MIME-Version: 1.0
In-Reply-To: <Pine.LNX.4.44L0.1706071039530.1751-100000@iolanthe.rowland.org>
References: <CAAeHK+w5zgBWs-Hr2rn8ggNAjGv3soAzCZNyUSnucoPTBy=VcQ@mail.gmail.com>
 <Pine.LNX.4.44L0.1706071039530.1751-100000@iolanthe.rowland.org>
From: Andrey Konovalov <andreyknvl@google.com>
Date: Wed, 7 Jun 2017 17:15:42 +0200
Message-ID: <CAAeHK+xnHVNz_YfgMs4nGGDwJxZn8G1Y59gtY=UKVbZgPQb0xA@mail.gmail.com>
Subject: Re: usb/gadget: another GPF in usb_gadget_unregister_driver
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Felipe Balbi <balbi@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Peter Chen <peter.chen@nxp.com>,
        Krzysztof Opasiak <k.opasiak@samsung.com>,
        Colin Ian King <colin.king@canonical.com>,
        =?UTF-8?Q?Felix_H=C3=A4dicke?= <felixhaedicke@web.de>,
        Roger Quadros <rogerq@ti.com>, USB list <linux-usb@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Dmitry Vyukov <dvyukov@google.com>, Kostya Serebryany <kcc@google.com>,
        syzkaller <syzkaller@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1151
Lines: 36

On Wed, Jun 7, 2017 at 4:43 PM, Alan Stern <stern@rowland.harvard.edu> wrote:
> On Wed, 7 Jun 2017, Andrey Konovalov wrote:
>
>> Hi,
>>
>> I've got the following error report while fuzzing the kernel with syzkaller.
>>
>> On commit b29794ec95c6856b316c2295904208bf11ffddd9 (4.12-rc4+).
>>
>> This looks quite similar to
>> https://groups.google.com/forum/#!topic/syzkaller/HDawLBeeORI
>
> It does look very similar, but that problem was supposed to have been
> fixed by commit 7b0173811260 ("usb: gadget: udc: core: fix return code
> of usb_gadget_probe_driver()").
>
>> I'm able to reproduce this, so I can collect some debug traces if needed.
>
> Can you provide an strace or the equivalent?

Here's the syzkaller program (which is actually two programs executed
consequently):
https://gist.github.com/xairy/fe0a7531e00df5e8bc23e2e56e413510

Here's the strace log:
https://gist.github.com/xairy/5fadc3b5d8b2b80c97e566538de08bc4

Unfortunately there's a lot of unrelated garbage, but I can't extract
a simple C reproducer.

I can also apply patches with debug printk's, run the reproducer and
send you the result if that will help.

>
> Alan Stern
>