syzbot


KCSAN: data-race in vhci_hub_control / vhci_shutdown_connection (2)

Status: moderation: reported on 2025/01/24 10:31
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+e4dc7ad33466b13d942a@syzkaller.appspotmail.com
First crash: 11d, last: 11d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in vhci_hub_control / vhci_shutdown_connection usb 3 956d 977d 0/28 auto-closed as invalid on 2022/07/29 15:48

Sample crash report:
vhci_hcd: vhci_device speed not set
==================================================================
BUG: KCSAN: data-race in vhci_hub_control / vhci_shutdown_connection

read-write to 0xffff888101411258 of 4 bytes by task 5076 on cpu 0:
 rh_port_disconnect drivers/usb/usbip/vhci_hcd.c:204 [inline]
 vhci_shutdown_connection+0x19b/0x1e0 drivers/usb/usbip/vhci_hcd.c:1064
 event_handler+0x18b/0x350 drivers/usb/usbip/usbip_event.c:79
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3317
 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3398
 kthread+0x4ae/0x520 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888101411258 of 4 bytes by task 35 on cpu 1:
 vhci_hub_control+0xd68/0xdd0 drivers/usb/usbip/vhci_hcd.c:657
 rh_call_control drivers/usb/core/hcd.c:656 [inline]
 rh_urb_enqueue drivers/usb/core/hcd.c:821 [inline]
 usb_hcd_submit_urb+0xcd2/0x1510 drivers/usb/core/hcd.c:1529
 usb_submit_urb+0xa80/0xb70 drivers/usb/core/urb.c:581
 usb_start_wait_urb+0x91/0x190 drivers/usb/core/message.c:59
 usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
 usb_control_msg+0x182/0x240 drivers/usb/core/message.c:154
 get_port_status drivers/usb/core/hub.c:604 [inline]
 hub_ext_port_status+0xbf/0x480 drivers/usb/core/hub.c:621
 hub_port_reset+0x559/0xed0 drivers/usb/core/hub.c:3049
 hub_port_init+0x198/0x1730 drivers/usb/core/hub.c:4895
 hub_port_connect drivers/usb/core/hub.c:5452 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
 port_event drivers/usb/core/hub.c:5823 [inline]
 hub_event+0x1b1a/0x2910 drivers/usb/core/hub.c:5905
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3317
 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3398
 kthread+0x4ae/0x520 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x00100103 -> 0x00110102

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 6.13.0-syzkaller-05252-gbc8198dc7ebc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: usb_hub_wq hub_event
==================================================================
usb 3-1: new full-speed USB device number 2 using vhci_hcd
usb 3-1: enqueue for inactive port 0
usb 3-1: enqueue for inactive port 0
usb 3-1: enqueue for inactive port 0
vhci_hcd: vhci_device speed not set

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/24 10:30 upstream bc8198dc7ebc 521b0ce3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in vhci_hub_control / vhci_shutdown_connection
* Struck through repros no longer work on HEAD.