ci starts bisection 2022-08-25 15:45:53.461581711 +0000 UTC m=+2085.591976905
bisecting fixing commit since dd81e1c7d5fb126e5fbc5c9e334d7b3ec29a16a0
building syzkaller on 214351e168def9426c79e1f65a93ddb112cee906
testing commit dd81e1c7d5fb126e5fbc5c9e334d7b3ec29a16a0
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: c7d092af4f112a1053978ac9e517e1cc4cf1a225660573405311daaf8d175313
run #0: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #1: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #2: crashed: WARNING in cm109_input_open/usb_submit_urb
run #3: crashed: WARNING in cm109_input_open/usb_submit_urb
run #4: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #5: crashed: WARNING in cm109_input_open/usb_submit_urb
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
reproducer seems to be flaky
testing current HEAD c40e8341e3b3bb27e3a65b06b5b454626234c4f0
testing commit c40e8341e3b3bb27e3a65b06b5b454626234c4f0
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: bbedfd534ac78f894dea0076acdc03c9637277226c89bd8fdb0ea7b1810a9095
run #0: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #1: crashed: WARNING in cm109_input_open/usb_submit_urb
run #2: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
Reproducer flagged being flaky
revisions tested: 2, total time: 37m15.252704085s (build: 13m8.395829645s, test: 23m15.755102996s)
the crash still happens on HEAD
commit msg: Merge tag 'cgroup-for-6.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
crash: BUG: corrupted list in usb_hcd_link_urb_to_ep
cm109 4-1:0.0: invalid payload size 0, expected 4
input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input1346
list_add double add: new=ffff888074abdc18, prev=ffff888074abdc18, next=ffff88807bf1e070.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:33!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 144 Comm: kworker/1:2 Not tainted 6.0.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Workqueue: usb_hub_wq hub_event
RIP: 0010:__list_add_valid.cold+0x42/0x58 lib/list_debug.c:33
Code: e8 91 b1 f1 ff 0f 0b 48 c7 c7 80 ea 62 89 e8 83 b1 f1 ff 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 80 ec 62 89 e8 6c b1 f1 ff <0f> 0b 48 89 f1 48 c7 c7 00 ec 62 89 4c 89 e6 e8 58 b1 f1 ff 0f 0b
RSP: 0018:ffffc90001e3edf8 EFLAGS: 00010082
RAX: 0000000000000058 RBX: ffff888074abdc00 RCX: 0000000000000000
RDX: 0000000000000003 RSI: 0000000000000004 RDI: fffff520003c7db2
RBP: ffff888074abdc18 R08: 0000000000000058 R09: ffff8880b9f2792b
R10: ffffed10173e4f25 R11: 000000000007e07c R12: ffff88807bf1e070
R13: 0000000000000000 R14: ffff888074abdc18 R15: ffff88807bf1e078
FS:  0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f44d1cd7ca8 CR3: 0000000072df0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_add include/linux/list.h:69 [inline]
 list_add_tail include/linux/list.h:102 [inline]
 usb_hcd_link_urb_to_ep+0x1c4/0x330 drivers/usb/core/hcd.c:1181
 dummy_urb_enqueue+0x221/0x7a0 drivers/usb/gadget/udc/dummy_hcd.c:1285
 usb_hcd_submit_urb+0x276/0x1f70 drivers/usb/core/hcd.c:1556
 cm109_input_open+0x25b/0x340 drivers/input/misc/cm109.c:572
 input_open_device+0x155/0x290 drivers/input/input.c:650
 kbd_connect+0xd7/0x120 drivers/tty/vt/keyboard.c:1593
 input_attach_handler+0xfb/0x150 drivers/input/input.c:1060
 input_register_device.cold+0xb1/0x2a0 drivers/input/input.c:2396
 cm109_usb_probe+0x112e/0x17a0 drivers/input/misc/cm109.c:806
 usb_probe_interface+0x274/0x6a0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:530 [inline]
 really_probe+0x5a6/0xa50 drivers/base/dd.c:609
 __driver_probe_device+0x186/0x460 drivers/base/dd.c:748
 driver_probe_device+0x44/0x110 drivers/base/dd.c:778
 __device_attach_driver+0x185/0x250 drivers/base/dd.c:901
 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427
 __device_attach+0x19e/0x440 drivers/base/dd.c:973
 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487
 device_add+0xa14/0x1b80 drivers/base/core.c:3517
 usb_set_configuration+0xa38/0x1920 drivers/usb/core/message.c:2170
 usb_generic_driver_probe+0x74/0xa0 drivers/usb/core/generic.c:238
 usb_probe_device+0x94/0x230 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:530 [inline]
 really_probe+0x5a6/0xa50 drivers/base/dd.c:609
 __driver_probe_device+0x186/0x460 drivers/base/dd.c:748
 driver_probe_device+0x44/0x110 drivers/base/dd.c:778
 __device_attach_driver+0x185/0x250 drivers/base/dd.c:901
 bus_for_each_drv+0x11e/0x1a0 drivers/base/bus.c:427
 __device_attach+0x19e/0x440 drivers/base/dd.c:973
 bus_probe_device+0x19d/0x250 drivers/base/bus.c:487
 device_add+0xa14/0x1b80 drivers/base/core.c:3517
 usb_new_device.cold+0x5b4/0xe87 drivers/usb/core/hub.c:2573
 hub_port_connect drivers/usb/core/hub.c:5353 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
 port_event drivers/usb/core/hub.c:5653 [inline]
 hub_event+0x1c5b/0x3af0 drivers/usb/core/hub.c:5735
 process_one_work+0x841/0x13a0 kernel/workqueue.c:2289
 worker_thread+0x598/0xec0 kernel/workqueue.c:2436
 kthread+0x294/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid.cold+0x42/0x58 lib/list_debug.c:33
Code: e8 91 b1 f1 ff 0f 0b 48 c7 c7 80 ea 62 89 e8 83 b1 f1 ff 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 80 ec 62 89 e8 6c b1 f1 ff <0f> 0b 48 89 f1 48 c7 c7 00 ec 62 89 4c 89 e6 e8 58 b1 f1 ff 0f 0b
RSP: 0018:ffffc90001e3edf8 EFLAGS: 00010082
RAX: 0000000000000058 RBX: ffff888074abdc00 RCX: 0000000000000000
RDX: 0000000000000003 RSI: 0000000000000004 RDI: fffff520003c7db2
RBP: ffff888074abdc18 R08: 0000000000000058 R09: ffff8880b9f2792b
R10: ffffed10173e4f25 R11: 000000000007e07c R12: ffff88807bf1e070
R13: 0000000000000000 R14: ffff888074abdc18 R15: ffff88807bf1e078
FS:  0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f44d1cd7ca8 CR3: 0000000072df0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400