From: syzbot <syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tkdkei@outlook.jp
Subject: Re: [syzbot] WARNING in usb_composite_setup_continue
Date: Sun, 06 Sep 2026 20:28:03 -0700 [thread overview]
Message-ID: <6a9e2f43.a6639fcc.23b8b0.000f.GAE@google.com> (raw)
In-Reply-To: <OSZPR01MB9313C6A272CD4ACAD2097CF0B2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in __fsg_is_set
configfs-gadget.g1 gadget.2: common->fsg is NULL in fsg_setup at 466
------------[ cut here ]------------
1
WARNING: drivers/usb/gadget/function/f_mass_storage.c:315 at __fsg_is_set.part.0.isra.0+0x2c/0x3a drivers/usb/gadget/function/f_mass_storage.c:315, CPU#0: syz-executor104/5934
Modules linked in:
CPU: 0 UID: 0 PID: 5934 Comm: syz-executor104 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:__fsg_is_set.part.0.isra.0+0x2c/0x3a drivers/usb/gadget/function/f_mass_storage.c:315
Code: 41 89 d4 55 48 89 f5 53 48 89 fb e8 9e f8 b6 00 48 8d bb d8 00 00 00 44 89 e1 48 89 ea 48 c7 c6 c0 82 dc 8c e8 25 61 eb ff 90 <0f> 0b 90 31 c0 5b 5d 41 5c e9 c6 f2 7b 0a e8 71 f8 b6 00 4c 89 e2
RSP: 0018:ffffc90000007a40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88802b4f4c00 RCX: 0000000000000000
RDX: ffff888035554b00 RSI: ffffffff81404f89 RDI: fffff52000000f38
RBP: ffffffff8cdc9f60 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000101 R11: 0000000000000001 R12: 00000000000001d2
R13: ffff88805c34ace8 R14: 0000000000000000 R15: ffffc90000007de0
FS: 00007f788ec136c0(0000) GS:ffff888123b6f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f788dc10ff8 CR3: 000000002cb70000 CR4: 00000000003526f0
Call Trace:
<IRQ>
__fsg_is_set drivers/usb/gadget/function/f_mass_storage.c:864 [inline]
fsg_setup.cold+0x38/0x4c drivers/usb/gadget/function/f_mass_storage.c:466
composite_setup+0xad8/0x9290 drivers/usb/gadget/composite.c:2239
configfs_composite_setup+0xfb/0x130 drivers/usb/gadget/configfs.c:1877
dummy_timer+0x2039/0x3700 drivers/usb/gadget/udc/dummy_hcd.c:1951
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2141
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x194/0x210 kernel/softirq.c:767
irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:unwind_next_frame+0xcb6/0x2090 arch/x86/kernel/unwind_orc.c:610
Code: 03 0f b6 04 02 4c 89 c2 83 e2 07 38 d0 7f 08 84 c0 0f 85 db 0d 00 00 0f b6 41 04 83 e0 0f 3c 09 0f 84 ef 0a 00 00 0f b6 41 05 <4c> 89 44 24 18 83 e0 07 3c 03 0f 84 cc 03 00 00 3c 04 0f 84 05 03
RSP: 0018:ffffc900035ef768 EFLAGS: 00000292
RAX: 0000000000000002 RBX: 0000000000000001 RCX: ffffffff9221d688
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffc900035ef820 R08: ffffffff9221d68c R09: 0000000000000007
R10: 0000000000000200 R11: 000000000003e7cf R12: ffffc900035ef828
R13: ffffc900035ef7d8 R14: ffffc900035efeb0 R15: ffffc900035efc38
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x32f/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
tomoyo_realpath_from_path+0xb6/0x690 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x23c/0x580 security/tomoyo/file.c:728
security_file_ioctl+0xd3/0x230 security/security.c:2512
__do_sys_ioctl fs/ioctl.c:591 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xb7/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f788ec4f93b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007f788ec130d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f788ec4f93b
RDX: 00007f788ec13148 RSI: 000000004008550c RDI: 0000000000000003
RBP: 000000008038550a R08: 0000000000000000 R09: 00007f788ec136c0
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000072062152
R13: 00007f788ec13160 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess):
0: 03 0f add (%rdi),%ecx
2: b6 04 mov $0x4,%dh
4: 02 4c 89 c2 add -0x3e(%rcx,%rcx,4),%cl
8: 83 e2 07 and $0x7,%edx
b: 38 d0 cmp %dl,%al
d: 7f 08 jg 0x17
f: 84 c0 test %al,%al
11: 0f 85 db 0d 00 00 jne 0xdf2
17: 0f b6 41 04 movzbl 0x4(%rcx),%eax
1b: 83 e0 0f and $0xf,%eax
1e: 3c 09 cmp $0x9,%al
20: 0f 84 ef 0a 00 00 je 0xb15
26: 0f b6 41 05 movzbl 0x5(%rcx),%eax
* 2a: 4c 89 44 24 18 mov %r8,0x18(%rsp) <-- trapping instruction
2f: 83 e0 07 and $0x7,%eax
32: 3c 03 cmp $0x3,%al
34: 0f 84 cc 03 00 00 je 0x406
3a: 3c 04 cmp $0x4,%al
3c: 0f .byte 0xf
3d: 84 .byte 0x84
3e: 05 .byte 0x5
3f: 03 .byte 0x3
Tested on:
commit: edc15184 usb: typec: hd3ss3220: Add support for supply..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=11e84a15580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec55b50193b453ea
dashboard link: https://syzkaller.appspot.com/bug?extid=a83a5a1ba9ff57935171
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
next parent reply other threads:[~2026-09-07 3:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <OSZPR01MB9313C6A272CD4ACAD2097CF0B2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 3:28 ` syzbot [this message]
[not found] <OSZPR01MB9313A6EAB14EA1A8E9C61EEBB2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 8:05 ` syzbot
[not found] <OSZPR01MB9313097803429A16EFC1BCCCB2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 5:00 ` syzbot
[not found] <OSZPR01MB9313EC5A624D7513F6801730B2B22@OSZPR01MB9313.jpnprd01.prod.outlook.com>
2026-09-07 4:24 ` syzbot
2026-08-17 11:04 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a9e2f43.a6639fcc.23b8b0.000f.GAE@google.com \
--to=syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tkdkei@outlook.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®