* [syzbot] [usb?] general protection fault in keyspan_break_ctl
@ 2026-08-27 18:53 syzbot
2026-08-28 1:28 ` Forwarded: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv syzbot
2026-08-28 6:53 ` [syzbot] [usb?] general protection fault in keyspan_break_ctl Johan Hovold
0 siblings, 2 replies; 4+ messages in thread
From: syzbot @ 2026-08-27 18:53 UTC (permalink / raw)
To: gregkh, johan, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16ba2979580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=161f499e580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-818bebeb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6e4100526b12/vmlinux-818bebeb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/723c4783ee96/bzImage-818bebeb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
CPU: 2 UID: 0 PID: 6029 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608
Code: ff ff ff e8 54 ca 48 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41
RSP: 0018:ffffc900035b7cb0 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87c231ec
RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c
RBP: ffff88802f436000 R08: 0000000000000005 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888034d39020 R14: ffff888034d390c8 R15: 0000000000000000
FS: 0000555589f16500(0000) GS:ffff8880d5da2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5bac070000 CR3: 00000000584fe000 CR4: 0000000000352ef0
Call Trace:
<TASK>
serial_break+0xcb/0x160 drivers/usb/serial/usb-serial.c:538
send_break drivers/tty/tty_io.c:2458 [inline]
send_break+0x2ec/0x370 drivers/tty/tty_io.c:2441
tty_ioctl+0xa2c/0x1640 drivers/tty/tty_io.c:2733
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5bac19e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd93db7608 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5bac425fa0 RCX: 00007f5bac19e0d9
RDX: 0000000000000000 RSI: 0000000000005425 RDI: 0000000000000004
RBP: 00007f5bac235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5bac425fac R14: 00007f5bac425fa0 R15: 00007f5bac425fa0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608
Code: ff ff ff e8 54 ca 48 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41
RSP: 0018:ffffc900035b7cb0 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87c231ec
RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c
RBP: ffff88802f436000 R08: 0000000000000005 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888034d39020 R14: ffff888034d390c8 R15: 0000000000000000
FS: 0000555589f16500(0000) GS:ffff8880d5da2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5bac070000 CR3: 00000000584fe000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 2 bytes skipped:
0: ff ljmp (bad)
1: e8 54 ca 48 fa call 0xfa48ca5a
6: 83 fb ff cmp $0xffffffff,%ebx
9: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
10: fc ff df
13: 49 8d bc 24 9c 00 00 lea 0x9c(%r12),%rdi
1a: 00
1b: 0f 94 c3 sete %bl
1e: 48 89 fa mov %rdi,%rdx
21: 0f b6 db movzbl %bl,%ebx
24: 48 c1 ea 03 shr $0x3,%rdx
* 28: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2c: 48 89 f8 mov %rdi,%rax
2f: 83 e0 07 and $0x7,%eax
32: 83 c0 03 add $0x3,%eax
35: 38 d0 cmp %dl,%al
37: 7c 04 jl 0x3d
39: 84 d2 test %dl,%dl
3b: 75 1d jne 0x5a
3d: 41 rex.B
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 4+ messages in thread
* Forwarded: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv
2026-08-27 18:53 [syzbot] [usb?] general protection fault in keyspan_break_ctl syzbot
@ 2026-08-28 1:28 ` syzbot
2026-08-28 6:53 ` [syzbot] [usb?] general protection fault in keyspan_break_ctl Johan Hovold
1 sibling, 0 replies; 4+ messages in thread
From: syzbot @ 2026-08-28 1:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Add pr_info() calls in keyspan_break_ctl() and keyspan_port_remove()
to trace the lifetime of the per-port private data (p_priv) around
port removal. This is a debugging aid to confirm a suspected race
where a port is unbound (freeing p_priv) while a stale tty fd is
still open, leading to a NULL pointer dereference in
keyspan_break_ctl() when break_ctl is issued afterward.
Not for upstream inclusion - debug only.
