BUG: corrupted list in usb_hcd_link_urb_to_ep (5)

Status: upstream: reported C repro on 2025/10/30 15:20
Subsystems: usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+e69c25cf38a53d0cf64c@syzkaller.appspotmail.com
First crash: 331d, last: 1d17h
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
fbc76818 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ✅ ❓ BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 2026/05/21 09:23 2026/05/21 09:23 2026/05/21 10:18 cf874a1c
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [usb?] BUG: corrupted list in usb_hcd_link_urb_to_ep (5) 5 (13) 2026/07/09 09:53
[PATCH] Input: cm109 - fix URB double-submit due to missing open check 1 (1) 2026/07/09 07:31
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: corrupted list in usb_hcd_link_urb_to_ep (4) usb 8 syz 7 484d 578d 0/29 auto-obsoleted due to no activity on 2025/09/02 03:21
upstream BUG: corrupted list in usb_hcd_link_urb_to_ep usb 8 1 2260d 2260d 0/29 auto-closed as invalid on 2020/11/11 04:30
upstream BUG: corrupted list in usb_hcd_link_urb_to_ep (2) usb 8 syz, C error error 2 1032d 1700d 0/29 auto-obsoleted due to no activity on 2024/03/02 17:43
upstream BUG: corrupted list in usb_hcd_link_urb_to_ep (3) usb 8 1 840d 836d 0/29 auto-obsoleted due to no activity on 2024/08/31 17:07
▶ ▼ Last patch testing requests (15)
Created Duration User Patch Repo Result
2026/09/07 15:06 18m retest repro upstream no crash job log log
2026/09/07 15:06 18m retest repro upstream report job log log
2026/09/07 15:06 21m retest repro upstream report job log log
2026/09/07 15:06 18m retest repro upstream no crash job log log
2026/09/07 15:06 18m retest repro upstream report job log log
2026/07/09 09:53 27m xue.lei@windriver.com upstream log
2026/07/09 08:17 24m xue.lei@windriver.com patch upstream error
2026/07/08 14:22 1h00m stern@rowland.harvard.edu patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v7.2-rc2 log
2026/07/07 18:43 27m stern@rowland.harvard.edu patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 2b763db0c276 log
2026/05/28 14:11 32m retest repro linux-next log
2026/05/28 14:11 34m retest repro upstream log
2026/05/28 14:11 25m retest repro linux-next log
2026/05/28 13:35 38m retest repro linux-next log
2026/01/18 09:22 37m retest repro upstream report log
2026/01/05 04:07 25m hdanton@sina.com patch upstream OK log

Sample crash report:
list_add double add: new=ffff888026b80518, prev=ffff888026b80518, next=ffff88802512e078.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:35!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 6857 Comm: syz.2.391 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 lib/list_debug.c:35
Code: ec ff 90 0f 0b 48 c7 c7 00 e6 3f 8c e8 da 05 ec ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 e8 3f 8c e8 c2 05 ec ff 90 <0f> 0b 48 89 de 48 c7 c7 00 e9 3f 8c e8 b0 05 ec ff 90 0f 0b 48 89
RSP: 0018:ffffc90000538890 EFLAGS: 00010082
RAX: 0000000000000058 RBX: ffff88802512e078 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff81e83829 RDI: fffff520000a7103
RBP: ffff888026b80518 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000103 R11: 0000000000000000 R12: ffff88802512e080
R13: ffff888026b80518 R14: 0000000000000000 R15: ffff888026b80518
FS:  0000000000000000(0000) GS:ffff888096df3000(0063) knlGS:00000000f6895b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7436288 CR3: 000000006cbd9000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __list_add_valid include/linux/list.h:96 [inline]
 __list_add include/linux/list.h:158 [inline]
 list_add_tail include/linux/list.h:191 [inline]
 usb_hcd_link_urb_to_ep+0x220/0x3a0 drivers/usb/core/hcd.c:1154
 dummy_urb_enqueue+0x2b5/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1310
 usb_hcd_submit_urb+0x268/0x2150 drivers/usb/core/hcd.c:1542
 usb_submit_urb+0x827/0x19b0 drivers/usb/core/urb.c:586
 keyspan_usa49_send_setup.isra.0+0x72c/0xf10 drivers/usb/serial/keyspan.c:2466
 usa49_glocont_callback+0x18d/0x260 drivers/usb/serial/keyspan.c:1047
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdb2/0x36f0 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_callee_save___kvm_vcpu_is_preempted+0x16/0x20
Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 fd 20 69 46 8e 80 b8 50 0f 63 94 00 0f 95 c0 <c3> cc cc cc cc 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90004dff648 EFLAGS: 00000246
RAX: ffff888096ef3000 RBX: ffffffff8f988d40 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000003
RBP: ffff888028b00000 R08: 0000000000000000 R09: fffffbfff1f311a8
R10: ffffffff8f988d47 R11: 0000000000000000 R12: ffffed100505e950
R13: ffff8880282f4a80 R14: 0000000000000000 R15: dffffc0000000000
 pv_vcpu_is_preempted arch/x86/include/asm/paravirt-spinlock.h:47 [inline]
 vcpu_is_preempted arch/x86/include/asm/paravirt-spinlock.h:78 [inline]
 owner_on_cpu include/linux/sched.h:2323 [inline]
 mutex_spin_on_owner+0x12e/0x2c0 kernel/locking/mutex.c:406
 mutex_optimistic_spin kernel/locking/mutex.c:509 [inline]
 __mutex_lock_common kernel/locking/mutex.c:650 [inline]
 __mutex_lock+0x1229/0x1bd0 kernel/locking/mutex.c:821
 tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6ab/0x14d0 fs/open.c:947
 vfs_open+0x82/0x3f0 fs/open.c:1052
 do_open fs/namei.c:4700 [inline]
 path_openat+0x2873/0x4280 fs/namei.c:4863
 do_file_open+0x20e/0x430 fs/namei.c:4892
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
 do_sys_open fs/open.c:1374 [inline]
 __do_compat_sys_openat fs/open.c:1436 [inline]
 __se_compat_sys_openat fs/open.c:1434 [inline]
 __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf709efec
Code: Unable to access opcode bytes at 0xf709efc2.
