[syzbot] [wireguard?] WARNING in kthread_unpark (2)

48 views
Skip to first unread message

syzbot

unread,
May 11, 2024, 5:47:32 PM5/11/24
to Ja...@zx2c4.com, da...@davemloft.net, edum...@google.com, ku...@kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com, wire...@lists.zx2c4.com
Hello,

syzbot found the following issue on:

HEAD commit: 75fa778d74b7 Add linux-next specific files for 20240510
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13d483c0980000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccdd3ebd6715749a
dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ad9391835bcf/disk-75fa778d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d827b3da9a26/vmlinux-75fa778d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8f32f0182388/bzImage-75fa778d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+943d34...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525 [inline]
WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind kernel/kthread.c:538 [inline]
WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 kthread_unpark+0x16b/0x210 kernel/kthread.c:631
Modules linked in:

CPU: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.9.0-rc7-next-20240510-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: netns cleanup_net

RIP: 0010:__kthread_bind_mask kernel/kthread.c:525 [inline]
RIP: 0010:__kthread_bind kernel/kthread.c:538 [inline]
RIP: 0010:kthread_unpark+0x16b/0x210 kernel/kthread.c:631
Code: 00 fc ff df 41 0f b6 04 06 84 c0 0f 85 93 00 00 00 41 80 4d 03 04 4c 89 e7 48 8b 34 24 e8 bd c5 32 0a eb 09 e8 46 88 33 00 90 <0f> 0b 90 48 89 ef be 08 00 00 00 e8 75 43 99 00 f0 80 65 00 fb 4c
RSP: 0018:ffffc90000107758 EFLAGS: 00010293

RAX: ffffffff8162943a RBX: 0000000000000000 RCX: ffff8880172c3c00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88802e430800 R08: ffffffff816293c7 R09: 1ffffffff25f64cd
R10: dffffc0000000000 R11: fffffbfff25f64ce R12: 0000000000000001
R13: ffff8880296eda2c R14: 1ffff110052ddb45 R15: ffff8880296eda00
FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd40918ff8 CR3: 000000002e664000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kthread_stop+0x17a/0x630 kernel/kthread.c:707
destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810
wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257
netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693
default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769
ops_exit_list net/core/net_namespace.c:178 [inline]
cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,
Jul 29, 2024, 11:48:31 AM7/29/24
to Ja...@zx2c4.com, da...@davemloft.net, edum...@google.com, ja...@zx2c4.com, ku...@kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com, wire...@lists.zx2c4.com
syzbot has found a reproducer for the following issue on:

HEAD commit: dc1c8034e31b minmax: simplify min()/max()/clamp() implemen..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=100341c9980000
kernel config: https://syzkaller.appspot.com/x/.config?x=2258b49cd9b339fa
dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1022b573980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6699621c3baa/disk-dc1c8034.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/22380dec726f/vmlinux-dc1c8034.xz
kernel image: https://storage.googleapis.com/syzbot-assets/04c3f45e6e2d/bzImage-dc1c8034.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+943d34...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 53 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525 [inline]
WARNING: CPU: 0 PID: 53 at kernel/kthread.c:525 __kthread_bind kernel/kthread.c:538 [inline]
WARNING: CPU: 0 PID: 53 at kernel/kthread.c:525 kthread_unpark+0x16b/0x210 kernel/kthread.c:631
Modules linked in:
CPU: 0 UID: 0 PID: 53 Comm: kworker/u8:3 Not tainted 6.11.0-rc1-syzkaller-00004-gdc1c8034e31b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: netns cleanup_net

RIP: 0010:__kthread_bind_mask kernel/kthread.c:525 [inline]
RIP: 0010:__kthread_bind kernel/kthread.c:538 [inline]
RIP: 0010:kthread_unpark+0x16b/0x210 kernel/kthread.c:631
Code: 00 fc ff df 41 0f b6 04 06 84 c0 0f 85 93 00 00 00 41 80 4d 03 04 4c 89 e7 48 8b 34 24 e8 ad f7 56 0a eb 09 e8 06 a0 33 00 90 <0f> 0b 90 48 89 ef be 08 00 00 00 e8 c5 b5 97 00 f0 80 65 00 fb 4c
RSP: 0018:ffffc90000bd7760 EFLAGS: 00010293

