ci starts bisection 2023-01-31 08:04:42.507526832 +0000 UTC m=+737596.453588899
bisecting fixing commit since dd81e1c7d5fb126e5fbc5c9e334d7b3ec29a16a0
building syzkaller on 214351e168def9426c79e1f65a93ddb112cee906
ensuring issue is reproducible on original commit dd81e1c7d5fb126e5fbc5c9e334d7b3ec29a16a0

testing commit dd81e1c7d5fb126e5fbc5c9e334d7b3ec29a16a0 gcc
compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: e4d1b02e972eafa6a63f1385e8acb9dd2c014565ba18cb7e3d1f860e629cdbfc
run #0: crashed: WARNING in cm109_input_open/usb_submit_urb
run #1: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #2: crashed: WARNING in cm109_input_open/usb_submit_urb
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
reproducer seems to be flaky
testing current HEAD 9f266ccaa2f5228bfe67ad58a94ca4e0109b954a
testing commit 9f266ccaa2f5228bfe67ad58a94ca4e0109b954a gcc
compiler: Debian clang version 13.0.1-6~deb11u1, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 6307abb114054065ebfb10e571af8797652a38fc981a1b1c99edc27821a59707
run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe
run #1: basic kernel testing failed: BUG: program execution failed: executor NUM: exit status NUM
run #2: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #3: crashed: WARNING in cm109_input_open/usb_submit_urb
run #4: OK
run #5: OK
run #6: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
Reproducer flagged being flaky
revisions tested: 2, total time: 38m21.996821793s (build: 14m11.937781256s, test: 23m3.772602237s)
the crash still happens on HEAD
commit msg: Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
crash: BUG: corrupted list in usb_hcd_link_urb_to_ep
usb 4-1: SerialNumber: syz
usb 4-1: config 0 descriptor??
cm109 4-1:0.0: invalid payload size 0, expected 4
input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input1557
list_add double add: new=ffff88801a2b1018, prev=ffff88801a2b1018, next=ffff8880270d5070.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:35!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5024 Comm: kworker/1:3 Not tainted 6.2.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Workqueue: usb_hub_wq hub_event
RIP: 0010:__list_add_valid+0xa7/0x100 lib/list_debug.c:33
Code: 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 b0 01 84 c0 74 ee 48 c7 c7 80 33 09 8a 4c 89 fe 4c 89 e2 4c 89 f1 31 c0 e8 e9 81 89 05 <0f> 0b 48 c7 c7 80 31 09 8a 31 c0 e8 d9 81 89 05 0f 0b 48 c7 c7 20
RSP: 0018:ffffc90003afe7b8 EFLAGS: 00010046
RAX: 0000000000000058 RBX: ffff8880270d5078 RCX: 3a73da84246fbf00
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffff8880270d5070 R08: dffffc0000000000 R09: ffffed10173a4f5b
R10: ffffed10173a4f5b R11: 1ffff110173a4f5a R12: ffff88801a2b1018
R13: dffffc0000000000 R14: ffff8880270d5070 R15: ffff88801a2b1018
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc248abc68 CR3: 000000007e997000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_add include/linux/list.h:69 [inline]
 list_add_tail include/linux/list.h:102 [inline]
 usb_hcd_link_urb_to_ep+0x173/0x2c0 drivers/usb/core/hcd.c:1181
 dummy_urb_enqueue+0x253/0x680 drivers/usb/gadget/udc/dummy_hcd.c:1285
 usb_hcd_submit_urb+0x237/0x480 drivers/usb/core/hcd.c:1556
 cm109_input_open+0x1d8/0x430 drivers/input/misc/cm109.c:572
 input_open_device+0x12f/0x280 drivers/input/input.c:651
 kbd_connect+0xcd/0x100 drivers/tty/vt/keyboard.c:1593
 input_attach_handler drivers/input/input.c:1061 [inline]
 input_register_device+0xabf/0xe00 drivers/input/input.c:2397
 cm109_usb_probe+0x1080/0x1540 drivers/input/misc/cm109.c:806
 usb_probe_interface+0x4db/0x970 drivers/usb/core/driver.c:396
 call_driver_probe+0x85/0x1e0
 really_probe+0x1cc/0x830 drivers/base/dd.c:639
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:778
 driver_probe_device+0x4b/0x1e0 drivers/base/dd.c:808
 __device_attach_driver+0x1c7/0x2c0 drivers/base/dd.c:936
 bus_for_each_drv+0x15d/0x1c0 drivers/base/bus.c:427
 __device_attach+0x2d6/0x4e0 drivers/base/dd.c:1008
 bus_probe_device+0x81/0x190 drivers/base/bus.c:487
 device_add+0x7dc/0xd50 drivers/base/core.c:3479
 usb_set_configuration+0x1802/0x1e10 drivers/usb/core/message.c:2171
 usb_generic_driver_probe+0x5f/0xf0 drivers/usb/core/generic.c:238
 usb_probe_device+0xc7/0x1e0 drivers/usb/core/driver.c:293
 call_driver_probe+0x85/0x1e0
 really_probe+0x1cc/0x830 drivers/base/dd.c:639
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:778
 driver_probe_device+0x4b/0x1e0 drivers/base/dd.c:808
 __device_attach_driver+0x1c7/0x2c0 drivers/base/dd.c:936
 bus_for_each_drv+0x15d/0x1c0 drivers/base/bus.c:427
 __device_attach+0x2d6/0x4e0 drivers/base/dd.c:1008
 bus_probe_device+0x81/0x190 drivers/base/bus.c:487
 device_add+0x7dc/0xd50 drivers/base/core.c:3479
 usb_new_device+0xbdb/0x17f0 drivers/usb/core/hub.c:2576
 hub_port_connect+0xdeb/0x1e40 drivers/usb/core/hub.c:5408
 hub_port_connect_change+0x517/0xa40 drivers/usb/core/hub.c:5552
 port_event+0xc27/0x1180 drivers/usb/core/hub.c:5712
 hub_event+0x462/0xb70 drivers/usb/core/hub.c:5794
 process_one_work+0x794/0xc10 kernel/workqueue.c:2289
 worker_thread+0x8ff/0xfe0 kernel/workqueue.c:2436
 kthread+0x228/0x2a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid+0xa7/0x100 lib/list_debug.c:33
Code: 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 b0 01 84 c0 74 ee 48 c7 c7 80 33 09 8a 4c 89 fe 4c 89 e2 4c 89 f1 31 c0 e8 e9 81 89 05 <0f> 0b 48 c7 c7 80 31 09 8a 31 c0 e8 d9 81 89 05 0f 0b 48 c7 c7 20
RSP: 0018:ffffc90003afe7b8 EFLAGS: 00010046
RAX: 0000000000000058 RBX: ffff8880270d5078 RCX: 3a73da84246fbf00
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffff8880270d5070 R08: dffffc0000000000 R09: ffffed10173a4f5b
R10: ffffed10173a4f5b R11: 1ffff110173a4f5a R12: ffff88801a2b1018
R13: dffffc0000000000 R14: ffff8880270d5070 R15: ffff88801a2b1018
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc248abc68 CR3: 000000007e997000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400