Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <b92fb04b-e28b-4c55-8891-61e6c3fc022f@gmail.com>
Date:   Tue, 8 Feb 2022 15:39:03 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [syzbot] WARNING in component_del
Content-Language: en-US
To:     syzbot <syzbot+60df062e1c41940cae0f@syzkaller.appspotmail.com>,
        dri-devel@lists.freedesktop.org, gregkh@linuxfoundation.org,
        linux-kernel@vger.kernel.org, rafael@kernel.org,
        syzkaller-bugs@googlegroups.com
References: <00000000000016f4ae05d5cec832@google.com>
 <0000000000001e4c2e05d77cfcbb@google.com>
 <YgJifE4GcWXS9p2H@phenom.ffwll.local>
From:   Pavel Skripkin <paskripkin@gmail.com>
In-Reply-To: <YgJifE4GcWXS9p2H@phenom.ffwll.local>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi Daniel,

On 2/8/22 15:30, Daniel Vetter wrote:
> On Mon, Feb 07, 2022 at 11:51:29PM -0800, syzbot wrote:
>> syzbot has found a reproducer for the following issue on:
>> 
>> HEAD commit:    555f3d7be91a Merge tag '5.17-rc3-ksmbd-server-fixes' of gi..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=130a0c2c700000

(*)

>> kernel config:  https://syzkaller.appspot.com/x/.config?x=266de9da75c71a45
>> dashboard link: https://syzkaller.appspot.com/bug?extid=60df062e1c41940cae0f
>> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15880d84700000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14de0c77b00000
>> 
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+60df062e1c41940cae0f@syzkaller.appspotmail.com
> 
>  From a quick grep usb seems to have indeed gained some component code, and
> I'm not aware of any drm usb drivers using component. So I think this is
> an usb issue, not a drm one.
> 

It looks like missing error handling. syzbot injected allocation failure 
inside component_add(), but usb_hub_create_port_device() just prints 
warn message in case of component_add() failure (see log (*))

And then calling component_del() on non-added item causes WARN_ON()

Can't prove my thoughts, since there is no repro :(


With regards,
Pavel Skripkin