07:55:02AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
>
> raw-gadget.0 gadget.1: Reset #2
> usb 2-1: device descriptor read/64, error -32
> gadget gadget.1: Reset #1, driver 0000000000000000
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
> CPU: 0 UID: 0 PID: 5814 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:usb_gadget_udc_reset+0x42/0x80 drivers/usb/gadget/udc/core.c:1201
That's a little weird. All the new debugging messages in the console
log are of the form "raw-gadget.0 gadget.1 Reset ...", but the last,
failing one says "gadget gadget.1 Reset ...". I wonder what that
indicates.
Maybe this next test will help find out.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/core.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/core.c
+++ usb-devel/drivers/usb/gadget/udc/core.c
@@ -1192,7 +1192,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
void usb_gadget_udc_reset(struct usb_gadget *gadget,
struct usb_gadget_driver *driver)
{
+ dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver);
driver->reset(gadget);
+ dev_info(&gadget->dev, "Reset #2\n");
usb_gadget_set_state(gadget, USB_STATE_DEFAULT);
}
EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-09 15:24 ` Alan Stern
@ 2026-03-09 15:43 ` syzbot
2026-03-10 15:50 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-09 15:43 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
usb 2-1: reset high-speed USB device number 8 using dummy_hcd
usb 2-1: device descriptor read/8, error -32
gadget gadget.1: Reset #1, gadget ffff888029d60c40 driver 0000000000000000
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 6630 Comm: kworker/1:8 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc900049464c0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029d60c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888025502d6c R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029d60c40
R13: 1ffff110053d16a1 R14: ffff888029d60d58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c90080a138 CR3: 00000000114f4000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
usb_reset_and_verify_device+0x1661/0x1af0 drivers/usb/core/hub.c:6215
usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410
sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221
gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc900049464c0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029d60c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888025502d6c R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029d60c40
R13: 1ffff110053d16a1 R14: ffff888029d60d58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c90080a138 CR3: 00000000114f4000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 4c 89 f7 mov %r14,%rdi
3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi
a: 48 89 da mov %rbx,%rdx
d: 4c 89 f9 mov %r15,%rcx
10: e8 20 5b fd ff call 0xfffd5b35
15: 49 83 c7 40 add $0x40,%r15
19: 4c 89 f8 mov %r15,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 ed da fb 00 call 0xfbdb25
38: 4d 8b 1f mov (%r15),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10828d52580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1019a3aa580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-09 15:43 ` syzbot
@ 2026-03-10 15:50 ` Alan Stern
2026-03-10 16:09 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-10 15:50 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Mon, Mar 09, 2026 at 08:43:01AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
>
> usb 2-1: reset high-speed USB device number 8 using dummy_hcd
> usb 2-1: device descriptor read/8, error -32
> gadget gadget.1: Reset #1, gadget ffff888029d60c40 driver 0000000000000000
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
That's helpful. And it turns out the reason that "raw-gadget.0" changes
to "gadget" right before the crash is because the raw-gadget driver has
been unbound, and when no driver is bound the dev_xxxx() calls use the
bus-type name instead.
An audit shows that the untimely driver unbinding occurs because of an
error in synchronization. The code in dummy-hcd which emulates
synchronize_irq() should run after the emulated interrupts are disabled,
not before. That code needs to be moved from dummy_pullup() to
dummy_udc_async_callbacks().
