Hello, syzbot tried to test the proposed patch but the build/boot failed: KASAN: null-ptr-deref Read in ida_free ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:71 [inline] BUG: KASAN: null-ptr-deref in test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] BUG: KASAN: null-ptr-deref in ida_free+0x1b6/0x2e0 lib/idr.c:510 Read of size 8 at addr 0000000000000000 by task syz-fuzzer/1284 CPU: 1 PID: 1284 Comm: syz-fuzzer Not tainted 5.18.0-rc5-syzkaller-00157-g97fa5887cf28-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_report mm/kasan/report.c:432 [inline] kasan_report.cold+0x61/0x1c6 mm/kasan/report.c:491 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] ida_free+0x1b6/0x2e0 lib/idr.c:510 dev_free+0xdb/0x6e0 drivers/usb/gadget/legacy/raw_gadget.c:209 kref_put include/linux/kref.h:65 [inline] raw_release+0x219/0x290 drivers/usb/gadget/legacy/raw_gadget.c:421 __fput+0x277/0x9d0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x1f7/0x200 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x49dfbb Code: e8 aa 4b fc ff eb 88 cc cc cc cc cc cc cc cc e8 bb 8f fc ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 RSP: 002b:000000c0002fb5f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 000000000049dfbb RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 RBP: 000000c0002fb630 R08: 0000000000000001 R09: 000000c0002fb650 R10: 000000c0002fb5dc R11: 0000000000000206 R12: 000000c0002fb5e8 R13: 0000000000203000 R14: 000000c0000001a0 R15: 00007f1aab9f437e </TASK> ================================================================== Warning: Permanently added '10.128.1.74' (ECDSA) to the list of known hosts. 2022/05/28 15:01:17 fuzzer started 2022/05/28 15:01:17 connecting to host at 10.128.0.163:44569 2022/05/28 15:01:17 checking machine... 2022/05/28 15:01:17 checking revisions... syzkaller login: [ 28.730807][ T1284] ================================================================== [ 28.732309][ T1284] BUG: KASAN: null-ptr-deref in ida_free+0x1b6/0x2e0 [ 28.733500][ T1284] Read of size 8 at addr 0000000000000000 by task syz-fuzzer/1284 [ 28.734813][ T1284] [ 28.735363][ T1284] CPU: 1 PID: 1284 Comm: syz-fuzzer Not tainted 5.18.0-rc5-syzkaller-00157-g97fa5887cf28-dirty #0 [ 28.737366][ T1284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.738920][ T1284] Call Trace: [ 28.739425][ T1284] <TASK> [ 28.739871][ T1284] dump_stack_lvl+0xcd/0x134 [ 28.740555][ T1284] kasan_report.cold+0x61/0x1c6 [ 28.741239][ T1284] ? ida_free+0x1b6/0x2e0 [ 28.741875][ T1284] kasan_check_range+0x13d/0x180 [ 28.742577][ T1284] ida_free+0x1b6/0x2e0 [ 28.743209][ T1284] ? ida_destroy+0x3b0/0x3b0 [ 28.743995][ T1284] ? rcu_read_lock_sched_held+0x3a/0x70 [ 28.744853][ T1284] ? kfree+0x36b/0x4f0 [ 28.745531][ T1284] dev_free+0xdb/0x6e0 [ 28.746110][ T1284] ? _raw_spin_unlock_irqrestore+0x38/0x70 [ 28.747069][ T1284] raw_release+0x219/0x290 [ 28.747719][ T1284] __fput+0x277/0x9d0 [ 28.748344][ T1284] ? gadget_unbind+0xd0/0xd0 [ 28.749014][ T1284] task_work_run+0xdd/0x1a0 [ 28.749693][ T1284] exit_to_user_mode_prepare+0x1f7/0x200 [ 28.750523][ T1284] syscall_exit_to_user_mode+0x19/0x60 [ 28.751641][ T1284] do_syscall_64+0x42/0xb0 [ 28.756063][ T1284] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 28.761951][ T1284] RIP: 0033:0x49dfbb [ 28.765827][ T1284] Code: e8 aa 4b fc ff eb 88 cc cc cc cc cc cc cc cc e8 bb 8f fc ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 28.785433][ T1284] RSP: 002b:000000c0002fb5f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 28.793837][ T1284] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 000000000049dfbb [ 28.801799][ T1284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 28.809765][ T1284] RBP: 000000c0002fb630 R08: 0000000000000001 R09: 000000c0002fb650 [ 28.817720][ T1284] R10: 000000c0002fb5dc R11: 0000000000000206 R12: 000000c0002fb5e8 [ 28.825672][ T1284] R13: 0000000000203000 R14: 000000c0000001a0 R15: 00007f1aab9f437e [ 28.833636][ T1284] </TASK> [ 28.836678][ T1284] ================================================================== [ 28.844826][ T1284] Kernel panic - not syncing: panic_on_warn set ... [ 28.851483][ T1284] CPU: 1 PID: 1284 Comm: syz-fuzzer Not tainted 5.18.0-rc5-syzkaller-00157-g97fa5887cf28-dirty #0 [ 28.862730][ T1284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.872864][ T1284] Call Trace: [ 28.876128][ T1284] <TASK> [ 28.879041][ T1284] dump_stack_lvl+0xcd/0x134 [ 28.883617][ T1284] panic+0x2d7/0x636 [ 28.887498][ T1284] ? panic_print_sys_info.part.0+0x10b/0x10b [ 28.893461][ T1284] ? ida_free+0x1b6/0x2e0 [ 28.897951][ T1284] end_report.part.0+0x3f/0x7c [ 28.902699][ T1284] kasan_report.cold+0x93/0x1c6 [ 28.907540][ T1284] ? ida_free+0x1b6/0x2e0 [ 28.911848][ T1284] kasan_check_range+0x13d/0x180 [ 28.916765][ T1284] ida_free+0x1b6/0x2e0 [ 28.921001][ T1284] ? ida_destroy+0x3b0/0x3b0 [ 28.925850][ T1284] ? rcu_read_lock_sched_held+0x3a/0x70 [ 28.931386][ T1284] ? kfree+0x36b/0x4f0 [ 28.935444][ T1284] dev_free+0xdb/0x6e0 [ 28.939501][ T1284] ? _raw_spin_unlock_irqrestore+0x38/0x70 [ 28.946270][ T1284] raw_release+0x219/0x290 [ 28.951563][ T1284] __fput+0x277/0x9d0 [ 28.955538][ T1284] ? gadget_unbind+0xd0/0xd0 [ 28.960121][ T1284] task_work_run+0xdd/0x1a0 [ 28.964752][ T1284] exit_to_user_mode_prepare+0x1f7/0x200 [ 28.970391][ T1284] syscall_exit_to_user_mode+0x19/0x60 [ 28.975939][ T1284] do_syscall_64+0x42/0xb0 [ 28.980357][ T1284] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 28.986259][ T1284] RIP: 0033:0x49dfbb [ 28.990166][ T1284] Code: e8 aa 4b fc ff eb 88 cc cc cc cc cc cc cc cc e8 bb 8f fc ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 29.009849][ T1284] RSP: 002b:000000c0002fb5f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 29.018247][ T1284] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 000000000049dfbb [ 29.026199][ T1284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 29.034157][ T1284] RBP: 000000c0002fb630 R08: 0000000000000001 R09: 000000c0002fb650 [ 29.042160][ T1284] R10: 000000c0002fb5dc R11: 0000000000000206 R12: 000000c0002fb5e8 [ 29.050128][ T1284] R13: 0000000000203000 R14: 000000c0000001a0 R15: 00007f1aab9f437e [ 29.058093][ T1284] </TASK> [ 29.061162][ T1284] Kernel Offset: disabled [ 29.065471][ T1284] Rebooting in 86400 seconds.. Tested on: commit: 97fa5887 USB: new quirk for Dell Gen 2 devices git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git kernel config: https://syzkaller.appspot.com/x/.config?x=d7b232ec3adf5c8d dashboard link: https://syzkaller.appspot.com/bug?extid=02b16343704b3af1667e compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 patch: https://syzkaller.appspot.com/x/patch.diff?x=10cc0d03f00000