RSP: 002b:00000000f689550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800001c0
RDX: 0000000000044400 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report.cold+0x34/0x36 lib/list_debug.c:35
Code: ec ff 90 0f 0b 48 c7 c7 00 e6 3f 8c e8 da 05 ec ff 90 0f 0b 48 89 d9 4c 89 ea 48 89 ee 48 c7 c7 40 e8 3f 8c e8 c2 05 ec ff 90 <0f> 0b 48 89 de 48 c7 c7 00 e9 3f 8c e8 b0 05 ec ff 90 0f 0b 48 89
RSP: 0018:ffffc90000538890 EFLAGS: 00010082
RAX: 0000000000000058 RBX: ffff88802512e078 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff81e83829 RDI: fffff520000a7103
RBP: ffff888026b80518 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000103 R11: 0000000000000000 R12: ffff88802512e080
R13: ffff888026b80518 R14: 0000000000000000 R15: ffff888026b80518
FS:  0000000000000000(0000) GS:ffff888096df3000(0063) knlGS:00000000f6895b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f709f000 CR3: 000000006cbd9000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	f3 0f 1e fa          	endbr64
  18:	48 8b 04 fd 20 69 46 	mov    -0x71b996e0(,%rdi,8),%rax
  1f:	8e
  20:	80 b8 50 0f 63 94 00 	cmpb   $0x0,-0x6b9cf0b0(%rax)
  27:	0f 95 c0             	setne  %al
* 2a:	c3                   	ret <-- trapping instruction
  2b:	cc                   	int3
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  34:	90                   	nop
  35:	90                   	nop
  36:	90                   	nop
  37:	90                   	nop
  38:	90                   	nop
  39:	90                   	nop
  3a:	90                   	nop
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/12 02:07 upstream f5bbbfec59b4 f8d35649 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/05 10:22 linux-next 2b763db0c276 fcece630 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/06/21 14:51 upstream 390d73adf896 43bfcdb0 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/01/04 07:02 upstream aacb0a6d604a d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/24 15:02 upstream 818bebeb63dd b55bd4c3 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/11 19:31 upstream f5bbbfec59b4 557a89d3 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/05/14 13:20 linux-next e98d21c170b0 6ccb967e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/04/23 06:57 linux-next 70c8a7ec6715 b10da5ec .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/10 02:19 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci ba5cc80fd326 5d63f80b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/09/19 13:47 upstream c3d85c669d09 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/20 14:40 upstream a4ff2be345d0 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/19 23:41 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/19 10:01 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/11 07:02 upstream d58772d8520c 039457bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/10 00:51 upstream b643e495ae92 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/02 15:37 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/24 22:14 upstream 48a5a7ab8d6a 05b26a28 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/24 13:30 upstream d326f83e819c 544adce9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/08 07:50 upstream 0e35b9b6ec0f 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/01 13:41 upstream 665159e24674 00a5cf1c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/05/10 00:34 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/04/02 00:52 upstream 9147566d8016 0285fe54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/06/09 06:26 upstream 2d3090a8aeb5 656e94c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/05/09 13:39 upstream 70390501d194 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: corrupted list in usb_hcd_link_urb_to_ep
2025/11/26 02:27 upstream 8a2bcda5e139 64219f15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: corrupted list in usb_hcd_link_urb_to_ep
2025/11/14 04:28 upstream 2ccec5944606 07e030de .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/18 07:42 upstream ff68e5f557f6 1e72964b .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/13 05:42 upstream f4fb100039e9 d78ea535 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/02/22 23:16 upstream 189f164e573e 6e7b5511 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: corrupted list in usb_hcd_link_urb_to_ep
2025/10/24 13:28 upstream 6fab32bb6508 c0460fcd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/08/24 03:15 linux-next 903c1cf6dff9 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/07 14:48 linux-next 5c73cd9f0819 8e71ce95 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/07/05 07:57 linux-next 2b763db0c276 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/05/14 08:51 linux-next e98d21c170b0 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/04/30 07:51 linux-next 0787c45ea08a 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
2026/04/21 16:46 linux-next bee6ea30c487 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in usb_hcd_link_urb_to_ep
* Struck through repros no longer work on HEAD.