Let's see if this fixes the bug.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/core.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/core.c
+++ usb-devel/drivers/usb/gadget/udc/core.c
@@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
void usb_gadget_udc_reset(struct usb_gadget *gadget,
struct usb_gadget_driver *driver)
{
+ dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver);
driver->reset(gadget);
+ dev_info(&gadget->dev, "Reset #2\n");
usb_gadget_set_state(gadget, USB_STATE_DEFAULT);
}
EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -908,21 +908,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +930,23 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ if (!enable) {
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ }
spin_unlock_irq(&dum->lock);
}
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-10 15:50 ` Alan Stern
@ 2026-03-10 16:09 ` syzbot
2026-03-10 19:02 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-10 16:09 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
gadget gadget.4: Reset #1, gadget ffff8880294bcc40 driver 0000000000000000
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 0 UID: 0 PID: 5912 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90004c064c0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff8880294bcc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880206be26c R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000980c01 R12: ffff8880294bcc40
R13: 1ffff110052caca1 R14: ffff8880294bcd58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563d3bdf1be0 CR3: 000000002872c000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x80b/0x1220 drivers/usb/gadget/udc/dummy_hcd.c:469
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
usb_reset_and_verify_device+0x105d/0x1af0 drivers/usb/core/hub.c:6215
usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410
sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221
gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed da fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90004c064c0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff8880294bcc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880206be26c R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000980c01 R12: ffff8880294bcc40
R13: 1ffff110052caca1 R14: ffff8880294bcd58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563d3bdf1be0 CR3: 000000002872c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 4c 89 f7 mov %r14,%rdi
3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi
a: 48 89 da mov %rbx,%rdx
d: 4c 89 f9 mov %r15,%rcx
10: e8 20 5b fd ff call 0xfffd5b35
15: 49 83 c7 40 add $0x40,%r15
19: 4c 89 f8 mov %r15,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 ed da fb 00 call 0xfbdb25
38: 4d 8b 1f mov (%r15),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1023f8d6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1793d016580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-10 16:09 ` syzbot
@ 2026-03-10 19:02 ` Alan Stern
2026-03-10 19:32 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-10 19:02 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Tue, Mar 10, 2026 at 09:09:02AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
>
> gadget gadget.4: Reset #1, gadget ffff8880294bcc40 driver 0000000000000000
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
That's a little surprising. Here's a test with more debugging
printouts, along with a delay to make a race more likely to occur.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/core.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/core.c
+++ usb-devel/drivers/usb/gadget/udc/core.c
@@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
void usb_gadget_udc_reset(struct usb_gadget *gadget,
struct usb_gadget_driver *driver)
{
+ dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver);
driver->reset(gadget);
+ dev_info(&gadget->dev, "Reset #2\n");
usb_gadget_set_state(gadget, USB_STATE_DEFAULT);
}
EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -464,7 +464,9 @@ static void set_link_state(struct dummy_
if (dum->ints_enabled && (disconnect || reset)) {
stop_activity(dum);
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Reset usage %d\n", dum->callback_usage);
spin_unlock(&dum->lock);
+ udelay(1000);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
@@ -908,21 +910,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +932,25 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ if (!enable) {
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ dev_info(&_gadget->dev, "Disable usage %d\n", dum->callback_usage);
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ dev_info(&_gadget->dev, "Disable done\n");
+ }
spin_unlock_irq(&dum->lock);
}
@@ -1034,6 +1040,7 @@ static int dummy_udc_stop(struct usb_gad
dum->ints_enabled = 0;
stop_activity(dum);
dum->driver = NULL;
+ dev_info(&g->dev, "Dummy stop\n");
spin_unlock_irq(&dum->lock);
return 0;
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-10 19:02 ` Alan Stern
@ 2026-03-10 19:32 ` syzbot
2026-03-11 1:50 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-10 19:32 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
gadget gadget.2: Reset usage 1
gadget gadget.2: Reset #1, gadget ffff888029b6cc40 driver 0000000000000000
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 6660 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90003de64c8 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029b6cc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029b6cc40
R13: ffff888029cac50b R14: ffff888029b6cd58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc51d195fb3 CR3: 000000005ff3a000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0xad6/0xff0 drivers/usb/gadget/udc/dummy_hcd.c:471
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
usb_reset_and_verify_device+0x105d/0x1af0 drivers/usb/core/hub.c:6215
usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410
sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221
gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90003de64c8 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029b6cc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888029b6cc40
R13: ffff888029cac50b R14: ffff888029b6cd58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc51d195fb3 CR3: 00000000364fe000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 4c 89 f7 mov %r14,%rdi
3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi
a: 48 89 da mov %rbx,%rdx
d: 4c 89 f9 mov %r15,%rcx
10: e8 20 5b fd ff call 0xfffd5b35
15: 49 83 c7 40 add $0x40,%r15
19: 4c 89 f8 mov %r15,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 ed ea fb 00 call 0xfbeb25
38: 4d 8b 1f mov (%r15),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1490d3aa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1016975a580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-10 19:32 ` syzbot
@ 2026-03-11 1:50 ` Alan Stern
2026-03-11 3:16 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-11 1:50 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Tue, Mar 10, 2026 at 12:32:03PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
I'm getting the impression from the console log that this isn't a race
between unbind and reset after all, but between bind and reset. The log
contains these two lines:
[ 250.845916][ T7233] raw-gadget.4 gadget.2: Dummy stop
[ 250.847972][ T6660] gadget gadget.2: Reset usage 1
The dummy_udc_stop() routine sets ints_enabled to 0, but the "Reset
usage 1" line is printed only if ints_enabled != 0. The only way for
ints_enabled to be set to a nonzero value is through a call to
usb_gadget_enable_async_callbacks(), which happens only in
gadget_bind_driver().
So let's add more debugging messages to track binding as well as
unbinding events.
