From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f171.google.com (mail-qk1-f171.google.com [209.85.222.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC5C23AF66E for ; Tue, 10 Mar 2026 15:50:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773157845; cv=none; b=K4B9IOmOqUNhjXNHni/fLVOHjLFzWW9RuCeOVrI2iZesA1HCovtBUQO8P7UPyNen4CZBcAaVcO3X3bAHUZJJtQQ/MGYDrhlwDMYDdMMABkAaFzNKcMDF/5OXMbT39OA0K5tSOa+UwJckca6RM42Y9cu4B68KCjwr4NmWIi2+llY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773157845; c=relaxed/simple; bh=U5IAlJjmuyP1FJjkQ89Qyux4pmW1nHt7YrbnA8H4NTA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=g+ohQdy5XGQxGiT59VxQcI8IIstzZeKiosWRd8MsywiqOYBojEYXSz2Rr/EolxvozEQkwbFJ9geMZxBaKfEOL/7jj+Z3w/bEo1d0592GnvvseugLuUggkz/HMknKjmjk2SQYNJfc4WVTE8rxEc4ba/QY2K4sCht68/GjJWCombc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rowland.harvard.edu; spf=fail smtp.mailfrom=g.harvard.edu; dkim=pass (2048-bit key) header.d=rowland.harvard.edu header.i=@rowland.harvard.edu header.b=o00uWd+i; arc=none smtp.client-ip=209.85.222.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rowland.harvard.edu Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=g.harvard.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rowland.harvard.edu header.i=@rowland.harvard.edu header.b="o00uWd+i" Received: by mail-qk1-f171.google.com with SMTP id af79cd13be357-8c70b5594f4so1250885a.1 for ; Tue, 10 Mar 2026 08:50:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rowland.harvard.edu; s=google; t=1773157841; x=1773762641; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=PW00xXFDqTiT4ZVobmj7fYCyD660Y8ptjDf6FEsjoAs=; b=o00uWd+isM7jOuVwUp+IjoqVGXIrtBbqLyRYBSMg0eh5xHq3UNsQ3voZYdfWQXdi4y PCpQwpOD6jFe6C3rbQ9E61DK5IrvIGtWAiHmQ6uh0/noNPB8Pyv30E99xeXOS2xZjJYq +sLoa4b6nMQBDEAyjJYWzuD8NgDr7ZUO2Kf6JHANdjTQ/iuPR4G5XO4M1yhr0F4ukBiY x0fgRm6ZGccv5/xpu57MVhIpBo4SXpDnsK8Ln7+UPqYwe+dEIQVlOf+N+M6rLKD/RSXb ajaT3BgLzxVvJk/m48s9oyITybu8N+GiI3jkLvh0QJGzo4sGv/niVo0oA1PfxdXCfQj2 3EvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773157841; x=1773762641; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=PW00xXFDqTiT4ZVobmj7fYCyD660Y8ptjDf6FEsjoAs=; b=iMmwBK/zl9UcVtCKnTRm2dzZTWjWf2wDHb+ej/sTu8bJJ5yuZuznWO38ecWI2Zjm+c b5/c1O1ym0eOzcklVB6SpeOI7CFNG9efdIiMpuLWwJLbSZg0W4t3nr9x9RUu3KZ2tvye z7Zcg4CwvOIQ1BAFPdfxL8iOH5ji0h/hKjncwjN4YyrJunhQhsCjCIjH4rxOWX/hIJSR I4mqQA7i0wI/Wzp8WBiUaL/Fh1sBnOkxvo48CnX6gnYbGOaDl7clQX/bSyiOweVCm8eC oP+94TO72945bKCaaQF0sLwHtPf3p5mwXwwhiGjUiUuimZVStoWmGTCMieyLkXJ3BKVm HmPg== X-Forwarded-Encrypted: i=1; AJvYcCWpL/anjQAGPnotT12T782zd1OswCs5hdyjyYYYpCiERxJf/sMCLZkA6d6Dvgn+zSi8+XQV4olNqnvAtEk=@vger.kernel.org X-Gm-Message-State: AOJu0YyGDTVY0pWauuBNDOlHPb9baBufa/Ul2wRKGiB+86nYAgxhlgui YRNKzAmKXMTVJm9Y/rk9yOxPFC6oUy6jRVeF9/7ZjeDKIRhMI1n4ZeKac8Lik4u9zg== X-Gm-Gg: ATEYQzxqhZhNa0gOWDSxB0Sq/Y2DuTXxRcpLPPNoNxRp4JBBg5llyGJ5HKG7fNk8zJY QO9hwwpAIP32kkOMYzTFUBPHj01HFJYubm108Bdq42TTPFXZ5UcWBcfVkITQHW1UtUQr5N/m5I3 wn7G5exDQz3D2kEJ/R8HBS9ibsbixelIMmLCVlEzIKBI7RQ0h0jFygVM5dwbXWSFBHBLTsTOgjq 2i7vdm0DV1TOW9kcP04SSJ5S9Aw/Upc71xZ9KQ840LfjUi4+nxCOJGiPk/9zKQjbbN2bbH8+hdh +jK87L5VHguerGuSu7GN4mhVViPgN8iI66SYp9Jt1WmxZPf+YqjXuiFPH7nO2nng/Awx2B3joNj 3ZwCvteCsNQRmWcm6NjPCZQwHTR1ryVKd4wrALmgHvptZW3nZetxDcUQSWLTAafsb8eJNLfps1Z LZSb24ZqL9+PKR4Fv7Xit0C0m7 X-Received: by 2002:a05:620a:4049:b0:8c7:3ff0:d472 with SMTP id af79cd13be357-8cd93b759fbmr442558585a.15.1773157840380; Tue, 10 Mar 2026 08:50:40 -0700 (PDT) Received: from rowland.harvard.edu ([2601:19b:d01:d210::687c]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8cd81aa2eefsm564736985a.42.2026.03.10.08.50.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Mar 2026 08:50:39 -0700 (PDT) Date: Tue, 10 Mar 2026 11:50:37 -0400 From: Alan Stern To: syzbot Cc: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [usb?] general protection fault in usb_gadget_udc_reset (4) Message-ID: References: <04861347-b659-4bcc-91d4-4319432c8ba6@rowland.harvard.edu> <69aeea85.050a0220.310d8.002a.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <69aeea85.050a0220.310d8.002a.GAE@google.com> On Mon, Mar 09, 2026 at 08:43:01AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in usb_gadget_udc_reset > > usb 2-1: reset high-speed USB device number 8 using dummy_hcd > usb 2-1: device descriptor read/8, error -32 > gadget gadget.1: Reset #1, gadget ffff888029d60c40 driver 0000000000000000 > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI That's helpful. And it turns out the reason that "raw-gadget.0" changes to "gadget" right before the crash is because the raw-gadget driver has been unbound, and when no driver is bound the dev_xxxx() calls use the bus-type name instead. An audit shows that the untimely driver unbinding occurs because of an error in synchronization. The code in dummy-hcd which emulates synchronize_irq() should run after the emulated interrupts are disabled, not before. That code needs to be moved from dummy_pullup() to dummy_udc_async_callbacks(). Let's see if this fixes the bug. Alan Stern #syz test: upstream 651690480a96 Index: usb-devel/drivers/usb/gadget/udc/core.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/core.c +++ usb-devel/drivers/usb/gadget/udc/core.c @@ -1197,7 +1197,9 @@ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); void usb_gadget_udc_reset(struct usb_gadget *gadget, struct usb_gadget_driver *driver) { + dev_info(&gadget->dev, "Reset #1, gadget %p driver %p\n", gadget, driver); driver->reset(gadget); + dev_info(&gadget->dev, "Reset #2\n"); usb_gadget_set_state(gadget, USB_STATE_DEFAULT); } EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -908,21 +908,6 @@ static int dummy_pullup(struct usb_gadge spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); - if (value == 0) { - /* - * Emulate synchronize_irq(): wait for callbacks to finish. - * This seems to be the best place to emulate the call to - * synchronize_irq() that's in usb_gadget_remove_driver(). - * Doing it in dummy_udc_stop() would be too late since it - * is called after the unbind callback and unbind shouldn't - * be invoked until all the other callbacks are finished. - */ - while (dum->callback_usage > 0) { - spin_unlock_irqrestore(&dum->lock, flags); - usleep_range(1000, 2000); - spin_lock_irqsave(&dum->lock, flags); - } - } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -945,6 +930,23 @@ static void dummy_udc_async_callbacks(st spin_lock_irq(&dum->lock); dum->ints_enabled = enable; + if (!enable) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * It has to come after dum->ints_enabled is clear. But + * doing it in dummy_udc_stop() would be too late since that + * routine is called after the unbind callback, and unbind + * shouldn't be invoked until all the other callbacks are + * finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irq(&dum->lock); + usleep_range(1000, 2000); + spin_lock_irq(&dum->lock); + } + } spin_unlock_irq(&dum->lock); }