bisecting fixing commit since dbb5afad100a828c97e012c6106566d99f041db6
building syzkaller on ed7d41c582d6f194ff35353d8bfdf7681dc0718e
testing commit dbb5afad100a828c97e012c6106566d99f041db6 with gcc (GCC) 10.2.1 20210217
kernel signature: fb9f0da2ebbc2c7fcbc36753b88d794ee9af2ab407c0c86e98829652464468e2
run #0: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
reproducer seems to be flaky
testing current HEAD e73f0f0ee7541171d89f2e2491130c7771ba58d3
testing commit e73f0f0ee7541171d89f2e2491130c7771ba58d3 with gcc (GCC) 10.2.1 20210217
kernel signature: df416c2ad1d3cfe2c64ec0d7896b16d91a86669c210d94a5bcc8d80e01c99fb6
run #0: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #1: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #2: crashed: BUG: corrupted list in usb_hcd_link_urb_to_ep
run #3: crashed: WARNING in cm109_input_open/usb_submit_urb
run #4: OK
run #5: crashed: WARNING in corrupted/usb_submit_urb
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
Reproducer flagged being flaky
revisions tested: 2, total time: 33m38.149800029s (build: 14m40.563429061s, test: 18m21.210787456s)
the crash still happens on HEAD
commit msg: Linux 5.14-rc1
crash: WARNING in corrupted/usb_submit_urb
usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 4-1: Product: syz
usb 4-1: Manufacturer: syz
usb 4-1: SerialNumber: syz
usb 4-1: config 0 descriptor??
cm109 4-1:0.0: invalid payload size 82, expected 4
input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input1342
------------[ cut here ]------------
URB 00000000b7a7ce04 submitted while active
WARNING: CPU: 0 PID: 8628 at drivers/usb/core/urb.c:378 usb_submit_urb+0x1057/0x1680 drivers/usb/core/urb.c:378
Modules linked in:
CPU: 0 PID: 8628 Comm: kworker/0:3 Tainted: G        W         5.14.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x1057/0x1680 drivers/usb/core/urb.c:378
Code: 3d 24 87 69 07 00 b8 f0 ff ff ff 0f 85 f7 fb ff ff 48 89 ee 48 c7 c7 e0 de 3e 89 89 04 24 c6 05 05 87 69 07 01 e8 1d 79 3c 03 <0f> 0b 8b 04 24 e9 d4 fb ff ff b8 ed ff ff ff e9 ca fb ff ff 66 90
RSP: 0018:ffffc90001f8ef98 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88802062f000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000004 RDI: fffff520003f1de5
RBP: ffff88801be7eb00 R08: 0000000000000001 R09: ffff8880b9e1fa5b
R10: ffffed10173c3f4b R11: 3030303020425255 R12: 000000000000000f
R13: ffff88802062f010 R14: ffff88802062f0a0 R15: ffff88802f3742e8
FS:  0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b223d0718 CR3: 00000000472d1000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace: