Hi,
I see this on today's linux-next with notably KASAN and
DEBUG_TEST_DRIVER_REMOVE enabled:
[58.045441] hub 6-0:1.0: 1 port detected
[58.050894] xhci_hcd 0000:7a:02.0: remove, state 1
[58.055698] usb usb6: USB disconnect, device number 1
[58.063151] xhci_hcd 0000:7a:02.0: USB bus 6 deregistered
[58.068598] xhci_hcd 0000:7a:02.0: remove, state 1
[58.073396] usb usb5: USB disconnect, device number 1
[58.082040] xhci_hcd 0000:7a:02.0: USB bus 5 deregistered
[58.088446]
==================================================================
[58.095667] BUG: KASAN: use-after-free in usb_hcd_pci_remove+0xbc/0x168
[58.102272] Read of size 8 at addr ffff002a0b6e8120 by task swapper/0/1
[58.108875]
[58.110361] CPU: 2 PID: 1 Comm: swapper/0 Tainted: G
W5.8.0-next-20200813-dirty #31
[58.119396] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0
- V1.16.01 03/15/2019
[58.127910] Call trace:
[58.130351] dump_backtrace+0x0/0x2d0
[58.134005] show_stack+0x18/0x28
[58.137313] dump_stack+0xf4/0x168
[58.140709] print_address_description.constprop.12+0x6c/0x4ec
[58.146532] kasan_report+0x130/0x200
[58.150186] __asan_load8+0x9c/0xd8
[58.153666] usb_hcd_pci_remove+0xbc/0x168
[58.157755] xhci_pci_remove+0xb8/0x108
[58.161583] pci_device_remove+0x6c/0x138
[58.165586] really_probe+0x22c/0x640
[58.169240] driver_probe_device+0x78/0xe8
[58.173328] device_driver_attach+0x9c/0xa8
[58.177504] __driver_attach+0x74/0x120
[58.181331] bus_for_each_dev+0xec/0x160
[58.185245] driver_attach+0x34/0x48
[58.188812] bus_add_driver+0x1b8/0x2c0
[58.192639] driver_register+0xc0/0x1e0
[58.196467] __pci_register_driver+0xb4/0xd0
[58.200729] xhci_pci_init+0x60/0x70
[58.204297] do_one_initcall+0xd4/0x264
[58.208125] kernel_init_freeable+0x270/0x2d8
[58.212475] kernel_init+0x14/0x124
[58.215955] ret_from_fork+0x10/0x34
[58.216996] hub 1-1:1.0: USB hub found
[58.219519]
[58.219523] Allocated by task 13:
[58.219528] kasan_save_stack+0x28/0x58
[58.219538] __kasan_kmalloc.isra.6+0xcc/0xf0
[58.236219] kasan_kmalloc+0x10/0x20
[58.239786] __kmalloc+0x194/0x290
[58.243181] __usb_create_hcd+0x48/0x3a8
[58.247095] usb_create_hcd+0x1c/0x28
[58.250748] usb_hcd_pci_probe+0xa0/0x548
[58.254749] xhci_pci_probe+0x54/0x360
[58.258488] local_pci_probe+0x78/0xf8
[58.262230] work_for_cpu_fn+0x30/0x50
[58.265971] process_one_work+0x424/0x698
[58.269972] worker_thread+0x438/0x6d0
[58.273713] kthread+0x224/0x230
[58.276933] ret_from_fork+0x10/0x34
[58.280497]
[58.281978] Freed by task 1:
[58.284851] kasan_save_stack+0x28/0x58
[58.288677] kasan_set_track+0x28/0x40
[58.292418] kasan_set_free_info+0x24/0x48
[58.296505] __kasan_slab_free+0x104/0x188
[58.300593] kasan_slab_free+0x14/0x20
[58.304333] slab_free_freelist_hook+0x8c/0x190
[58.308855] kfree+0x2cc/0x400
[58.311901] usb_put_hcd+0xc0/0x110
[58.315381] usb_hcd_pci_remove+0xb4/0x168
[58.317397] hub 1-1:1.0: 4 ports detected
[58.319468] xhci_pci_remove+0xb8/0x108
[58.319473] pci_device_remove+0x6c/0x138
[58.319480] really_probe+0x22c/0x640
[58.334943] driver_probe_device+0x78/0xe8
[58.339031] device_driver_attach+0x9c/0xa8
[58.343205] __driver_attach+0x74/0x120
[58.347033] bus_for_each_dev+0xec/0x160
[58.350947] driver_attach+0x34/0x48
[58.354513] bus_add_driver+0x1b8/0x2c0
[58.358340] driver_register+0xc0/0x1e0
[58.362168] __pci_register_driver+0xb4/0xd0
[58.366429] xhci_pci_init+0x60/0x70
[58.369995] do_one_initcall+0xd4/0x264
[58.373823] kernel_init_freeable+0x270/0x2d8
[58.378171] kernel_init+0x14/0x124
[58.381651] ret_from_fork+0x10/0x34
[58.385215]
[58.386699] The buggy address belongs to the object at ffff002a0b6e8000
[58.386699] which belongs to the cache kmalloc-8k of size 8192
[58.399207] The buggy address is located 288 bytes inside of
[58.399207] 8192-byte region [ffff002a0b6e8000, ffff002a0b6ea000)
[58.411019] The buggy address belongs to the page:
[58.415803] page:0000000060c9fcec refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x2a0b6e8
[58.425272] head:0000000060c9fcec order:3 compound_mapcount:0
compound_pincount:0
[58.432746] flags: 0x2ffff00000010200(slab|head)
[58.437357] raw: 2ffff00000010200 dead000000000100 dead000000000122
ffff002a53c0f300
[58.445092] raw: 0000000000000000 0000000080020002 00000001ffffffff
0000000000000000
[58.452824] page dumped because: kasan: bad access detected
[58.458385]
[58.459867] Memory state around the buggy address:
[58.464649] ffff002a0b6e8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb
[58.471862] ffff002a0b6e8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb
[58.479074] >ffff002a0b6e8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb
[58.486284] ^
[58.490545] ffff002a0b6e8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb
[58.497758] ffff002a0b6e8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb
[58.504968]
==================================================================
[58.512179] Disabling lock debugging due to kernel taint
[58.519143] xhci_hcd 0000:7a:02.0: xHCI Host Controller
[58.524428] xhci_hcd 0000:7a:02.0: new USB bus registered, assigned bus
number 5
[58.532155] xhci_hcd 0000:7a:02.0: hcc params 0x0220f66d hci version
0x100 quirks 0x0000000000000010
[58.545434] hub 5-0:1.0: USB hub found
[58.549366] hub 5-0:1.0: 1 port detected
[58.554496] hub 5-0:1.0: USB hub found
[58.558406] hub 5-0:1.0: 1 port detected
[58.565161] hub 5-0:1.0: USB hub found
[58.569080] hub 5-0:1.0: 1 port detected
[58.574234] hub 5-0:1.0: USB hub found
[58.578419] hub 5-0:1.0: 1 port detected
[58.583849] xhci_hcd 0000:7a:02.0: xHCI Host Controller
[58.589112] xhci_hcd 0000:7a:02.0: new USB bus registered, assigned bus
number 6
[58.596755] xhci_hcd 0000:7a:02.0: Host supports USB 3.0 SuperSpeed
[58.603283] usb usb6: We don't know the algorithms for LPM for this
host, disabling LPM.
[58.614147] hub 6-0:1.0: USB hub found
[58.618068] hub 6-0:1.0: 1 port detected
[58.623291] hub 6-0:1.0: USB hub found
[58.627197] hub 6-0:1.0: 1 port detected
[58.633993] hub 6-0:1.0: USB hub found
[58.638412] hub 6-0:1.0: 1 port detected
[58.643593] hub 6-0:1.0: USB hub found
[58.647537] hub 6-0:1.0: 1 port detected
[58.654020] xhci_hcd 0000:ba:02.0: xHCI Host Controller
[58.659323] xhci_hcd 0000:ba:02.0: new USB bus registered, assigned bus
number 7
[58.667086] xhci_hcd 0000:ba:02.0: hcc params 0x0220f66d hci version
0x100 quirks 0x0000000000000010
[58.680638] hub 7-0:1.0: USB hub found
[58.684572] hub 7-0:1.0: 1 port detected
[58.689782] hub 7-0:1.0: USB hub found
[58.693700] hub 7-0:1.0: 1 port detected
[58.709559] hub 7-0:1.0: USB hub found
[58.713571] hub 7-0:1.0: 1 port detected
[58.718955] xhci_hcd 0000:ba:02.0: xHCI Host Controller
[58.724567] xhci_hcd 0000:ba:02.0: new USB bus registered, assigned bus
number 8
[58.731996] xhci_hcd 0000:ba:02.0: Hos.0: remove, state 1
[58.793746] usb usb8: USB disconnect, device number 1
[58.801364] xhci_hcd 0000:ba:02.0: USB bus 8 deregistered
[58.806815] xhci_hcd 0000:ba:02.0: remove, state 1
[58.811614] usb usb7: USB disconnect, device number 1
[58.820394] xhci_hcd 0000:ba:02.0: USB bus 7 deregistered
[58.826505] xhci_hcd 0000:ba:02.0: xHCI Host Controller
[58.831811] xhci_hcd 0000:ba:02.0: new USB bus registered, assigned bus
number 7
[58.839569] xhci_hcd 0000:ba:02.0: hcc params 0x0220f66d hci version
0x100 quirks 0x0000000000000010
[58.852983] hub 7-0:1.0: USB hub found
[58.856908] hub 7-0:1.0: 1 port detected
[58.862044] hub 7-0:1.0: USB hub found
[58.865959] hub 7-0:1.0: 1 port detected
[58.872577] hub 7-0:1.0: USB hub found
[58.876491] hub 7-0:1.0: 1 port detected
[58.881760] hub 7-0:1.0: USB hub found
[58.885678] hub 7-0:1.0: 1 port detected
[58.891037] xhci_hcd 0000:ba:02.0: xHCI Host Controller
[58.896550] xhci_hcd 0000:ba:02.0: new USB bus registered, assigned bus
number 8
[58.903968] xhci_hcd 0000:ba:02.0: Host supports USB 3.0 SuperSpeed
[58.910471] usb usb8: We don't know the algorithms for LPM for this
host, disabling LPM.
[58.921427] hub 8-0:1.0: USB hub found
[58.925533] hub 8-0:1.0: 1 port detected
[58.930781] hub 8-0:1.0: USB hub found
[58.934695] hub 8-0:1.0: 1 port detected
[58.941649] hub 8-0:1.0: USB hub found
[58.945728] hub 8-0:1.0: 1 port detected
[58.950967] hub 8-0:1.0: USB hub found
[58.954894] hub 8-0:1.0: 1 port detected
[58.961651] usbcore: registered new interface driver usb-storage
Ring any bells? I don't mind debugging the real issue, but good to know
it's not already solved. I didn't see anything on linux-usb archives,
apart from this:
https://lore.kernel.org/linux-usb/1566554761464.60146@xxxxxxxxxx/ which
doesn't look too familiar.
I couldn't recreate on v5.8, but this triggering this seems a bit
fragile even on linux-next.
Thanks,
john