Alan Stern
#syz test: upstream 651690480a96
2 files changed, 26 insertions(+), 15 deletions(-)
Index: usb-devel/drivers/usb/gadget/udc/core.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/core.c
+++ usb-devel/drivers/usb/gadget/udc/core.c
@@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
void usb_gadget_udc_reset(struct usb_gadget *gadget,
struct usb_gadget_driver *driver)
{
+ dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver);
driver->reset(gadget);
+ dev_info(&gadget->dev, "Reset #2\n");
usb_gadget_set_state(gadget, USB_STATE_DEFAULT);
}
EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -464,7 +464,9 @@ static void set_link_state(struct dummy_
if (dum->ints_enabled && (disconnect || reset)) {
stop_activity(dum);
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Reset usage %d\n", dum->callback_usage);
spin_unlock(&dum->lock);
+ udelay(1000);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
@@ -906,23 +908,9 @@ static int dummy_pullup(struct usb_gadge
dum_hcd = gadget_to_dummy_hcd(_gadget);
spin_lock_irqsave(&dum->lock, flags);
+ dev_info(&_gadget->dev, "Dummy pullup %d\n", value);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +933,25 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ dev_info(&_gadget->dev, "Dummy ints_enabled %d\n", enable);
+ if (!enable) {
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ dev_info(&_gadget->dev, "Disable done\n");
+ }
spin_unlock_irq(&dum->lock);
}
@@ -1020,6 +1027,7 @@ static int dummy_udc_start(struct usb_ga
spin_lock_irq(&dum->lock);
dum->devstatus = 0;
dum->driver = driver;
+ dev_info(&g->dev, "Dummy start\n");
spin_unlock_irq(&dum->lock);
return 0;
@@ -1034,6 +1042,7 @@ static int dummy_udc_stop(struct usb_gad
dum->ints_enabled = 0;
stop_activity(dum);
dum->driver = NULL;
+ dev_info(&g->dev, "Dummy stop\n");
spin_unlock_irq(&dum->lock);
return 0;
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-11 1:50 ` Alan Stern
@ 2026-03-11 3:16 ` syzbot
2026-03-11 18:44 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-11 3:16 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
gadget gadget.0: Reset usage 1
gadget gadget.0: Reset #1, gadget ffff888027440c40 driver 0000000000000000
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 6315 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90003d77308 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888027440c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888027440c40
R13: ffff888029fe250b R14: ffff888027440d58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f168c5e3286 CR3: 0000000036838000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0xad6/0xff0 drivers/usb/gadget/udc/dummy_hcd.c:471
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
hub_port_connect drivers/usb/core/hub.c:5496 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x45/0x80 drivers/usb/gadget/udc/core.c:1201
Code: 4c 89 f7 48 c7 c6 a0 d2 fb 8b 48 89 da 4c 89 f9 e8 20 5b fd ff 49 83 c7 40 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ed ea fb 00 4d 8b 1f 48 89 df 2e 2e
RSP: 0018:ffffc90003d77308 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888027440c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1017124923 R12: ffff888027440c40
R13: ffff888029fe250b R14: ffff888027440d58 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f168c5e3286 CR3: 0000000036838000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 4c 89 f7 mov %r14,%rdi
3: 48 c7 c6 a0 d2 fb 8b mov $0xffffffff8bfbd2a0,%rsi
a: 48 89 da mov %rbx,%rdx
d: 4c 89 f9 mov %r15,%rcx
10: e8 20 5b fd ff call 0xfffd5b35
15: 49 83 c7 40 add $0x40,%r15
19: 4c 89 f8 mov %r15,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ff mov %r15,%rdi
33: e8 ed ea fb 00 call 0xfbeb25
38: 4d 8b 1f mov (%r15),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: 2e cs
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15cd975a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=16e44d52580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-11 3:16 ` syzbot
@ 2026-03-11 18:44 ` Alan Stern
2026-03-11 19:25 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-11 18:44 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Tue, Mar 10, 2026 at 08:16:03PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
>
> gadget gadget.0: Reset usage 1
> gadget gadget.0: Reset #1, gadget ffff888027440c40 driver 0000000000000000
It looks like dum->ints_enabled is getting set to a nonzero value when
it shouldn't be. Let's track all the places where it gets changed and
the place where it gets tested.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -460,11 +460,15 @@ static void set_link_state(struct dummy_
unsigned int reset = USB_PORT_STAT_RESET &
(~dum_hcd->old_status) & dum_hcd->port_status;
+ if (reset)
+ dev_info(&dum->gadget.dev, "Dummy %p reset, ints_enabled %d\n", dum, dum->ints_enabled);
+
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
stop_activity(dum);
++dum->callback_usage;