Link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/usb/serial/keyspan.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 4d3746c7a94e..36626c0cc0a9 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -601,9 +601,9 @@ static int keyspan_break_ctl(struct tty_struct *tty, int break_state)
{
struct usb_serial_port *port = tty->driver_data;
struct keyspan_port_private *p_priv;
-
p_priv = usb_get_serial_port_data(port);
-
+ pr_info("keyspan: break_ctl port=%d p_priv=%px disconnected=%d\n",
+ port->port_number, p_priv, port->serial->disconnected);
if (break_state == -1)
p_priv->break_on = 1;
else
@@ -2975,7 +2975,8 @@ static void keyspan_port_remove(struct usb_serial_port *port)
int i;
p_priv = usb_get_serial_port_data(port);
-
+ pr_info("keyspan: port_remove port=%d freeing p_priv=%px\n",
+ port->port_number, p_priv);
usb_kill_urb(p_priv->inack_urb);
usb_kill_urb(p_priv->outcont_urb);
for (i = 0; i < 2; i++) {
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [usb?] general protection fault in keyspan_break_ctl
2026-08-27 18:53 [syzbot] [usb?] general protection fault in keyspan_break_ctl syzbot
2026-08-28 1:28 ` Forwarded: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv syzbot
@ 2026-08-28 6:53 ` Johan Hovold
1 sibling, 0 replies; 4+ messages in thread
From: Johan Hovold @ 2026-08-28 6:53 UTC (permalink / raw)
To: syzbot; +Cc: gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Thu, Aug 27, 2026 at 11:53:24AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16ba2979580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
> dashboard link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=161f499e580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-818bebeb.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6e4100526b12/vmlinux-818bebeb.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/723c4783ee96/bzImage-818bebeb.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
> CPU: 2 UID: 0 PID: 6029 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608
> Code: ff ff ff e8 54 ca 48 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41
> RSP: 0018:ffffc900035b7cb0 EFLAGS: 00010203
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87c231ec
> RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c
> RBP: ffff88802f436000 R08: 0000000000000005 R09: 00000000ffffffff
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> R13: ffff888034d39020 R14: ffff888034d390c8 R15: 0000000000000000
> FS: 0000555589f16500(0000) GS:ffff8880d5da2000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f5bac070000 CR3: 00000000584fe000 CR4: 0000000000352ef0
> Call Trace:
> <TASK>
> serial_break+0xcb/0x160 drivers/usb/serial/usb-serial.c:538
> send_break drivers/tty/tty_io.c:2458 [inline]
> send_break+0x2ec/0x370 drivers/tty/tty_io.c:2441
> tty_ioctl+0xa2c/0x1640 drivers/tty/tty_io.c:2733
> vfs_ioctl fs/ioctl.c:51 [inline]
And this is most likely the known issue I've promised to produce a patch
for:
https://lore.kernel.org/all/ZIGejjOfsWkwjB2s@hovoldconsulting.com/
I'll revisit the fix and post it now...
Johan
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [usb?] general protection fault in keyspan_break_ctl
[not found] <20260828012840.12003-1-kartikey406@gmail.com>
@ 2026-08-28 1:52 ` syzbot
0 siblings, 0 replies; 4+ messages in thread
From: syzbot @ 2026-08-28 1:52 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
0737418240 ms ovfl timer
[ 4.533726][ T1] kvm_amd: CPU 0 isn't AMD or Hygon
[ 4.533777][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x257a472b559, max_idle_ns: 440795210424 ns
[ 4.546396][ T1] clocksource: Switched to clocksource tsc
[ 4.591367][ T1] Initialise system trusted keyrings
[ 4.596578][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=20 bucket_order=0 (anon: 0)
[ 4.602197][ T1] DLM installed
[ 4.605411][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 4.611459][ T1] NFS: Registering the id_resolver key type
[ 4.611575][ T1] Key type id_resolver registered
[ 4.611583][ T1] Key type id_legacy registered
[ 4.611770][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 4.611848][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 4.614137][ T1] smbdirect: subsystem loading...
[ 4.619280][ T1] smbdirect: subsystem loaded
[ 4.655793][ T1] Key type cifs.spnego registered
[ 4.656089][ T1] Key type cifs.idmap registered
[ 4.659755][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 4.659769][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 4.660173][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 4.662629][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 4.662796][ T1] QNX4 filesystem 0.2.3 registered.
[ 4.662873][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 4.663840][ T1] fuse: init (API version 7.46)
[ 4.666275][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 4.666952][ T1] orangefs_init: module version upstream loaded
[ 4.668066][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 4.680640][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[ 4.697494][ T1] 9p: Installing v9fs 9p2000 file system support
[ 4.698237][ T1] NILFS version 2 loaded
[ 4.698245][ T1] befs: version: 0.9.3
[ 4.699153][ T1] ocfs2: Registered cluster interface o2cb
[ 4.699837][ T1] ocfs2: Registered cluster interface user
[ 4.700945][ T1] OCFS2 User DLM kernel interface loaded
[ 4.721036][ T1] gfs2: GFS2 installed
[ 4.735695][ T1] ceph: loaded (mds proto 32)
[ 4.751130][ T1] NET: Registered PF_ALG protocol family
[ 4.755936][ T1] async_tx: api initialized (async)
[ 4.757614][ T1] Key type asymmetric registered
[ 4.757659][ T1] Asymmetric key parser 'x509' registered
[ 4.757668][ T1] Asymmetric key parser 'pkcs8' registered
[ 4.757677][ T1] Key type pkcs7_test registered
[ 4.758462][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 4.759983][ T1] io scheduler mq-deadline registered
[ 4.759995][ T1] io scheduler kyber registered
[ 4.760450][ T1] io scheduler bfq registered
[ 4.762124][ T1] raid6: skipped pq benchmark and selected avx512x4
[ 4.831401][ T1] ACPI: \_SB_.GSIE: Enabled at IRQ 20
[ 4.840657][ T1] pcieport 0000:00:04.0: PME: Signaling with IRQ 25
[ 4.845928][ T1] pcieport 0000:00:04.0: AER: enabled with IRQ 26
[ 4.853866][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 4.861878][ T1] ACPI: button: Power Button [PWRF]
[ 5.205533][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 5.236632][ T1] ACPI: \_SB_.GSIF: Enabled at IRQ 21
[ 5.287166][ T1] ACPI: \_SB_.GSIH: Enabled at IRQ 23
[ 5.394772][ T410] kworker/u33:5 (410) used greatest stack depth: 26904 bytes left
[ 5.618133][ T1] N_HDLC line discipline registered with maxframe=4096
[ 5.618638][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 5.628392][ T1] 00:04: ttyS0 I/O:0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 5.666492][ T1] Non-volatile memory driver v1.3
[ 5.677041][ T1] usbcore: registered new interface driver xillyusb
[ 5.681588][ T1] ACPI: bus type drm_connector registered
[ 5.687468][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 5.688230][ T1] usbcore: registered new interface driver udl
[ 5.689052][ T1] [drm] pci: virtio-vga detected at 0000:00:01.0
[ 5.689126][ T1] virtio-pci 0000:00:01.0: vgaarb: deactivate vga console
[ 5.712847][ T1] Console: switching to colour dummy device 80x25
[ 5.714016][ T1] [drm] features: -virgl +edid -resource_blob -host_visibl
** replaying previous printk message **
[ 5.714016][ T1] [drm] features: -virgl +edid -resource_blob -host_visible
[ 5.714024][ T1] [drm] features: -context_init -blob_alignment
[ 5.720795][ T1] [drm] number of scanouts: 1
[ 5.720830][ T1] [drm] number of cap sets: 0
[ 5.723674][ T1] ------------[ cut here ]------------
[ 5.723682][ T1] [PLANE:36:plane-1] pixel format with alpha exposed but blend mode not setup
[ 5.723689][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0xfb4/0x1be0, CPU#3: swapper/0/1
[ 5.752112][ T1] Modules linked in:
[ 5.754097][ T1] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 5.759300][ T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 5.765067][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[ 5.768677][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d dc 0b 7e 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 51 a9 39 fc 48 8d
[ 5.781701][ T1] RSP: 0000:ffffc90000047908 EFLAGS: 00010246
[ 5.786225][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 5.791549][ T1] RDX: ffff888022b16a80 RSI: 0000000000000024 RDI: ffffffff915039a0
