Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp2403646yba; Mon, 15 Apr 2019 10:52:51 -0700 (PDT) X-Google-Smtp-Source: APXvYqxJZkgCYPqhch4i3b5r42z2KsL6teVXIsWnbRinSJe7Plg4WUoFXr93yfICfAN/qWNpRk4m X-Received: by 2002:a17:902:8bca:: with SMTP id r10mr76664964plo.67.1555350771172; Mon, 15 Apr 2019 10:52:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1555350771; cv=none; d=google.com; s=arc-20160816; b=yZHq15WTF6dlxGAXr72BqEcPfzVOr52kI+vjXe7gpmrq4IFKEbXYd4OFkPqjB8xtOZ bRexcCQ6UlvcIgCiiMfdPShJnU3/K6PmIJjjbUabmjoE4lKltPH3w+sxIMcyMa5u0sum ygOd/X58egVSUSY2//5o9i2uNaWQHKtdSF8xpGjiXpop8mTUK3cU0lzbqmeIJSYlQVYy Ww3S/K7pHt5lsgsShIBWfWNkPaB6YvZ9+Rs0r+wVLlX8sQto3U51WnTKAP67O1AtYZXa 11vtc5hBfsGAllRnakr9DTYcCCQARAjjDKrQA34ZhnNIdiZtPbwS4BntCfU1/2GaKkP0 KREw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=9Dv+R0VL/bb+jQfziwn2QW1zo1nWTJgpQUXYmCc2ap4=; b=HFEvA5fsI+7506q08mi9az2FFmz8zm0hEYqccyYFl4bUHcJcv/y9+p50gbJCoJClAI SR4TjI8us6DimPXjmTqaZ5o+fOtcp1cNrhW4mO6PDR4pwAhFeSwmpunjOuCPmdONty5+ S/Th2JR8cuEsmQDAGASvwRp2gUCK/VP3A4axLTeiS3T2X6gUR3gtgQyVdmo4p9u5MaXm XkiFJV0+W12BAzh21zW2iilxIBTx+Qc4VML9lcPpNBv2kEddBGVjRVPO1gRv9sU0t/bN haIAqra17kA/Y3D0rTia/yn4WoKOnyZxtdDSishv5gqCTyFqWKkKRLVkhtNC0VSGT6SE Jrag== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b="ApHHfgv/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e6si37019690pgc.62.2019.04.15.10.52.35; Mon, 15 Apr 2019 10:52:51 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b="ApHHfgv/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727856AbfDORs3 (ORCPT + 99 others); Mon, 15 Apr 2019 13:48:29 -0400 Received: from mail-pl1-f195.google.com ([209.85.214.195]:35712 "EHLO mail-pl1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727490AbfDORs3 (ORCPT ); Mon, 15 Apr 2019 13:48:29 -0400 Received: by mail-pl1-f195.google.com with SMTP id w24so8938421plp.2 for ; Mon, 15 Apr 2019 10:48:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9Dv+R0VL/bb+jQfziwn2QW1zo1nWTJgpQUXYmCc2ap4=; b=ApHHfgv/brsFKSwRUyz8eNdWSjFtlZ9bNiUxkt0ycFqZT0cx7Y/xeGghp+2fEUlF04 ouZ9QvcWV+4ovzmtFoT961GYF1yUmC4yIWZ50XHsg99XypZYRl9GqOCeUaPCrjZOOirT EjIQtArdWE+HNSZiGgD1Gwgg53iym4wMFtRyl/qxR3Mk/t8umK6xQT4JCvL/OAmIOrHP 9arDv4lw325LlfASfzSw/39anUuyhn1E/k06PH2uAkzeJB2mwq+Gqpq+W8bq928RxDuf Igrp7nDkE8qBlrRXFkRDnw0HmDk3vfn+fPAUpPdUSmp7/MIYzImOzVdevIBYKhuw6X7U evCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9Dv+R0VL/bb+jQfziwn2QW1zo1nWTJgpQUXYmCc2ap4=; b=SLn66x9wEWEFMEtHFbrJzZ1REq1QUNIlLcqGyL5f7SVsWlrsGgjhpgMYEJl94m0Eqk vL0rPchEkFUqhAnCvBXmxsA1EKmdVmE0l169cJ8hquXZ6kngp4dFmrBBOoqfPBfgGFaa m3CLCt0nH8CHBu+OCDJtP0ANl7Ff3iRmiVYcPjViXNYdnX1hyNsLc+k2SNQYIOVGI4er LqE6Gz8JMkmei692OoSEeukQC//5uyxw47wSNZBHuZ4fRa45VxJRXrkIdFEnyyp00fv+ xkPYK+Tz1jw2AgYME+bqW30X2zChjaMETnhG+jkhmMM8agR9m4TkJnEkUxhh4bKQpXqw s42g== X-Gm-Message-State: APjAAAUZJEioYaNQ/JJNjLeEOAERy/H9iMs2eGW1Wb4irG/COln1noZS 1TJS1eBSsDVWZAFx0sJJzMl7SD6M8+sBfaGaFBJtyA== X-Received: by 2002:a17:902:b48c:: with SMTP id y12mr74860592plr.280.1555350507794; Mon, 15 Apr 2019 10:48:27 -0700 (PDT) MIME-Version: 1.0 References: <0000000000006f1596058653d991@google.com> In-Reply-To: From: Andrey Konovalov