spin_unlock(&dum->lock);
+ udelay(1000);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
@@ -908,21 +912,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +934,26 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ dev_info(&_gadget->dev, "Dummy %p ints_enabled <- %d A\n", dum, dum->ints_enabled);
+ if (!enable) {
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ if (dum->ints_enabled)
+ dev_info(&_gadget->dev, "Dummy %p ints_enabled = %d !\n", dum, dum->ints_enabled);
+ }
spin_unlock_irq(&dum->lock);
}
@@ -1032,6 +1041,7 @@ static int dummy_udc_stop(struct usb_gad
spin_lock_irq(&dum->lock);
dum->ints_enabled = 0;
+ dev_info(&g->dev, "Dummy %p ints_enabled <- %d B\n", dum, dum->ints_enabled);
stop_activity(dum);
dum->driver = NULL;
spin_unlock_irq(&dum->lock);
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-11 18:44 ` Alan Stern
@ 2026-03-11 19:25 ` syzbot
2026-03-12 17:56 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-11 19:25 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0000:ffffc90004e97308 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888027e5cc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888027e5c000 R08: ffffffff8f6a4fb7 R09: 1ffffffff1ed49f6
R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: ffff888027e5cc3c
R13: ffff888027e5cbc0 R14: 0000000000000040 R15: 1ffff11004fcb987
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558766fe1070 CR3: 000000003a8c8000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0x81b/0x1340 drivers/usb/gadget/udc/dummy_hcd.c:473
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
hub_port_connect drivers/usb/core/hub.c:5496 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0000:ffffc90004e97308 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888027e5cc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888027e5c000 R08: ffffffff8f6a4fb7 R09: 1ffffffff1ed49f6
R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: ffff888027e5cc3c
R13: ffff888027e5cbc0 R14: 0000000000000040 R15: 1ffff11004fcb987
FS: 0000000000000000(0000) GS:ffff88812633d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558766fe1070 CR3: 0000000038c0e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 41 56 push %r14
9: 53 push %rbx
a: 49 89 f6 mov %rsi,%r14
d: 48 89 fb mov %rdi,%rbx
10: e8 6e 5c c0 fa call 0xfac05c83
15: 49 83 c6 40 add $0x40,%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 cb 74 26 fb call 0xfb267503
38: 4d 8b 1e mov (%r14),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: e8 .byte 0xe8
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=143d04d6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1686575a580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-11 19:25 ` syzbot
@ 2026-03-12 17:56 ` Alan Stern
2026-03-12 18:29 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-12 17:56 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Wed, Mar 11, 2026 at 12:25:04PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
The console log contains some very strange looking stuff. I need more
debugging info.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -460,21 +460,28 @@ static void set_link_state(struct dummy_
unsigned int reset = USB_PORT_STAT_RESET &
(~dum_hcd->old_status) & dum_hcd->port_status;
+ if (reset)
+ dev_info(&dum->gadget.dev, "Dummy %p reset, ints_enabled %d\n", dum, dum->ints_enabled);
+
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
stop_activity(dum);
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d A\n", dum->callback_usage);
spin_unlock(&dum->lock);
+ udelay(1000);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
dum->driver->disconnect(&dum->gadget);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d A\n", dum->callback_usage);
}
} else if (dum_hcd->active != dum_hcd->old_active &&
dum->ints_enabled) {
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d B\n", dum->callback_usage);
spin_unlock(&dum->lock);
if (dum_hcd->old_active && dum->driver->suspend)
dum->driver->suspend(&dum->gadget);
@@ -482,6 +489,7 @@ static void set_link_state(struct dummy_
dum->driver->resume(&dum->gadget);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d B\n", dum->callback_usage);
}
dum_hcd->old_status = dum_hcd->port_status;
@@ -908,21 +916,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +938,27 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ dev_info(&_gadget->dev, "Dummy %p ints_enabled <- %d A\n", dum, dum->ints_enabled);
+ if (!enable) {
+ dev_info(&dum->gadget.dev, "Wait usage %d\n", dum->callback_usage);
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ if (dum->ints_enabled)
+ dev_info(&_gadget->dev, "Dummy %p ints_enabled = %d !\n", dum, dum->ints_enabled);
+ }
spin_unlock_irq(&dum->lock);
}
@@ -1020,6 +1034,8 @@ static int dummy_udc_start(struct usb_ga
spin_lock_irq(&dum->lock);
dum->devstatus = 0;
dum->driver = driver;
+ dev_info(&dum->gadget.dev, "Start on bus %d\n",
+ dummy_hcd_to_hcd(dum_hcd)->self.busnum);
