On Sat, Jun 08, 2024 at 09:41:04PM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-and-tested-by: syzbot+5f996b83575ef4058638@xxxxxxxxxxxxxxxxxxxxxxxxx > > Tested on: > > commit: 8867bbd4 mm: arm64: Fix the out-of-bounds issue in con.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git > console output: https://syzkaller.appspot.com/x/log.txt?x=11f0680a980000 > kernel config: https://syzkaller.appspot.com/x/.config?x=3b4350cf56c61c80 > dashboard link: https://syzkaller.appspot.com/bug?extid=5f996b83575ef4058638 > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > userspace arch: arm64 > patch: https://syzkaller.appspot.com/x/patch.diff?x=118743fc980000 > > Note: testing is done by a robot and is best-effort only. I'd like to determine the reason behind this entire class of bugs. As far as I can see, the design of dummy-hcd shouldn't allow them to occur. Alan Stern #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 8867bbd4a056 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -1826,6 +1826,7 @@ static void dummy_timer(struct timer_lis break; dum->ep[i].already_seen = 0; } + dev_info(dummy_dev(dum_hcd), "Timer handler\n"); restart: list_for_each_entry_safe(urbp, tmp, &dum_hcd->urbp_list, urbp_list) { @@ -1835,6 +1836,9 @@ restart: struct dummy_ep *ep = NULL; int status = -EINPROGRESS; + dev_info(dummy_dev(dum_hcd), "urbp %p %x next_frame %p\n", + urbp, urbp->urb->pipe, dum_hcd->next_frame_urbp); + /* stop when we reach URBs queued after the timer interrupt */ if (urbp == dum_hcd->next_frame_urbp) break;