RAX: ffffffff815fe27a RBX: 0000000000000000 RCX: ffff888015f90000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88801fcd8200 R08: ffffffff815fe207 R09: 1ffffffff269d71e
R10: dffffc0000000000 R11: fffffbfff269d71f R12: 0000000000000001
R13: ffff888029c75a2c R14: 1ffff1100538eb45 R15: ffff888029c75a00
FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc23f437d60 CR3: 000000007e72a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kthread_stop+0x17a/0x630 kernel/kthread.c:707
destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5793
wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257
netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10753
default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11889
ops_exit_list net/core/net_namespace.c:178 [inline]
cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Hillf Danton

unread,
Jul 30, 2024, 6:22:18 AM7/30/24
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, 29 Jul 2024 08:48:30 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: dc1c8034e31b minmax: simplify min()/max()/clamp() implemen..
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1022b573980000

#syz test upstream dc1c8034e31b

--- x/kernel/workqueue.c
+++ y/kernel/workqueue.c
@@ -2679,7 +2679,8 @@ static void worker_attach_to_pool(struct
worker->flags |= WORKER_UNBOUND;
} else {
WARN_ON_ONCE(pool->flags & POOL_BH);
- kthread_set_per_cpu(worker->task, pool->cpu);
+ if (!worker->rescue_wq)
+ kthread_set_per_cpu(worker->task, pool->cpu);
}

if (worker->rescue_wq)
--

syzbot

unread,
Jul 30, 2024, 7:00:06 AM7/30/24
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in corrupted

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P5301
} 2655 jiffies s: 7261 root: 0x0/T
rcu: blocking rcu_node structures (internal RCU debug):



Tested on:

commit: dc1c8034 minmax: simplify min()/max()/clamp() implemen..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1547f655980000
kernel config: https://syzkaller.appspot.com/x/.config?x=2258b49cd9b339fa
dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=136148d3980000

Hillf Danton

unread,
Jul 30, 2024, 7:30:49 AM7/30/24
to syzbot, Tejun Heo, Thomas Gleixner, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, 29 Jul 2024 08:48:30 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: dc1c8034e31b minmax: simplify min()/max()/clamp() implemen..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=100341c9980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2258b49cd9b339fa
> dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1022b573980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/6699621c3baa/disk-dc1c8034.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/22380dec726f/vmlinux-dc1c8034.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/04c3f45e6e2d/bzImage-dc1c8034.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+943d34...@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 53 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525 [inline]
> WARNING: CPU: 0 PID: 53 at kernel/kthread.c:525 __kthread_bind kernel/kthread.c:538 [inline]
> WARNING: CPU: 0 PID: 53 at kernel/kthread.c:525 kthread_unpark+0x16b/0x210 kernel/kthread.c:631

This warning looks bogus to me since a running workqueue rescuer could not
have a state with TASK_PARKED set.

Hillf Danton

unread,
Jul 31, 2024, 7:05:17 AM7/31/24
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, 29 Jul 2024 08:48:30 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: dc1c8034e31b minmax: simplify min()/max()/clamp() implemen..
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1022b573980000

#syz test upstream dc1c8034e31b

--- x/kernel/workqueue.c
+++ y/kernel/workqueue.c
@@ -2679,7 +2679,8 @@ static void worker_attach_to_pool(struct
worker->flags |= WORKER_UNBOUND;
} else {
WARN_ON_ONCE(pool->flags & POOL_BH);
- kthread_set_per_cpu(worker->task, pool->cpu);
+ if (!worker->rescue_wq)
+ kthread_set_per_cpu(worker->task, pool->cpu);
}

if (worker->rescue_wq)
--- x/drivers/input/misc/yealink.c
+++ y/drivers/input/misc/yealink.c
@@ -438,6 +438,8 @@ static void urb_irq_callback(struct urb

yealink_do_idle_tasks(yld);

+ if (status == -EPROTO)
+ return;
if (!yld->shutdown) {
ret = usb_submit_urb(yld->urb_ctl, GFP_ATOMIC);
if (ret && ret != -EPERM)
@@ -452,9 +454,12 @@ static void urb_ctl_callback(struct urb
struct yealink_dev *yld = urb->context;
int ret = 0, status = urb->status;

- if (status)
+ if (status) {
dev_err(&yld->intf->dev, "%s - urb status %d\n",
__func__, status);
+ if (status == -EPROTO)
+ return;
+ }

switch (yld->ctl_data->cmd) {
case CMD_KEYPRESS:
--

syzbot

unread,
Jul 31, 2024, 7:29:04 AM7/31/24
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+943d34...@syzkaller.appspotmail.com
Tested-by: syzbot+943d34...@syzkaller.appspotmail.com

