syzbot


general protection fault in usb_gadget_udc_reset

Status: closed as invalid on 2019/05/14 14:46
Subsystems: usb
[Documentation on labels]
First crash: 1792d, last: 1792d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in usb_gadget_udc_reset (3) usb 1 702d 696d 0/26 auto-closed as invalid on 2022/08/24 11:51
upstream general protection fault in usb_gadget_udc_reset (2) usb 2 1738d 1765d 0/26 auto-closed as invalid on 2019/10/25 08:44

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 0 PID: 533 Comm: kworker/0:2 Not tainted 5.1.0-rc3-319004-g43151d6 #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_gadget_udc_reset+0x28/0xc0 drivers/usb/gadget/udc/core.c:1051
Code: eb d4 0f 1f 44 00 00 41 54 49 89 fc 53 48 89 f3 e8 bd 6a ed f7 48 8d 7b 40 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 70 48 8b 43 40 4c 89 e7 e8 b6 f9 bb 04 49 8d 7c 24
RSP: 0018:ffff88809f7074b8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90012792000
RDX: 0000000000000008 RSI: ffffffff89845fb3 RDI: 0000000000000040
RBP: ffff888216f54df4 R08: ffff88809f471880 R09: ffffed1042dea841
R10: ffffed1042dea840 R11: ffff888216f54203 R12: ffff888216f54df8
R13: ffff888216f54200 R14: ffff88809f60f0e3 R15: ffff88809f60f0a4
FS:  0000000000000000(0000) GS:ffff8880ad000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000062a768 CR3: 0000000077d90000 CR4: 00000000001406f0
Call Trace:
 set_link_state+0x7c3/0xd00 drivers/usb/gadget/udc/dummy_hcd.c:463
 dummy_hub_control+0x8df/0x1d90 drivers/usb/gadget/udc/dummy_hcd.c:2303
 rh_call_control drivers/usb/core/hcd.c:685 [inline]
 rh_urb_enqueue drivers/usb/core/hcd.c:844 [inline]
 usb_hcd_submit_urb+0xc0f/0x2180 drivers/usb/core/hcd.c:1652
 usb_submit_urb+0x6f1/0x1480 drivers/usb/core/urb.c:569
 usb_start_wait_urb+0x10d/0x4d0 drivers/usb/core/message.c:57
 usb_internal_control_msg drivers/usb/core/message.c:101 [inline]
 usb_control_msg+0x321/0x4a0 drivers/usb/core/message.c:152
 set_port_feature+0x6e/0x90 drivers/usb/core/hub.c:428
 hub_port_reset+0x20d/0x1770 drivers/usb/core/hub.c:2871
 hub_port_init+0x937/0x2d30 drivers/usb/core/hub.c:4688
 hub_port_connect drivers/usb/core/hub.c:5021 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
 port_event drivers/usb/core/hub.c:5350 [inline]
 hub_event+0x11b8/0x3b00 drivers/usb/core/hub.c:5432
 process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
 process_scheduled_works kernel/workqueue.c:2331 [inline]
 worker_thread+0x7b0/0xe20 kernel/workqueue.c:2417
 kthread+0x313/0x420 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace cee03c710b56c154 ]---
RIP: 0010:usb_gadget_udc_reset+0x28/0xc0 drivers/usb/gadget/udc/core.c:1051
Code: eb d4 0f 1f 44 00 00 41 54 49 89 fc 53 48 89 f3 e8 bd 6a ed f7 48 8d 7b 40 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 70 48 8b 43 40 4c 89 e7 e8 b6 f9 bb 04 49 8d 7c 24
RSP: 0018:ffff88809f7074b8 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90012792000
RDX: 0000000000000008 RSI: ffffffff89845fb3 RDI: 0000000000000040
RBP: ffff888216f54df4 R08: ffff88809f471880 R09: ffffed1042dea841
R10: ffffed1042dea840 R11: ffff888216f54203 R12: ffff888216f54df8
R13: ffff888216f54200 R14: ffff88809f60f0e3 R15: ffff88809f60f0a4
FS:  0000000000000000(0000) GS:ffff8880ad000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000062a768 CR3: 0000000077d90000 CR4: 00000000001406f0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/02 09:05 https://github.com/google/kasan.git usb-fuzzer 43151d6c3fce 1852eb18 .config console log report ci2-upstream-usb
* Struck through repros no longer work on HEAD.