ci2 starts bisection 2023-06-24 21:05:57.461715787 +0000 UTC m=+346941.690674055
bisecting fixing commit since 9d6bde853685609a631871d7c12be94fdf8d912e
building syzkaller on 4bce1a3e705a8b62de8194bdb28f5eef89c8feec
ensuring issue is reproducible on original commit 9d6bde853685609a631871d7c12be94fdf8d912e
testing commit 9d6bde853685609a631871d7c12be94fdf8d912e gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: e5103f778a1232cba0f5b4fe5daf82f641016dae735b65b1ced95c5ca93c1a77
all runs: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
testing current HEAD f67653019430833d5003f16817d7fa85272a6a76
testing commit f67653019430833d5003f16817d7fa85272a6a76 gcc
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 0e4c5d10b856bd6552630d3dd6b81eb5a8ba8c62a7dd33d7c1f481ade38900f6
all runs: crashed: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
crash still not fixed/happens on the oldest tested release
revisions tested: 2, total time: 48m52.370229259s (build: 33m26.362975506s, test: 14m24.381415722s)
crash still not fixed on HEAD or HEAD had kernel test errors
commit msg: Linux 5.15.118
crash: KASAN: use-after-free Write in usb_anchor_suspend_wakeups
usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
BUG: KASAN: use-after-free in usb_anchor_suspend_wakeups drivers/usb/core/urb.c:940 [inline]
BUG: KASAN: use-after-free in usb_anchor_suspend_wakeups+0x1a/0x30 drivers/usb/core/urb.c:937
Write of size 4 at addr ffff8880195b1910 by task kworker/0:1/13
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted 5.15.118-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:451
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline]
usb_anchor_suspend_wakeups drivers/usb/core/urb.c:940 [inline]
usb_anchor_suspend_wakeups+0x1a/0x30 drivers/usb/core/urb.c:937
__usb_hcd_giveback_urb+0x1d2/0x3f0 drivers/usb/core/hcd.c:1657
dummy_timer+0x105e/0x2d60 drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x163/0x400 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers.part.0+0x530/0x890 kernel/time/timer.c:1737
__run_timers kernel/time/timer.c:1715 [inline]
run_timer_softirq+0x9c/0x190 kernel/time/timer.c:1750
__do_softirq+0x1d3/0x90e kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:console_unlock+0x4df/0x870 kernel/printk/printk.c:2739
Code: 27 28 fe ff e8 d2 29 00 00 48 83 3c 24 00 0f 85 e0 01 00 00 9c 58 f6 c4 02 0f 85 d3 02 00 00 48 83 3c 24 00 74 01 fb 45 85 e4 <0f> 85 27 02 00 00 8b 54 24 30 85 d2 0f 84 70 fc ff ff 31 d2 be b7
RSP: 0018:ffffc90000d27338 EFLAGS: 00000202
RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 1ffffffff1f85d8a
RDX: 0000000000000000 RSI: ffffffff890b6b40 RDI: ffffffff895ebac0
RBP: ffffc90000d27390 R08: 0000000000000001 R09: ffffffff8fc03b97
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff8beadc08 R14: ffffffff8beadbd0 R15: 0000000000000000
vprintk_emit+0x99/0x2f0 kernel/printk/printk.c:2268
dev_vprintk_emit+0x287/0x2cb drivers/base/core.c:4595
dev_printk_emit+0x9d/0xce drivers/base/core.c:4606
_dev_warn+0xc8/0xf6 drivers/base/core.c:4662
usb_parse_endpoint drivers/usb/core/config.c:455 [inline]
usb_parse_interface drivers/usb/core/config.c:582 [inline]
usb_parse_configuration drivers/usb/core/config.c:795 [inline]
usb_get_configuration.cold+0x126a/0x12f6 drivers/usb/core/config.c:944
usb_enumerate_device drivers/usb/core/hub.c:2400 [inline]
usb_new_device+0x559/0x800 drivers/usb/core/hub.c:2538
hub_port_connect drivers/usb/core/hub.c:5358 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
port_event drivers/usb/core/hub.c:5648 [inline]
hub_event+0x111f/0x3830 drivers/usb/core/hub.c:5730
process_one_work+0x85b/0x1360 kernel/workqueue.c:2307
worker_thread+0x5a6/0xf90 kernel/workqueue.c:2454
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Allocated by task 6635:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0x7c/0x90 mm/kasan/common.c:522
kmalloc include/linux/slab.h:591 [inline]
kzalloc include/linux/slab.h:721 [inline]
usbtmc_open+0x98/0x920 drivers/usb/class/usbtmc.c:175
usb_open+0x1d5/0x2a0 drivers/usb/core/file.c:48
chrdev_open+0x20f/0x650 fs/char_dev.c:414
do_dentry_open+0x46a/0x10f0 fs/open.c:826
do_open fs/namei.c:3538 [inline]
path_openat+0x12fe/0x23d0 fs/namei.c:3672
do_filp_open+0x199/0x3d0 fs/namei.c:3699