spin_unlock_irq(&dum->lock);
return 0;
@@ -1032,6 +1048,7 @@ static int dummy_udc_stop(struct usb_gad
spin_lock_irq(&dum->lock);
dum->ints_enabled = 0;
+ dev_info(&g->dev, "Dummy %p ints_enabled <- %d B\n", dum, dum->ints_enabled);
stop_activity(dum);
dum->driver = NULL;
spin_unlock_irq(&dum->lock);
@@ -1923,11 +1940,13 @@ restart:
*/
if (value > 0) {
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d C\n", dum->callback_usage);
spin_unlock(&dum->lock);
value = dum->driver->setup(&dum->gadget,
&setup);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d C\n", dum->callback_usage);
if (value >= 0) {
/* no delays (max 64KB data stage) */
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-12 17:56 ` Alan Stern
@ 2026-03-12 18:29 ` syzbot
2026-03-13 2:05 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-12 18:29 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
raw-gadget.1 gadget.3: Inc usage: 1 A
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 5926 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0018:ffffc90004197310 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029ce8c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36
R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: 1ffff1100539d187
R13: ffff8880296b450b R14: 0000000000000040 R15: ffff888029ce8c40
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f21940fcff8 CR3: 0000000038eda000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0xa17/0x10c0 drivers/usb/gadget/udc/dummy_hcd.c:474
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0x299/0x28c0 drivers/usb/core/hub.c:4939
hub_port_connect drivers/usb/core/hub.c:5496 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x25d3/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0018:ffffc90004197310 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff888029ce8c40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36
R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: 1ffff1100539d187
R13: ffff8880296b450b R14: 0000000000000040 R15: ffff888029ce8c40
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f21940fcff8 CR3: 00000000348ae000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 41 56 push %r14
9: 53 push %rbx
a: 49 89 f6 mov %rsi,%r14
d: 48 89 fb mov %rdi,%rbx
10: e8 6e 5c c0 fa call 0xfac05c83
15: 49 83 c6 40 add $0x40,%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 cb 74 26 fb call 0xfb267503
38: 4d 8b 1e mov (%r14),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: e8 .byte 0xe8
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=153e775a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=162dd75a580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-12 18:29 ` syzbot
@ 2026-03-13 2:05 ` Alan Stern
2026-03-13 2:42 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-13 2:05 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Thu, Mar 12, 2026 at 11:29:03AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
>
> raw-gadget.1 gadget.3: Inc usage: 1 A
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
Apparently one of the events I thought was a reset is actually a
disconnect? Let's get even more info.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -460,21 +460,27 @@ static void set_link_state(struct dummy_
unsigned int reset = USB_PORT_STAT_RESET &
(~dum_hcd->old_status) & dum_hcd->port_status;
+ dev_info(&dum->gadget.dev, "Dummy disconnect %d reset %d, ints_enabled %d\n", disconnect, reset, dum->ints_enabled);
+
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
stop_activity(dum);
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d X\n", dum->callback_usage);
spin_unlock(&dum->lock);
+ udelay(1000);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
dum->driver->disconnect(&dum->gadget);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d X\n", dum->callback_usage);
}
} else if (dum_hcd->active != dum_hcd->old_active &&
dum->ints_enabled) {
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d Y\n", dum->callback_usage);
spin_unlock(&dum->lock);
if (dum_hcd->old_active && dum->driver->suspend)
dum->driver->suspend(&dum->gadget);
@@ -482,6 +488,7 @@ static void set_link_state(struct dummy_
dum->driver->resume(&dum->gadget);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d Y\n", dum->callback_usage);
}
dum_hcd->old_status = dum_hcd->port_status;
@@ -908,21 +915,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +937,27 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ dev_info(&_gadget->dev, "Dummy ints_enabled <- %d A\n", dum->ints_enabled);
+ if (!enable) {
+ dev_info(&dum->gadget.dev, "Wait usage %d\n", dum->callback_usage);
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ if (dum->ints_enabled)
+ dev_info(&_gadget->dev, "Dummy ints_enabled = %d !\n", dum->ints_enabled);
+ }
spin_unlock_irq(&dum->lock);
}
@@ -1020,6 +1033,8 @@ static int dummy_udc_start(struct usb_ga
spin_lock_irq(&dum->lock);
dum->devstatus = 0;
dum->driver = driver;
