Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <00000000000001595b0592c41731@google.com> <Pine.LNX.4.44L0.1909181454300.1507-100000@iolanthe.rowland.org>
In-Reply-To: <Pine.LNX.4.44L0.1909181454300.1507-100000@iolanthe.rowland.org>
From:   Andrey Konovalov <andreyknvl@google.com>
Date:   Thu, 19 Sep 2019 17:19:12 +0200
Message-ID: <CAAeHK+xcJjE_+U7tTs76CkV1v95r8J+eKXhMj00iyrHA2cxGmA@mail.gmail.com>
Subject: Re: general protection fault in usb_set_interface
To:     Alan Stern <stern@rowland.harvard.edu>
Cc:     syzbot <syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Kai Heng Feng <kai.heng.feng@canonical.com>,
        LKML <linux-kernel@vger.kernel.org>,
        USB list <linux-usb@vger.kernel.org>, mans@mansr.com,
        Oliver Neukum <oneukum@suse.com>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Sep 18, 2019 at 8:57 PM Alan Stern <stern@rowland.harvard.edu> wrote:
>
> On Tue, 17 Sep 2019, syzbot wrote:
>
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer still triggered
> > crash:
> > WARNING in sysfs_remove_group
> >
> > ------------[ cut here ]------------
> > sysfs group 'power' not found for kobject 'radio0'
>
> Andrey:
>
> Is there any way to tell syzbot to run the reproducer but with only one
> device instance (that is, only one dummy-hcd bus)?
>
> Or can you a new, modified reproducer that will do this?

AFAIU there two bugs here and you've fixed the first one, but the
second one gets triggered.

I think the second one got reported separately here:

https://syzkaller.appspot.com/bug?extid=5b9bba68c833c84a1135

That one has a reproducer with a single dummy-hcd, so you can try
running your debugging patch against that report.

I'll see if I can run it manually in the meantime.