[ 5.796761][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[ 5.802379][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed10050cca23
[ 5.808023][ T1] R13: ffffed10050cca24 R14: 0000000000000001 R15: ffff888028665028
[ 5.813516][ T1] FS: 0000000000000000(0000) GS:ffff8880d5e69000(0000) knlGS:0000000000000000
[ 5.819373][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.823373][ T1] CR2: 0000000000000000 CR3: 000000000eb96000 CR4: 0000000000352ef0
[ 5.828276][ T1] Call Trace:
[ 5.830076][ T1] <TASK>
[ 5.831609][ T1] ? queue_work_on+0xf7/0x1e0
[ 5.833995][ T1] drm_dev_register+0x56e/0x7b0
[ 5.836779][ T1] ? aperture_remove_conflicting_pci_devices+0x138/0x1e0
[ 5.841510][ T1] virtio_gpu_probe+0x271/0x360
[ 5.844677][ T1] virtio_dev_probe+0x6a2/0xbe0
[ 5.847879][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 5.851682][ T1] ? kernfs_create_link+0x1bd/0x240
[ 5.855438][ T1] ? kernfs_put+0x3f/0x60
[ 5.858337][ T1] ? sysfs_do_create_link_sd+0xbb/0x140
[ 5.861896][ T1] ? sysfs_create_link+0x68/0xc0
[ 5.865146][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 5.869125][ T1] really_probe+0x241/0xa60
[ 5.872221][ T1] __driver_probe_device+0x210/0x460
[ 5.875556][ T1] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 5.879441][ T1] driver_probe_device+0x4a/0x140
[ 5.882613][ T1] __driver_attach+0x21f/0x5b0
[ 5.885544][ T1] ? __pfx___driver_attach+0x10/0x10
[ 5.889254][ T1] bus_for_each_dev+0x13e/0x1d0
[ 5.892667][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 5.896503][ T1] ? bus_add_driver+0x2b5/0x5b0
[ 5.899777][ T1] bus_add_driver+0x305/0x5b0
[ 5.902865][ T1] driver_register+0x1e2/0x360
[ 5.905606][ T1] ? __pfx_virtio_gpu_driver_init+0x10/0x10
[ 5.909247][ T1] virtio_gpu_driver_init+0xc9/0x170
[ 5.913026][ T1] do_one_initcall+0x11c/0x6f0
[ 5.916255][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 5.920145][ T1] ? kernel_init_freeable+0x4ca/0x7b0
[ 5.923843][ T1] kernel_init_freeable+0x6ea/0x7b0
[ 5.927728][ T1] ? __pfx_kernel_init+0x10/0x10
[ 5.931341][ T1] kernel_init+0x21/0x1e0
[ 5.934214][ T1] ? __pfx_kernel_init+0x10/0x10
[ 5.937631][ T1] ret_from_fork+0x730/0xd60
[ 5.940687][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 5.944325][ T1] ? __switch_to+0x800/0x10f0
[ 5.947527][ T1] ? __pfx_kernel_init+0x10/0x10
[ 5.950877][ T1] ret_from_fork_asm+0x1a/0x30
[ 5.954045][ T1] </TASK>
[ 5.956005][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 5.957489][ T1] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 5.957489][ T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 5.967407][ T1] Call Trace:
[ 5.967407][ T1] <TASK>
[ 5.967407][ T1] dump_stack_lvl+0x100/0x190
[ 5.967407][ T1] vpanic+0x553/0x970
[ 5.967407][ T1] ? __pfx_vpanic+0x10/0x10
[ 5.967407][ T1] panic+0xd1/0xe0
[ 5.967407][ T1] ? __pfx_panic+0x10/0x10
[ 5.967407][ T1] check_panic_on_warn.cold+0x19/0x34
[ 5.967407][ T1] ? drm_mode_config_validate+0xfb4/0x1be0
[ 5.997431][ T1] __warn.cold+0x191/0x318
[ 5.997431][ T1] __report_bug+0x30f/0x440
[ 5.997431][ T1] ? drm_mode_config_validate+0xfb4/0x1be0
[ 6.007541][ T1] ? __pfx___report_bug+0x10/0x10
[ 6.007541][ T1] ? __pfx___might_resched+0x10/0x10
[ 6.017426][ T1] ? schedule_timeout+0x161/0x280
[ 6.017426][ T1] report_bug_entry+0xe2/0x290
[ 6.017426][ T1] ? drm_mode_config_validate+0xfbb/0x1be0
[ 6.017426][ T1] handle_bug+0x1cd/0x2a0
[ 6.017426][ T1] exc_invalid_op+0x17/0x50
[ 6.017426][ T1] asm_exc_invalid_op+0x1a/0x20
[ 6.037494][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[ 6.037494][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d dc 0b 7e 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 51 a9 39 fc 48 8d
[ 6.047452][ T1] RSP: 0000:ffffc90000047908 EFLAGS: 00010246