+ dev_info(&dum->gadget.dev, "Start on bus %d\n",
+ dummy_hcd_to_hcd(dum_hcd)->self.busnum);
spin_unlock_irq(&dum->lock);
return 0;
@@ -1032,6 +1047,7 @@ static int dummy_udc_stop(struct usb_gad
spin_lock_irq(&dum->lock);
dum->ints_enabled = 0;
+ dev_info(&g->dev, "Dummy ints_enabled <- %d B\n", dum->ints_enabled);
stop_activity(dum);
dum->driver = NULL;
spin_unlock_irq(&dum->lock);
@@ -1923,11 +1939,13 @@ restart:
*/
if (value > 0) {
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d Z\n", dum->callback_usage);
spin_unlock(&dum->lock);
value = dum->driver->setup(&dum->gadget,
&setup);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d Z\n", dum->callback_usage);
if (value >= 0) {
/* no delays (max 64KB data stage) */
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-13 2:05 ` Alan Stern
@ 2026-03-13 2:42 ` syzbot
2026-03-13 16:07 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-13 2:42 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in usb_gadget_udc_reset
raw-gadget.1 gadget.0: Dummy disconnect 0 reset 16, ints_enabled 1
raw-gadget.1 gadget.0: Inc usage: 1 X
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 1 UID: 0 PID: 6645 Comm: kworker/1:10 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0000:ffffc900045f64d0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff88802702cc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36
R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: dffffc0000000000
R13: ffff888029a7850b R14: 0000000000000040 R15: 0000000000000010
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feeb9ff20c0 CR3: 000000003a1fe000 CR4: 00000000003526f0
Call Trace:
<TASK>
set_link_state+0xb30/0x1080 drivers/usb/gadget/udc/dummy_hcd.c:473
dummy_hub_control+0xa09/0x1a00 drivers/usb/gadget/udc/dummy_hcd.c:-1
rh_call_control drivers/usb/core/hcd.c:652 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:817 [inline]
usb_hcd_submit_urb+0xdbe/0x1b50 drivers/usb/core/hcd.c:1538
usb_start_wait_urb+0x12b/0x510 drivers/usb/core/message.c:59
usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
set_port_feature drivers/usb/core/hub.c:466 [inline]
hub_port_reset+0x3c7/0x1820 drivers/usb/core/hub.c:3083
hub_port_init+0xf50/0x28c0 drivers/usb/core/hub.c:5056
usb_reset_and_verify_device+0x4ea/0x1af0 drivers/usb/core/hub.c:6215
usb_reset_device+0x551/0xb40 drivers/usb/core/hub.c:6410
sd_config+0x27f/0x15b0 drivers/media/usb/gspca/se401.c:221
gspca_dev_probe2+0x81e/0x1450 drivers/media/usb/gspca/gspca.c:1529
usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12d/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb80 drivers/base/core.c:3689
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:usb_gadget_udc_reset+0x27/0x60 drivers/usb/gadget/udc/core.c:1200
Code: 90 90 90 f3 0f 1e fa 41 56 53 49 89 f6 48 89 fb e8 6e 5c c0 fa 49 83 c6 40 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 cb 74 26 fb 4d 8b 1e 48 89 df 2e e8
RSP: 0000:ffffc900045f64d0 EFLAGS: 00010202
RAX: 0000000000000008 RBX: ffff88802702cc40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f6a51b7 R09: 1ffffffff1ed4a36
R10: dffffc0000000000 R11: ffffffff8b2104d0 R12: dffffc0000000000
R13: ffff888029a7850b R14: 0000000000000040 R15: 0000000000000010
FS: 0000000000000000(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feeb9ff20c0 CR3: 0000000038f62000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 41 56 push %r14
9: 53 push %rbx
a: 49 89 f6 mov %rsi,%r14
d: 48 89 fb mov %rdi,%rbx
10: e8 6e 5c c0 fa call 0xfac05c83
15: 49 83 c6 40 add $0x40,%r14
19: 4c 89 f0 mov %r14,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 cb 74 26 fb call 0xfb267503
38: 4d 8b 1e mov (%r14),%r11
3b: 48 89 df mov %rbx,%rdi
3e: 2e cs
3f: e8 .byte 0xe8
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=105044d6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=12442602580000
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-13 2:42 ` syzbot
@ 2026-03-13 16:07 ` Alan Stern
2026-03-13 16:32 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-13 16:07 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Thu, Mar 12, 2026 at 07:42:03PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in usb_gadget_udc_reset
>
> raw-gadget.1 gadget.0: Dummy disconnect 0 reset 16, ints_enabled 1
> raw-gadget.1 gadget.0: Inc usage: 1 X
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
I believe I have found the problem. The code in question in dummy_hcd.c
does this:
dev_info(&dum->gadget.dev, "Dummy disconnect %d reset %d, ints_enabled %d\n", disconnect, reset, dum->ints_enabled);
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
stop_activity(dum);
++dum->callback_usage;
dev_info(&dum->gadget.dev, "Inc usage: %d X\n", dum->callback_usage);
spin_unlock(&dum->lock);
The issue is that dum->callback_usage needs to be incremented after the
dum->ints_enabled check and before the dum->lock spinlock is released,
but stop_activity() drops the spinlock temporarily while giving back
cancelled requests.