Date: Mon, 15 Apr 2019 19:48:16 +0200 Message-ID: Subject: Re: INFO: task hung in usb_kill_urb To: Alan Stern Cc: Greg Kroah-Hartman , gustavo@embeddedor.com, Kernel development list , USB list , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Apr 12, 2019 at 9:46 PM Alan Stern wrote: > > Andrey: > > It's really hard to tell just what's going on here. > > On Fri, 12 Apr 2019, syzbot wrote: > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver > > git tree: https://github.com/google/kasan/tree/usb-fuzzer > > console output: https://syzkaller.appspot.com/x/log.txt?x=14c4c1af200000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15 > > dashboard link: https://syzkaller.appspot.com/bug?extid=d919b0f29d7b5a4994b9 > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14410dbb200000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12f0acd3200000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+d919b0f29d7b5a4994b9@syzkaller.appspotmail.com > > > > usb-fuzzer-gadget dummy_udc.0: failed to start USB fuzzer: -22 > > usb-fuzzer-gadget dummy_udc.0: failed to start USB fuzzer: -22 > > usb-fuzzer-gadget dummy_udc.0: failed to start USB fuzzer: -22 > > usb-fuzzer-gadget dummy_udc.0: failed to start USB fuzzer: -22 > > usb-fuzzer-gadget dummy_udc.0: failed to start USB fuzzer: -22 > > INFO: task kworker/0:2:532 blocked for more than 143 seconds. > > Not tainted 5.1.0-rc4-319354-g9a33b36 #3 > > "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. > > kworker/0:2 D26656 532 2 0x80000000 > > Workqueue: usb_hub_wq hub_event > > Call Trace: > > schedule+0x8f/0x180 kernel/sched/core.c:3562 > > usb_kill_urb drivers/usb/core/urb.c:695 [inline] > > usb_kill_urb+0x22a/0x2c0 drivers/usb/core/urb.c:687 > > usb_start_wait_urb+0x257/0x4d0 drivers/usb/core/message.c:63 > > usb_internal_control_msg drivers/usb/core/message.c:101 [inline] > > usb_control_msg+0x321/0x4a0 drivers/usb/core/message.c:152 > > It looks like something is stuck waiting for usb_kill_urb() to finish. > But what happened before that? This crash is somewhat special. It happens quite often during USB fuzzing, but at the same time it's a hang, which makes it a bit harder debug. I initially thought that is somehow related to my custom USB fuzzing kernel patches, but then I saw that someone else hit this issue while doing USB fuzzing in a completely different way that doesn't require kernel modifications. So it might be an actual issue in the kernel. The full console output is provided by the syzbot, but I guess it's not very useful in this case. I've just made sure that this issue is manually reproducible, so we can easily retest it with debug patches (syzbot should be also able to do that via the syz test command). Or is there a way to turn on some verbose mode to see some USB debug messages? > > I can't tell from the reproducer source, because it uses a bunch of > special stuff you added in your usb-fuzzer tree. > > Alan Stern > I understand, for now I guess the simpler way to debug this is to run the reproducer. I'll write you and Greg a separate email regarding all that special stuff that I added. Thanks!