Re: [syzbot] [usb?] general protection fault in vhci_hcd_probe

[Michal Pecio]

On Mon, 7 Sep 2026 09:59:36 +0200, Aleksandr Nogikh wrote:
> On Sun, Sep 6, 2026 at 12:38 PM Michal Pecio <michal.pecio@xxxxxxxxx> wrote:
> >
> > On Sat, 5 Sep 2026 13:30:01 +0200, Greg KH wrote:  
> > > On Sat, Sep 05, 2026 at 10:43:31AM +0200, Michal Pecio wrote:  
> > > > On Sat, 05 Sep 2026 01:12:27 -0700, syzbot wrote:  
> > > > > syzbot has found a reproducer for the following issue on:
> > > > >
> > > > > HEAD commit:    9d80aa4617b3 Add linux-next specific files for 20260903
> > > > > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=10adf4f9580000
> > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=bb4a32c282cc2ec7
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=7300affe388249d66dfe
> > > > > compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> > > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=121c7215580000  
> > > >
> > > > Who or what is coming up with these ideas and even commenting it?
> > > >
> > > >     // Iterate platform devices
> > > >     dir = opendir("/sys/bus/platform/devices/");
> > > >
> > > >     while ((ent = readdir(dir)) != NULL) {
> > > >
> > > >         // Set driver override
> > > >         snprintf(path, sizeof(path), "/sys/bus/platform/devices/%s/driver_override", ent->d_name);
> > > >         fd = open(path, O_WRONLY);
> > > >
> > > >         // Bind to vhci_hcd
> > > >         fd = open("/sys/bus/platform/drivers/vhci_hcd/bind", O_WRONLY);  
> > >
> > > That will taint the kernel in newer releases, and syzbot has already
> > > been told not to do this, it's not "valid" at all.  
> >
> > What cought my attention is that Google apparently has some capability
> > (human, machine or otherwise) to understand how this repro works, and
> > yet they keep reporting this broken pattern.  
> 
> As Greg pointed out, we've adjusted the fuzzer to stop using this
> kernel interface, so there should be no new bugs of this type.
> However, we haven't yet invalidated all such reported bugs, so some
> notifications like this one may still leak. I'll look into
> mass-invalidation of them all, but in the meanwhile let's close this
> particular one:
> 
> #syz invalid

Thanks, that should do it.

Nota bene, this can be triggered not only by the per-device
'driver_override' files, but also the per-driver 'new_id'. While
I haven't yet seen your syzbot instance using the latter, I have
seen others, so this needs to be filtered too.

Regards,
Michal