Let's interchange the increment and the stop_activity() call. That's
the only change here from the prior test patch.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -460,21 +460,27 @@ static void set_link_state(struct dummy_
unsigned int reset = USB_PORT_STAT_RESET &
(~dum_hcd->old_status) & dum_hcd->port_status;
+ dev_info(&dum->gadget.dev, "Dummy disconnect %d reset %d, ints_enabled %d\n", disconnect, reset, dum->ints_enabled);
+
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
- stop_activity(dum);
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d X\n", dum->callback_usage);
+ stop_activity(dum);
spin_unlock(&dum->lock);
+ udelay(1000);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
else
dum->driver->disconnect(&dum->gadget);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d X\n", dum->callback_usage);
}
} else if (dum_hcd->active != dum_hcd->old_active &&
dum->ints_enabled) {
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d Y\n", dum->callback_usage);
spin_unlock(&dum->lock);
if (dum_hcd->old_active && dum->driver->suspend)
dum->driver->suspend(&dum->gadget);
@@ -482,6 +488,7 @@ static void set_link_state(struct dummy_
dum->driver->resume(&dum->gadget);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d Y\n", dum->callback_usage);
}
dum_hcd->old_status = dum_hcd->port_status;
@@ -908,21 +915,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +937,27 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ dev_info(&_gadget->dev, "Dummy ints_enabled <- %d A\n", dum->ints_enabled);
+ if (!enable) {
+ dev_info(&dum->gadget.dev, "Wait usage %d\n", dum->callback_usage);
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This seems to be the best place to emulate the call to
+ * synchronize_irq() that's in usb_gadget_remove_driver().
+ * It has to come after dum->ints_enabled is clear. But
+ * doing it in dummy_udc_stop() would be too late since that
+ * routine is called after the unbind callback, and unbind
+ * shouldn't be invoked until all the other callbacks are
+ * finished.
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ if (dum->ints_enabled)
+ dev_info(&_gadget->dev, "Dummy ints_enabled = %d !\n", dum->ints_enabled);
+ }
spin_unlock_irq(&dum->lock);
}
@@ -1020,6 +1033,8 @@ static int dummy_udc_start(struct usb_ga
spin_lock_irq(&dum->lock);
dum->devstatus = 0;
dum->driver = driver;
+ dev_info(&dum->gadget.dev, "Start on bus %d\n",
+ dummy_hcd_to_hcd(dum_hcd)->self.busnum);
spin_unlock_irq(&dum->lock);
return 0;
@@ -1032,6 +1047,7 @@ static int dummy_udc_stop(struct usb_gad
spin_lock_irq(&dum->lock);
dum->ints_enabled = 0;
+ dev_info(&g->dev, "Dummy ints_enabled <- %d B\n", dum->ints_enabled);
stop_activity(dum);
dum->driver = NULL;
spin_unlock_irq(&dum->lock);
@@ -1923,11 +1939,13 @@ restart:
*/
if (value > 0) {
++dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Inc usage: %d Z\n", dum->callback_usage);
spin_unlock(&dum->lock);
value = dum->driver->setup(&dum->gadget,
&setup);
spin_lock(&dum->lock);
--dum->callback_usage;
+ dev_info(&dum->gadget.dev, "Dec usage: %d Z\n", dum->callback_usage);
if (value >= 0) {
/* no delays (max 64KB data stage) */
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-13 16:07 ` Alan Stern
@ 2026-03-13 16:32 ` syzbot
2026-03-13 19:47 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-13 16:32 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11535cd6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=11de1def980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-13 16:32 ` syzbot
@ 2026-03-13 19:47 ` Alan Stern
2026-03-13 21:28 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-13 19:47 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Mar 13, 2026 at 09:32:02AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
> Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=11535cd6580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
> dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> patch: https://syzkaller.appspot.com/x/patch.diff?x=11de1def980000
>
> Note: testing is done by a robot and is best-effort only.
Great! Here's the final form of the fix, just to make sure I haven't
messed anything up.
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -462,8 +462,13 @@ static void set_link_state(struct dummy_
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
- stop_activity(dum);
++dum->callback_usage;
+ /*
+ * stop_activity() can drop dum->lock, so it must
+ * must not come between the dum->ints_enabled test
+ * and the ++dum->callback_usage.
+ */
+ stop_activity(dum);
spin_unlock(&dum->lock);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
@@ -908,21 +913,6 @@ static int dummy_pullup(struct usb_gadge
spin_lock_irqsave(&dum->lock, flags);
dum->pullup = (value != 0);
set_link_state(dum_hcd);
- if (value == 0) {
- /*
- * Emulate synchronize_irq(): wait for callbacks to finish.
- * This seems to be the best place to emulate the call to
- * synchronize_irq() that's in usb_gadget_remove_driver().
- * Doing it in dummy_udc_stop() would be too late since it
- * is called after the unbind callback and unbind shouldn't
- * be invoked until all the other callbacks are finished.
- */
- while (dum->callback_usage > 0) {
- spin_unlock_irqrestore(&dum->lock, flags);
- usleep_range(1000, 2000);
- spin_lock_irqsave(&dum->lock, flags);
- }
- }
spin_unlock_irqrestore(&dum->lock, flags);
usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -945,6 +935,20 @@ static void dummy_udc_async_callbacks(st
spin_lock_irq(&dum->lock);
dum->ints_enabled = enable;
+ if (!enable) {
+ /*
+ * Emulate synchronize_irq(): wait for callbacks to finish.
+ * This has to happen after emulated interrupts are disabled
+ * (dum->ints_enabled is clear) and before the unbind callback,
+ * just like the call to synchronize_irq() in
+ * gadget_unbind_driver().
+ */
+ while (dum->callback_usage > 0) {
+ spin_unlock_irq(&dum->lock);
+ usleep_range(1000, 2000);
+ spin_lock_irq(&dum->lock);
+ }
+ }
spin_unlock_irq(&dum->lock);
}
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-13 19:47 ` Alan Stern
@ 2026-03-13 21:28 ` syzbot
2026-03-14 16:42 ` Alan Stern
0 siblings, 1 reply; 26+ messages in thread
From: syzbot @ 2026-03-13 21:28 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14ab954a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=113b1602580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-13 21:28 ` syzbot
@ 2026-03-14 16:42 ` Alan Stern
2026-03-14 17:07 ` syzbot
0 siblings, 1 reply; 26+ messages in thread
From: Alan Stern @ 2026-03-14 16:42 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Mar 13, 2026 at 02:28:02PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
> Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=14ab954a580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
> dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> patch: https://syzkaller.appspot.com/x/patch.diff?x=113b1602580000
>
> Note: testing is done by a robot and is best-effort only.
Just out of curiosity, let's see if this test crashes with only the
second change (moving stop_activity()) and not the first (moving the
synchronize_irq() emulation).
Alan Stern
#syz test: upstream 651690480a96
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -462,8 +462,13 @@ static void set_link_state(struct dummy_
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
- stop_activity(dum);
++dum->callback_usage;
+ /*
+ * stop_activity() can drop dum->lock, so it must
+ * must not come between the dum->ints_enabled test
+ * and the ++dum->callback_usage.
+ */
+ stop_activity(dum);
spin_unlock(&dum->lock);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4)
2026-03-14 16:42 ` Alan Stern
@ 2026-03-14 17:07 ` syzbot
0 siblings, 0 replies; 26+ messages in thread
From: syzbot @ 2026-03-14 17:07 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=141f18ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a019678b1a3a692
dashboard link: https://syzkaller.appspot.com/bug?extid=19bed92c97bee999e5db
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=169b5d52580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 26+ messages in thread
end of thread, other threads:[~2026-03-14 17:07 UTC | newest]
Thread overview: 26+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-25 7:30 [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) syzbot
2026-03-07 10:52 ` syzbot
2026-03-08 15:36 ` Alan Stern
2026-03-08 16:01 ` syzbot
2026-03-09 14:25 ` Alan Stern
2026-03-09 14:55 ` syzbot
2026-03-09 15:24 ` Alan Stern
2026-03-09 15:43 ` syzbot
2026-03-10 15:50 ` Alan Stern
2026-03-10 16:09 ` syzbot
2026-03-10 19:02 ` Alan Stern
2026-03-10 19:32 ` syzbot
2026-03-11 1:50 ` Alan Stern
2026-03-11 3:16 ` syzbot
2026-03-11 18:44 ` Alan Stern
2026-03-11 19:25 ` syzbot
2026-03-12 17:56 ` Alan Stern
2026-03-12 18:29 ` syzbot
2026-03-13 2:05 ` Alan Stern
2026-03-13 2:42 ` syzbot
2026-03-13 16:07 ` Alan Stern
2026-03-13 16:32 ` syzbot
2026-03-13 19:47 ` Alan Stern
2026-03-13 21:28 ` syzbot
2026-03-14 16:42 ` Alan Stern
2026-03-14 17:07 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox