From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751726AbcLEMUo (ORCPT <rfc822;w@1wt.eu>);
        Mon, 5 Dec 2016 07:20:44 -0500
Received: from mail-wm0-f43.google.com ([74.125.82.43]:38419 "EHLO
        mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750951AbcLEMUm (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 5 Dec 2016 07:20:42 -0500
MIME-Version: 1.0
In-Reply-To: <6c5b6bf0-207f-2bba-35ff-c6c04017d158@web.de>
References: <CAAeHK+xNM+D8O-2x2BMnbessbFQgoJC-hs4a+2mWec2JhdXoAg@mail.gmail.com>
 <6c5b6bf0-207f-2bba-35ff-c6c04017d158@web.de>
From: Andrey Konovalov <andreyknvl@google.com>
Date: Mon, 5 Dec 2016 13:20:39 +0100
Message-ID: <CAAeHK+ydhL1wpTq-5AZp+VJD02sueFOwH4Do6YutOLvbbrwXJA@mail.gmail.com>
Subject: Re: usb/gadget: GPF in usb_gadget_unregister_driver
To: =?UTF-8?Q?Felix_H=C3=A4dicke?= <felixhaedicke@web.de>
Cc: linux-usb@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
        Felipe Balbi <balbi@kernel.org>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id uB5CKm0g022988

On Sat, Dec 3, 2016 at 6:31 PM, Felix Hädicke <felixhaedicke@web.de> wrote:
> Hi,
>> Hi!
>>
>> I've got the following error report while running the syzkaller fuzzer.
>>
>> On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2).
>>
>> general protection fault: 0000 [#1] SMP KASAN
>> Dumping ftrace buffer:
>>    (ftrace buffer empty)
>> Modules linked in:
>> CPU: 0 PID: 10564 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #4
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> task: ffff88006cd0db40 task.stack: ffff88006a050000
>> RIP: 0010:[<ffffffff8201aa9e>]  [<ffffffff8201aa9e>]
>> __list_del_entry+0xce/0x280 lib/list_debug.c:57
>> RSP: 0018:ffff88006a056ea8  EFLAGS: 00010246
>> RAX: dffffc0000000000 RBX: 1ffff1000d40add6 RCX: ffffffff860ceac8
>> RDX: 0000000000000000 RSI: ffff88006cd0e340 RDI: ffffffff860cead0
>> RBP: ffff88006a056f38 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000006 R11: 0000000000000000 R12: 0000000000000000
>> R13: 0000000000000000 R14: ffffffff860cea00 R15: ffff88006a056f10
>> FS:  0000000000000000(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 000000002000d000 CR3: 0000000005c1d000 CR4: 00000000000006f0
>> Stack:
>>  ffffffff859785e0 0000000041b58ab3 ffffffff8593717a ffffffff8201a9d0
>>  1ffff1000d40ade0 ffff88006cd0db40 ffffffff817e5a3c ffff88006cd0e338
>>  0000000000000a06 1ffff1000d40ade4 ffff88006cd0e340 0000000000000000
>> Call Trace:
>>  [<ffffffff8201ac5d>] list_del+0xd/0x70 lib/list_debug.c:77
>>  [<ffffffff830ebf80>] usb_gadget_unregister_driver+0x120/0x240
>> drivers/usb/gadget/udc/core.c:1365
>>  [<ffffffff832245d0>] dev_release+0x80/0x160
>> drivers/usb/gadget/legacy/inode.c:1187
>>  [<ffffffff81805852>] __fput+0x332/0x7f0 fs/file_table.c:208
>>  [<ffffffff81805d95>] ____fput+0x15/0x20 fs/file_table.c:244
>>  [<ffffffff81338b9b>] task_work_run+0x19b/0x270 kernel/task_work.c:116
>>  [<     inline     >] exit_task_work include/linux/task_work.h:21
>>  [<ffffffff812c7eca>] do_exit+0x16aa/0x2530 kernel/exit.c:828
>>  [<ffffffff812cd749>] do_group_exit+0x149/0x420 kernel/exit.c:932
>>  [<ffffffff812faa9d>] get_signal+0x76d/0x17b0 kernel/signal.c:2307
>>  [<ffffffff811cfee2>] do_signal+0xd2/0x2120 arch/x86/kernel/signal.c:807
>>  [<ffffffff81003d00>] exit_to_usermode_loop+0x170/0x200
>> arch/x86/entry/common.c:156
>>  [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190
>>  [<ffffffff81007293>] syscall_return_slowpath+0x3d3/0x420
>> arch/x86/entry/common.c:259
>>  [<ffffffff84f47f62>] entry_SYSCALL_64_fastpath+0xc0/0xc2
>> Code: c5 0f 84 e2 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f
>> 84 ec 00 00 00 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
>> 3c 02 00 0f 85 35 01 00 00 4d 8b 04 24 49 39 c8 0f 85 e1 00
>> RIP  [<ffffffff8201aa9e>] __list_del_entry+0xce/0x280 lib/list_debug.c:57
>>  RSP <ffff88006a056ea8>
>> ---[ end trace 883f708e6720200f ]---
>> Kernel panic - not syncing: Fatal exception
>> Dumping ftrace buffer:
>>    (ftrace buffer empty)
>> Kernel Offset: disabled
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-usb" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
> Looks similar to the oops which I had reported a few days ago. See mail
> "PROBLEM: Oops when unbinding an inactive gadget configfs configuration
> from UDC". Maybe you want to test my bugfix proposal "usb: gadget: udc:
> core: fix return code of usb_gadget_probe_driver()".

Hi Felix,

Looks quite similar, but your patch doesn't help in my case.

Thanks!

>
> Regards,
> Felix
>