do_sys_openat2+0x11e/0x400 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__x64_sys_openat+0x11b/0x1d0 fs/open.c:1238
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Freed by task 6635:
kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:360
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0xe0/0x110 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook mm/slub.c:1731 [inline]
slab_free mm/slub.c:3499 [inline]
kfree+0xe3/0x420 mm/slub.c:4559
usbtmc_release+0x237/0x340 drivers/usb/class/usbtmc.c:261
__fput+0x20b/0x9b0 fs/file_table.c:280
task_work_run+0xc0/0x160 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x25d/0x260 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:301
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x61/0xcb
The buggy address belongs to the object at ffff8880195b1800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 272 bytes inside of
1024-byte region [ffff8880195b1800, ffff8880195b1c00)
The buggy address belongs to the page:
page:ffffea0000656c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x195b0
head:ffffea0000656c00 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888010c41dc0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2952, ts 64388178248, free_ts 64049293906
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0xa76/0x2f80 mm/page_alloc.c:4159
__alloc_pages+0x1b2/0x470 mm/page_alloc.c:5421
alloc_slab_page mm/slub.c:1775 [inline]
allocate_slab+0x2ee/0x440 mm/slub.c:1912
new_slab mm/slub.c:1975 [inline]
___slab_alloc+0xd5d/0x1680 mm/slub.c:3008
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3095
slab_alloc_node mm/slub.c:3186 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc_trace+0x2f3/0x320 mm/slub.c:3245
kmalloc include/linux/slab.h:591 [inline]
syslog_print+0xc0/0x420 kernel/printk/printk.c:1500
do_syslog.part.0+0x157/0x430 kernel/printk/printk.c:1679
do_syslog kernel/printk/printk.c:1664 [inline]
__do_sys_syslog kernel/printk/printk.c:1771 [inline]
__se_sys_syslog kernel/printk/printk.c:1769 [inline]
__x64_sys_syslog+0x80/0xa0 kernel/printk/printk.c:1769
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1391
free_unref_page_prepare mm/page_alloc.c:3317 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3396
__unfreeze_partials+0x340/0x360 mm/slub.c:2507
qlink_free mm/kasan/quarantine.c:157 [inline]
qlist_free_all+0x68/0x110 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x73/0x80 mm/kasan/common.c:444
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook mm/slab.h:519 [inline]
slab_alloc_node mm/slub.c:3220 [inline]
slab_alloc mm/slub.c:3228 [inline]
kmem_cache_alloc_trace+0x1e1/0x320 mm/slub.c:3245
kmalloc include/linux/slab.h:591 [inline]
usb_control_msg+0xae/0x460 drivers/usb/core/message.c:143
get_port_status drivers/usb/core/hub.c:583 [inline]
hub_ext_port_status+0xf8/0x3c0 drivers/usb/core/hub.c:600
hub_port_status drivers/usb/core/hub.c:622 [inline]
hub_port_debounce+0x19e/0x2d0 drivers/usb/core/hub.c:4553
hub_port_debounce_be_stable drivers/usb/core/hub.h:166 [inline]
hub_port_connect drivers/usb/core/hub.c:5214 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
port_event drivers/usb/core/hub.c:5648 [inline]
hub_event+0x2350/0x3830 drivers/usb/core/hub.c:5730
process_one_work+0x85b/0x1360 kernel/workqueue.c:2307
process_scheduled_works kernel/workqueue.c:2370 [inline]
worker_thread+0x741/0xf90 kernel/workqueue.c:2456
kthread+0x38b/0x460 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Memory state around the buggy address:
ffff8880195b1800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880195b1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880195b1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880195b1980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880195b1a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 4 bytes skipped:
0: e8 d2 29 00 00 callq 0x29d7
5: 48 83 3c 24 00 cmpq $0x0,(%rsp)
a: 0f 85 e0 01 00 00 jne 0x1f0
10: 9c pushfq
11: 58 pop %rax
12: f6 c4 02 test $0x2,%ah
15: 0f 85 d3 02 00 00 jne 0x2ee
1b: 48 83 3c 24 00 cmpq $0x0,(%rsp)
20: 74 01 je 0x23
22: fb sti
23: 45 85 e4 test %r12d,%r12d
* 26: 0f 85 27 02 00 00 jne 0x253 <-- trapping instruction
2c: 8b 54 24 30 mov 0x30(%rsp),%edx
30: 85 d2 test %edx,%edx
32: 0f 84 70 fc ff ff je 0xfffffca8
38: 31 d2 xor %edx,%edx
3a: be .byte 0xbe
3b: b7 .byte 0xb7