Tested on:

commit: dc1c8034 minmax: simplify min()/max()/clamp() implemen..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1264b511980000
kernel config: https://syzkaller.appspot.com/x/.config?x=2258b49cd9b339fa
dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10fe9911980000

Note: testing is done by a robot and is best-effort only.

syzbot

unread,
Aug 12, 2024, 12:53:04 AM8/12/24
to Ja...@zx2c4.com, da...@davemloft.net, edum...@google.com, gre...@linuxfoundation.org, hda...@sina.com, ja...@zx2c4.com, ku...@kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, one...@suse.com, pab...@redhat.com, st...@rowland.harvard.edu, syzkall...@googlegroups.com, tg...@linutronix.de, t...@kernel.org, wire...@lists.zx2c4.com
syzbot has bisected this issue to:

commit b3e40fc85735b787ce65909619fcd173107113c2
Author: Oliver Neukum <one...@suse.com>
Date: Thu May 2 11:51:40 2024 +0000

USB: usb_parse_endpoint: ignore reserved bits

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11ca267d980000
start commit: dc1c8034e31b minmax: simplify min()/max()/clamp() implemen..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=13ca267d980000
console output: https://syzkaller.appspot.com/x/log.txt?x=15ca267d980000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1022b573980000

Reported-by: syzbot+943d34...@syzkaller.appspotmail.com
Fixes: b3e40fc85735 ("USB: usb_parse_endpoint: ignore reserved bits")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Frederic Weisbecker

unread,
Sep 11, 2024, 8:04:33 AM9/11/24
to syzbot, hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com, Thomas Gleixner, Tejun Heo
The problem is in the kthread code. kthread_stop() seem to assume that
the target is parked and since kthread_stop() is seldom called on per-cpu
kthreads (smpboot_unregister_percpu_thread() doesn't have any user yet), this
went unnoticed until workqueue happened to do it.

Can you test the following?
---
From: Frederic Weisbecker <fred...@kernel.org>
Date: Tue, 10 Sep 2024 22:10:19 +0200
Subject: [PATCH] kthread: Unpark only parked kthreads

Calling into kthread unparking unconditionally is mostly harmless when
the kthread is already unparked. The wake up is then simply ignored
because the target is not in TASK_PARKED state.

However if the kthread is per CPU, the wake up is preceded by a call
to kthread_bind() which expects the task to be inactive and in
TASK_PARKED state, which obviously isn't the case if it is unparked.

As a result, calling kthread_stop() on an unparked per-cpu kthread
triggers such a warning:

WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525
<TASK>
kthread_stop+0x17a/0x630 kernel/kthread.c:707
destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810
wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257
netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693
default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769
ops_exit_list net/core/net_namespace.c:178 [inline]
cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Fix this with skipping unecessary unparking while stopping a kthread.

Reported-by: syzbot+943d34...@syzkaller.appspotmail.com
Suggested-by: Thomas Gleixner <tg...@linutronix.de>
Signed-off-by: Frederic Weisbecker <fred...@kernel.org>
---
kernel/kthread.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/kernel/kthread.c b/kernel/kthread.c
index f7be976ff88a..5e2ba556aba8 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -623,6 +623,8 @@ void kthread_unpark(struct task_struct *k)
{
struct kthread *kthread = to_kthread(k);

+ if (!test_bit(KTHREAD_SHOULD_PARK, &kthread->flags))
+ return;
/*
* Newly created kthread was parked when the CPU was offline.
* The binding was lost and we need to set it again.
--
2.46.0

Hillf Danton

unread,
Sep 12, 2024, 7:31:08 AM9/12/24
to Frederic Weisbecker, syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com, Thomas Gleixner, Tejun Heo
On Wed, 11 Sep 2024 14:04:28 +0200 Frederic Weisbecker <fred...@kernel.org>
>
> Can you test the following?
> ---

One line is needed to feed syzbot including four parts, see below for an example
two keywords tree tag or commit
syz test upstream master
#syz test upstream master

--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -623,6 +623,8 @@ void kthread_unpark(struct task_struct *

syzbot

unread,
Sep 12, 2024, 10:26:04 AM9/12/24
to fred...@kernel.org, hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com, tg...@linutronix.de, t...@kernel.org
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in corrupted

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: {
P5320
} 3518 jiffies s: 7245 root: 0x0/T


Tested on:

commit: 77f58789 Merge tag 'arm-fixes-6.11-3' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1533b100580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9e236c2f9e028b26
dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1663e49f980000

Hillf Danton

unread,
Sep 13, 2024, 8:11:26 AM9/13/24
to Frederic Weisbecker, syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com, Thomas Gleixner, Tejun Heo
Test Frederic's idea.

#syz test upstream master

--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -623,6 +623,8 @@ void kthread_unpark(struct task_struct *
{
struct kthread *kthread = to_kthread(k);

+ if (!test_bit(KTHREAD_SHOULD_PARK, &kthread->flags))
+ return;
/*
* Newly created kthread was parked when the CPU was offline.
* The binding was lost and we need to set it again.
--- l/drivers/input/misc/yealink.c
+++ y/drivers/input/misc/yealink.c
@@ -438,7 +438,7 @@ static void urb_irq_callback(struct urb

yealink_do_idle_tasks(yld);

- if (!yld->shutdown) {
+ if (!yld->shutdown && status != -EPROTO) {
ret = usb_submit_urb(yld->urb_ctl, GFP_ATOMIC);
if (ret && ret != -EPERM)
dev_err(&yld->intf->dev,
@@ -460,13 +460,13 @@ static void urb_ctl_callback(struct urb
case CMD_KEYPRESS:
case CMD_SCANCODE:
/* ask for a response */
- if (!yld->shutdown)
+ if (!yld->shutdown && status != -EPROTO)
ret = usb_submit_urb(yld->urb_irq, GFP_ATOMIC);
break;
default:
/* send new command */
yealink_do_idle_tasks(yld);
- if (!yld->shutdown)
+ if (!yld->shutdown && status != -EPROTO)
ret = usb_submit_urb(yld->urb_ctl, GFP_ATOMIC);
break;
}
--

Frederic Weisbecker

unread,
Sep 13, 2024, 8:31:57 AM9/13/24
to Hillf Danton, syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com, Thomas Gleixner, Tejun Heo
Le Fri, Sep 13, 2024 at 08:11:09PM +0800, Hillf Danton a écrit :
> Test Frederic's idea.
>
> #syz test upstream master

Thanks!

>
> --- a/kernel/kthread.c
> +++ b/kernel/kthread.c
> @@ -623,6 +623,8 @@ void kthread_unpark(struct task_struct *
> {
> struct kthread *kthread = to_kthread(k);
>
> + if (!test_bit(KTHREAD_SHOULD_PARK, &kthread->flags))
> + return;
> /*
> * Newly created kthread was parked when the CPU was offline.
> * The binding was lost and we need to set it again.

But are the following bits deliberate?

syzbot

unread,
Sep 13, 2024, 8:38:04 AM9/13/24
to fred...@kernel.org, hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com, tg...@linutronix.de, t...@kernel.org
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+943d34...@syzkaller.appspotmail.com
Tested-by: syzbot+943d34...@syzkaller.appspotmail.com

Tested on:

commit: 196145c6 Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11ce10a9980000
kernel config: https://syzkaller.appspot.com/x/.config?x=9e236c2f9e028b26
dashboard link: https://syzkaller.appspot.com/bug?extid=943d34fa3cf2191e3068
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=126610a9980000

Hillf Danton

unread,
Sep 13, 2024, 8:49:01 AM9/13/24
to Frederic Weisbecker, syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com, Thomas Gleixner, Tejun Heo
On Fri, 13 Sep 2024 14:31:52 +0200 Frederic Weisbecker <fred...@kernel.org>
> Le Fri, Sep 13, 2024 at 08:11:09PM +0800, Hillf Danton a écrit :
>
> But are the following bits deliberate?
>
It is added to kill rcu stall [1,2] and win Tested-by.

[1] https://lore.kernel.org/lkml/000000000000e6...@google.com/
[2] https://lore.kernel.org/lkml/0000000000008d...@google.com/

Frederic Weisbecker

unread,
Sep 13, 2024, 9:16:54 AM9/13/24
to syzbot, hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com, tg...@linutronix.de, t...@kernel.org
Le Fri, Sep 13, 2024 at 05:38:02AM -0700, syzbot a écrit :
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+943d34...@syzkaller.appspotmail.com
> Tested-by: syzbot+943d34...@syzkaller.appspotmail.com

Thanks! I'm cooking an updated patch with those tags.
Reply all
Reply to author
Forward
0 new messages