Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: INFO: task hung in hub_port_init
To:     Alan Stern <stern@rowland.harvard.edu>,
        Hao Sun <sunhao.th@gmail.com>, Shuah Khan <shuah@kernel.org>
Cc:     Greg KH <gregkh@linuxfoundation.org>, linux-usb@vger.kernel.org,
        a.darwish@linutronix.de, johan@kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        oneukum@suse.com, Shuah Khan <skhan@linuxfoundation.org>
References: <CACkBjsYQxQxGQwb3YS4obVWH3EODzqky5=nM3ADP7+13hBYgAA@mail.gmail.com>
 <20210913135459.GA120302@rowland.harvard.edu>
 <CACkBjsZcg0B=tF8cr54VqaJMVURD9R463epZqRQfesnoY=+L8g@mail.gmail.com>
 <20210918020245.GA69263@rowland.harvard.edu>
 <CACkBjsZPjO96NzLjKR2N7bYzBJRN6sPuaDpK6cvmGqKTd=Byow@mail.gmail.com>
 <20210918135301.GA79656@rowland.harvard.edu>
From:   Shuah Khan <skhan@linuxfoundation.org>
Message-ID: <2d776f5b-c6b5-1c05-de37-493fc10a97af@linuxfoundation.org>
Date:   Mon, 20 Sep 2021 08:31:08 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <20210918135301.GA79656@rowland.harvard.edu>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 9/18/21 7:53 AM, Alan Stern wrote:
> On Sat, Sep 18, 2021 at 10:17:26AM +0800, Hao Sun wrote:
>> Alan Stern <stern@rowland.harvard.edu> 于2021年9月18日周六 上午10:02写道：
>>>
>>> On Sat, Sep 18, 2021 at 09:56:52AM +0800, Hao Sun wrote:
>>>> Hi Alan,
>>>>
>>>> Alan Stern <stern@rowland.harvard.edu> 于2021年9月13日周一 下午9:55写道：
>>>>>
>>>>> On Mon, Sep 13, 2021 at 11:13:15AM +0800, Hao Sun wrote:
>>>>>> Hello,
>>>>>>
>>>>>> When using Healer to fuzz the Linux kernel, the following crash was triggered.
>>>>>>
>>>>>> HEAD commit: ac08b1c68d1b Merge tag 'pci-v5.15-changes'
>>>>>> git tree: upstream
>>>>>> console output:
>>>>>> https://drive.google.com/file/d/1ZeDIMe-DoY3fB32j2p5ifgpq-Lc5N74I/view?usp=sharing
>>>>>> kernel config: https://drive.google.com/file/d/1qrJUXD8ZIeAkg-xojzDpp04v9MtQ8RR6/view?usp=sharing
>>>>>> Syzlang reproducer:
>>>>>> https://drive.google.com/file/d/1tZe8VmXfxoPqlNpzpGOd-e5WCSWgbkxB/view?usp=sharing
>>>>>> Similar report:
>>>>>> https://groups.google.com/g/syzkaller-bugs/c/zX55CUzjBOY/m/uf91r0XqAgAJ
>>>>>>
>>>>>> Sorry, I don't have a C reproducer for this crash but have a Syzlang
>>>>>> reproducer. Also, hope the symbolized report can help.
>>>>>> Here are the instructions on how to execute Syzlang prog:
>>>>>> https://github.com/google/syzkaller/blob/master/docs/executing_syzkaller_programs.md
>>>>>>
>>>>>> If you fix this issue, please add the following tag to the commit:
>>>>>> Reported-by: Hao Sun <sunhao.th@gmail.com>
>>>>>
>>>>> There's not much hope of finding the cause of a problem like this
>>>>> without seeing the kernel log.
>>>>>
>>>>
>>>> Healer found another Syzlang prog to reproduce this task hang:
>>>> https://paste.ubuntu.com/p/HCNYbKJYtx/
>>>>
>>>> Also here is a very simple script to execute the reproducer:
>>>> https://paste.ubuntu.com/p/ZTGmvFSP6d/
>>>>
>>>> The `syz-execprog` and `syz-executor` are needed, so please build
>>>> Syzkaller first before running the script.
>>>> Hope this can help to find the root cause of the problem.
>>>
>>> I don't have time to install and figure out how to use Healer and
>>> Syzkaller.  But if you run the reproducer and post the kernel log,
>>> I'll take a look at it.
>>>
>>
>> Just executed the reproducer, here is the full log:
>> https://paste.ubuntu.com/p/x43SqQy8PX/
> 
> The log indicates that the problem is related to the vhci-hcd driver
> somehow.  I don't know why those "Module has invalid ELF structures"
> errors keep appearing, starting in line 1946 of the log.
> 
> Alan Stern
> 

Thank you. I will take a look.

thanks,
-- Shuah