From: syzbot <syzbot+f669f02a0fcc5b2148f2@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [i2c?] [usb?] INFO: task hung in em28xx_i2c_unregister
Date: Mon, 31 Aug 2026 23:55:03 -0700 [thread overview]
Message-ID: <6a9676c7.764875ec.b345.0007.GAE@google.com> (raw)
In-Reply-To: <20260901012633.1985-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel paging request in module_put
BUG: unable to handle page fault for address: ffffffff8188f427
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
PGD eb4b067 P4D eb4b067 PUD eb4c063 PMD 18001a1
Oops: Oops: 0003 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6682 Comm: syz.3.60 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:107 [inline]
RIP: 0010:raw_atomic_try_cmpxchg include/linux/atomic/atomic-arch-fallback.h:2130 [inline]
RIP: 0010:raw_atomic_dec_if_positive include/linux/atomic/atomic-arch-fallback.h:2560 [inline]
RIP: 0010:atomic_dec_if_positive include/linux/atomic/atomic-instrumented.h:1594 [inline]
RIP: 0010:module_put+0x4c/0x1a0 kernel/module/main.c:956
Code: f0 04 00 00 4c 89 f7 be 04 00 00 00 e8 cd da 86 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 76 41 8b 06 89 c1 ff c9 78 53 <f0> 41 0f b1 0e 75 f3 4c 8b 74 24 28 66 90 65 8b 05 a7 b3 e3 11 83
RSP: 0018:ffffc9000420f968 EFLAGS: 00010206
RAX: 000000000004be8e RBX: ffffffff8188ef37 RCX: 000000000004be8d
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8188f427
RBP: dffffc0000000000 R08: ffffffff8188f42a R09: 1ffffffff0311e85
R10: dffffc0000000000 R11: fffffbfff0311e86 R12: dffffc0000000000
R13: ffff888073654ac8 R14: ffffffff8188f427 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888124cda000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8188f427 CR3: 000000002933a000 CR4: 00000000003526f0
Call Trace:
<TASK>
i2c_put_adapter+0x3e/0x60 drivers/i2c/i2c-core-base.c:2660
i2cdev_release+0x5a/0x90 drivers/i2c/i2c-dev.c:632
__fput+0x418/0xa50 fs/file_table.c:512
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x73a/0x2360 kernel/exit.c:1008
do_group_exit+0x22d/0x2f0 kernel/exit.c:1151
get_signal+0x121b/0x12c0 kernel/signal.c:3039
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbf1d95e98e
Code: Unable to access opcode bytes at 0x7fbf1d95e964.
RSP: 002b:00007fbf1e795b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: 0000000000000004 RBX: 00007fbf1e7966c0 RCX: 00007fbf1d95e98e
RDX: 0000000000080100 RSI: 00007fbf1e795c00 RDI: ffffffffffffff9c
RBP: 00007fbf1e795c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fbf1dc26038 R14: 00007fbf1dc25fa0 R15: 00007fbf1dd4fa48
</TASK>
Modules linked in:
CR2: ffffffff8188f427
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:107 [inline]
RIP: 0010:raw_atomic_try_cmpxchg include/linux/atomic/atomic-arch-fallback.h:2130 [inline]
RIP: 0010:raw_atomic_dec_if_positive include/linux/atomic/atomic-arch-fallback.h:2560 [inline]
RIP: 0010:atomic_dec_if_positive include/linux/atomic/atomic-instrumented.h:1594 [inline]
RIP: 0010:module_put+0x4c/0x1a0 kernel/module/main.c:956
Code: f0 04 00 00 4c 89 f7 be 04 00 00 00 e8 cd da 86 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 76 41 8b 06 89 c1 ff c9 78 53 <f0> 41 0f b1 0e 75 f3 4c 8b 74 24 28 66 90 65 8b 05 a7 b3 e3 11 83
RSP: 0018:ffffc9000420f968 EFLAGS: 00010206
RAX: 000000000004be8e RBX: ffffffff8188ef37 RCX: 000000000004be8d
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8188f427
RBP: dffffc0000000000 R08: ffffffff8188f42a R09: 1ffffffff0311e85
R10: dffffc0000000000 R11: fffffbfff0311e86 R12: dffffc0000000000
R13: ffff888073654ac8 R14: ffffffff8188f427 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888124cda000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8188f427 CR3: 000000002933a000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: f0 04 00 lock add $0x0,%al
3: 00 4c 89 f7 add %cl,-0x9(%rcx,%rcx,4)
7: be 04 00 00 00 mov $0x4,%esi
c: e8 cd da 86 00 call 0x86dade
11: 4c 89 f0 mov %r14,%rax
14: 48 c1 e8 03 shr $0x3,%rax
18: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax
1d: 84 c0 test %al,%al
1f: 75 76 jne 0x97
21: 41 8b 06 mov (%r14),%eax
24: 89 c1 mov %eax,%ecx
26: ff c9 dec %ecx
28: 78 53 js 0x7d
* 2a: f0 41 0f b1 0e lock cmpxchg %ecx,(%r14) <-- trapping instruction
2f: 75 f3 jne 0x24
31: 4c 8b 74 24 28 mov 0x28(%rsp),%r14
36: 66 90 xchg %ax,%ax
38: 65 8b 05 a7 b3 e3 11 mov %gs:0x11e3b3a7(%rip),%eax # 0x11e3b3e6
3f: 83 .byte 0x83
Tested on:
commit: 786262be Merge tag 'edac_updates_for_v7.3_rc2' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16cf9c15580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
dashboard link: https://syzkaller.appspot.com/bug?extid=f669f02a0fcc5b2148f2
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=142e9c15580000
prev parent reply other threads:[~2026-09-01 6:55 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-31 21:17 syzbot
2026-09-01 1:26 ` Hillf Danton
2026-09-01 6:55 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a9676c7.764875ec.b345.0007.GAE@google.com \
--to=syzbot+f669f02a0fcc5b2148f2@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®