syzbot


divide error in dummy_timer

Status: fixed on 2019/11/23 02:56
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+8ab8bf161038a8768553@syzkaller.appspotmail.com
Fix commit: 54f83b8c8ea9 USB: gadget: Reject endpoints with 0 maxpacket value
First crash: 1617d, last: 1612d
Discussions (8)
Title Replies (including bot) Last reply
[PATCH 3.16 000/136] 3.16.80-rc1 review 140 (140) 2019/12/23 14:00
[PATCH 4.19 000/149] 4.19.82-stable review 169 (169) 2019/11/11 09:36
[PATCH 4.9 00/62] 4.9.199-stable review 72 (72) 2019/11/06 11:17
[PATCH 5.3 000/163] 5.3.9-stable review 174 (174) 2019/11/06 10:49
[PATCH 4.14 00/95] 4.14.152-stable review 102 (102) 2019/11/05 23:37
[PATCH 4.4 00/46] 4.4.199-stable review 52 (52) 2019/11/05 23:36
[PATCH] USB: gadget: Reject endpoints with 0 maxpacket value 3 (3) 2019/10/29 08:38
divide error in dummy_timer 6 (10) 2019/10/24 19:17
Last patch testing requests (3)
Created Duration User Patch Repo Result
2019/10/24 18:58 16m stern@rowland.harvard.edu patch https://github.com/google/kasan.git 22be26f7 OK
2019/10/24 17:57 9m stern@rowland.harvard.edu patch https://github.com/google/kasan.git 22be26f7 report log
2019/10/24 15:04 16m stern@rowland.harvard.edu patch https://github.com/google/kasan.git 22be26f7 OK

Sample crash report:
divide error: 0000 [#1] SMP KASAN
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc5+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:transfer drivers/usb/gadget/udc/dummy_hcd.c:1426 [inline]
RIP: 0010:dummy_timer+0xb0d/0x2fdb drivers/usb/gadget/udc/dummy_hcd.c:1950
Code: 0f 84 e6 fd ff ff e8 e2 70 ab fd 89 de 44 89 e7 e8 c8 71 ab fd 41 39 dc 0f 82 a6 08 00 00 e8 ca 70 ab fd 44 89 e0 31 d2 31 ff <f7> f3 89 d6 89 94 24 c0 00 00 00 e8 23 72 ab fd 8b 94 24 c0 00 00
RSP: 0018:ffff8881db209b20 EFLAGS: 00010046
RAX: 0000000000000003 RBX: 0000000000000000 RCX: ffffffff8392b468
RDX: 0000000000000000 RSI: ffffffff8392b476 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff86c2b200 R09: ffffed103b641353
R10: ffffed103b641352 R11: 0000000000000003 R12: 0000000000000003
R13: ffff8881d5089138 R14: dffffc0000000000 R15: ffff8881d901cb00
FS:  0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe7b041b000 CR3: 00000001c6549000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x179/0x650 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0x5e3/0x1490 kernel/time/timer.c:1786
 __do_softirq+0x221/0x912 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x178/0x1a0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 </IRQ>
RIP: 0010:default_idle+0x28/0x2e0 arch/x86/kernel/process.c:581
Code: 90 90 41 56 41 55 65 44 8b 2d 74 ee 91 7a 41 54 55 53 0f 1f 44 00 00 e8 26 ad d3 fb e9 07 00 00 00 0f 00 2d aa 93 52 00 fb f4 <65> 44 8b 2d 50 ee 91 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffffff86c07da8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: ffffffff86c2b200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff86c2ba4c
RBP: fffffbfff0d85640 R08: ffffffff86c2b200 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x3b6/0x500 kernel/sched/idle.c:263
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:355
 start_kernel+0x82a/0x864 init/main.c:784
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
Modules linked in:
---[ end trace 9108efe26bbefb66 ]---
RIP: 0010:transfer drivers/usb/gadget/udc/dummy_hcd.c:1426 [inline]
RIP: 0010:dummy_timer+0xb0d/0x2fdb drivers/usb/gadget/udc/dummy_hcd.c:1950
Code: 0f 84 e6 fd ff ff e8 e2 70 ab fd 89 de 44 89 e7 e8 c8 71 ab fd 41 39 dc 0f 82 a6 08 00 00 e8 ca 70 ab fd 44 89 e0 31 d2 31 ff <f7> f3 89 d6 89 94 24 c0 00 00 00 e8 23 72 ab fd 8b 94 24 c0 00 00
RSP: 0018:ffff8881db209b20 EFLAGS: 00010046
RAX: 0000000000000003 RBX: 0000000000000000 RCX: ffffffff8392b468
RDX: 0000000000000000 RSI: ffffffff8392b476 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff86c2b200 R09: ffffed103b641353
R10: ffffed103b641352 R11: 0000000000000003 R12: 0000000000000003
R13: ffff8881d5089138 R14: dffffc0000000000 R15: ffff8881d901cb00
FS:  0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe7b041b000 CR3: 00000001c6549000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/29 21:37 https://github.com/google/kasan.git usb-fuzzer ff6409a6ec35 5ea87a66 .config console log report syz C ci2-upstream-usb
2019/10/26 06:53 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 413926c5 .config console log report syz C ci2-upstream-usb
2019/10/24 09:13 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 d01bb02a .config console log report syz C ci2-upstream-usb
* Struck through repros no longer work on HEAD.