syzbot
WARNING in usb_composite_setup_continue
Status:
upstream: reported C repro on 2026/08/17 11:04
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com
Fix commit:
usb: gadget: composite: avoid warning on aborted delayed status
Patched on: [ci2-upstream-usb], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce]
First crash: 29d, last: 29d
▶
▼
Last patch testing requests (5)
Sample crash report:
------------[ cut here ]------------
usb_composite_setup_continue: Unexpected call
WARNING: drivers/usb/gadget/composite.c:2743 at usb_composite_setup_continue+0x2be/0x3a0 drivers/usb/gadget/composite.c:2743, CPU#1: file-storage/5932
Modules linked in:
CPU: 1 UID: 0 PID: 5932 Comm: file-storage Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:usb_composite_setup_continue+0x2c5/0x3a0 drivers/usb/gadget/composite.c:2743
Code: e5 40 89 ee e8 7c fa 3d fa 40 84 ed 0f 84 35 fe ff ff e9 ec 74 87 f9 e8 59 00 3e fa 48 8d 3d c2 b9 62 09 48 c7 c6 a0 27 b7 8c <67> 48 0f b9 3a e9 d6 fd ff ff e8 3c 00 3e fa 48 89 da 48 b8 00 00
RSP: 0018:ffffc9000204fc88 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffff888021bce528 RCX: ffffffff87cc7103
RDX: ffff888079b50000 RSI: ffffffff8cb727a0 RDI: ffffffff912f2cf0
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000293
R13: ffff888021bce6c8 R14: ffff88801e31c610 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888123eec000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4279cc4ff8 CR3: 000000007215b000 CR4: 00000000003526f0
Call Trace:
<TASK>
handle_exception drivers/usb/gadget/function/f_mass_storage.c:2551 [inline]
fsg_main_thread+0x16ec/0x88e0 drivers/usb/gadget/function/f_mass_storage.c:2589
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------------
Code disassembly (best guess):
0: e5 40 in $0x40,%eax
2: 89 ee mov %ebp,%esi
4: e8 7c fa 3d fa call 0xfa3dfa85
9: 40 84 ed test %bpl,%bpl
c: 0f 84 35 fe ff ff je 0xfffffe47
12: e9 ec 74 87 f9 jmp 0xf9877503
17: e8 59 00 3e fa call 0xfa3e0075
1c: 48 8d 3d c2 b9 62 09 lea 0x962b9c2(%rip),%rdi # 0x962b9e5
23: 48 c7 c6 a0 27 b7 8c mov $0xffffffff8cb727a0,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 d6 fd ff ff jmp 0xfffffe0a
34: e8 3c 00 3e fa call 0xfa3e0075
39: 48 89 da mov %rbx,%rdx
3c: 48 rex.W
3d: b8 .byte 0xb8
Struck through repros no longer work on HEAD.