[ 6.057557][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 6.057557][ T1] RDX: ffff888022b16a80 RSI: 0000000000000024 RDI: ffffffff915039a0
[ 6.067476][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[ 6.067476][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed10050cca23
[ 6.077450][ T1] R13: ffffed10050cca24 R14: 0000000000000001 R15: ffff888028665028
[ 6.087490][ T1] ? drm_mode_config_validate+0xf76/0x1be0
[ 6.087490][ T1] ? queue_work_on+0xf7/0x1e0
[ 6.087490][ T1] drm_dev_register+0x56e/0x7b0
[ 6.097451][ T1] ? aperture_remove_conflicting_pci_devices+0x138/0x1e0
[ 6.097451][ T1] virtio_gpu_probe+0x271/0x360
[ 6.097451][ T1] virtio_dev_probe+0x6a2/0xbe0
[ 6.107563][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 6.107563][ T1] ? kernfs_create_link+0x1bd/0x240
[ 6.117437][ T1] ? kernfs_put+0x3f/0x60
[ 6.117437][ T1] ? sysfs_do_create_link_sd+0xbb/0x140
[ 6.117437][ T1] ? sysfs_create_link+0x68/0xc0
[ 6.127500][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 6.127500][ T1] really_probe+0x241/0xa60
[ 6.127500][ T1] __driver_probe_device+0x210/0x460
[ 6.137430][ T1] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 6.137430][ T1] driver_probe_device+0x4a/0x140
[ 6.137430][ T1] __driver_attach+0x21f/0x5b0
[ 6.147409][ T1] ? __pfx___driver_attach+0x10/0x10
[ 6.147409][ T1] bus_for_each_dev+0x13e/0x1d0
[ 6.147409][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 6.157491][ T1] ? bus_add_driver+0x2b5/0x5b0
[ 6.157491][ T1] bus_add_driver+0x305/0x5b0
[ 6.157491][ T1] driver_register+0x1e2/0x360
[ 6.167427][ T1] ? __pfx_virtio_gpu_driver_init+0x10/0x10
[ 6.167427][ T1] virtio_gpu_driver_init+0xc9/0x170
[ 6.167427][ T1] do_one_initcall+0x11c/0x6f0
[ 6.177501][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 6.177501][ T1] ? kernel_init_freeable+0x4ca/0x7b0
[ 6.177501][ T1] kernel_init_freeable+0x6ea/0x7b0
[ 6.177501][ T1] ? __pfx_kernel_init+0x10/0x10
[ 6.177501][ T1] kernel_init+0x21/0x1e0
[ 6.197435][ T1] ? __pfx_kernel_init+0x10/0x10
[ 6.197435][ T1] ret_from_fork+0x730/0xd60
[ 6.197435][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 6.207486][ T1] ? __switch_to+0x800/0x10f0
[ 6.207486][ T1] ? __pfx_kernel_init+0x10/0x10
[ 6.207486][ T1] ret_from_fork_asm+0x1a/0x30
[ 6.217426][ T1] </TASK>
[ 6.217426][ T1] Kernel Offset: disabled
[ 6.217426][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1871275757=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 614e416a2c3
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=614e416a2c34ab81eb2b80817ccfa47c00429056 -X github.com/google/syzkaller/prog.gitRevisionDate=20260824-135806" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=614e416a2c34ab81eb2b80817ccfa47c00429056 -X github.com/google/syzkaller/prog.gitRevisionDate=20260824-135806" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=614e416a2c34ab81eb2b80817ccfa47c00429056 -X github.com/google/syzkaller/prog.gitRevisionDate=20260824-135806" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"614e416a2c34ab81eb2b80817ccfa47c00429056\"
/usr/bin/ld: /tmp/ccmsqNe1.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=10df3579580000
Tested on:
commit: 1b78070a Merge tag 'net-7.3-rc1' of git://git.kernel.o..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f
dashboard link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=13b8f415580000
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-28 6:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-27 18:53 [syzbot] [usb?] general protection fault in keyspan_break_ctl syzbot
2026-08-28 1:28 ` Forwarded: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv syzbot
2026-08-28 6:53 ` [syzbot] [usb?] general protection fault in keyspan_break_ctl Johan Hovold
[not found] <20260828012840.12003-1-kartikey406@gmail.com>
2026-08-28 1:52 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®