syzbot


general protection fault in snd_scarlett2_controls_create

Status: premoderation: reported C repro on 2026/03/04 05:04
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+a69f523f5fe6d495ae35@syzkaller.appspotmail.com
First crash: 13d, last: 8d03h
Bug presence (2)
Date Name Commit Repro Result
2026/03/04 lts (merge base) ff2177382799 C [report] general protection fault in snd_scarlett2_controls_create
2026/03/04 upstream (ToT) 0031c06807cf C [report] general protection fault in snd_scarlett2_controls_create
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in snd_scarlett2_controls_create sound 2 C 5 12d 9d09h 22/29 upstream: reported C repro on 2026/03/07 23:59

Sample crash report:
usb 3-1: 0:6 : does not exist
usb 3-1: 0:7 : does not exist
usb 3-1: 0:8 : does not exist
usb 3-1: 0:9 : does not exist
usb 3-1: 0:10 : does not exist
usb 3-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8215); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 336 Comm: kworker/0:2 Not tainted syzkaller #0 e0984ef4b19b7a0d2e0df0f24afaf737f1320d97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8589 [inline]
RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8624 [inline]
RIP: 0010:snd_scarlett2_controls_create+0x96d/0x50d0 sound/usb/mixer_scarlett2.c:9013
Code: 10 4c 8d b2 10 01 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 eb 31 00 00 45 88 3e 4c 8d 73 02 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 48 8b 7c 24 38 0f 85 eb 31 00 00 45 0f b6 3e
RSP: 0018:ffffc90001b5e640 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88811593c000 RSI: 00000000000000ff RDI: ffff88812f760e20
RBP: ffffc90001b5ea58 R08: ffffffff8686baac R09: ffffffff8686bac0
R10: dffffc0000000000 R11: ffffed1022b2780d R12: dffffc0000000000
R13: ffff88812f760e0a R14: 0000000000000002 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cf8eb85460 CR3: 000000011594c000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 snd_scarlett2_init+0x41b/0x630 sound/usb/mixer_scarlett2.c:9641
 snd_usb_mixer_apply_create_quirk+0x1319/0x1740 sound/usb/mixer_quirks.c:4305
 snd_usb_create_mixer+0x1b4e/0x29d0 sound/usb/mixer.c:3635
 usb_audio_probe+0x13a6/0x1d60 sound/usb/card.c:970
 usb_probe_interface+0x6ac/0xc00 drivers/usb/core/driver.c:400
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x2d8/0x890 drivers/base/dd.c:657
 __driver_probe_device+0x198/0x280 drivers/base/dd.c:799
 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
 __device_attach+0x2c9/0x3c0 drivers/base/dd.c:1029
 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078
 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534
 device_add+0x80c/0xbf0 drivers/base/core.c:3692
 usb_set_configuration+0x1acf/0x20b0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x95/0x160 drivers/usb/core/generic.c:254
 usb_probe_device+0x1d4/0x380 drivers/usb/core/driver.c:295
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x2d8/0x890 drivers/base/dd.c:657
 __driver_probe_device+0x198/0x280 drivers/base/dd.c:799
 driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
 __device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
 bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
 __device_attach+0x2c9/0x3c0 drivers/base/dd.c:1029
 device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078
 bus_probe_device+0x18b/0x270 drivers/base/bus.c:534
 device_add+0x80c/0xbf0 drivers/base/core.c:3692
 usb_new_device+0x9f8/0x15b0 drivers/usb/core/hub.c:2703
 hub_port_connect drivers/usb/core/hub.c:5574 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5714 [inline]
 port_event drivers/usb/core/hub.c:5878 [inline]
 hub_event+0x30c6/0x4700 drivers/usb/core/hub.c:5960
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scarlett2_find_fc_interface sound/usb/mixer_scarlett2.c:8589 [inline]
RIP: 0010:scarlett2_init_private sound/usb/mixer_scarlett2.c:8624 [inline]
RIP: 0010:snd_scarlett2_controls_create+0x96d/0x50d0 sound/usb/mixer_scarlett2.c:9013
Code: 10 4c 8d b2 10 01 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 eb 31 00 00 45 88 3e 4c 8d 73 02 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 48 8b 7c 24 38 0f 85 eb 31 00 00 45 0f b6 3e
RSP: 0018:ffffc90001b5e640 EFLAGS: 00010246

RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88811593c000 RSI: 00000000000000ff RDI: ffff88812f760e20
RBP: ffffc90001b5ea58 R08: ffffffff8686baac R09: ffffffff8686bac0
R10: dffffc0000000000 R11: ffffed1022b2780d R12: dffffc0000000000
R13: ffff88812f760e0a R14: 0000000000000002 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cf8eb85460 CR3: 0000000115778000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
   0:	10 4c 8d b2          	adc    %cl,-0x4e(%rbp,%rcx,4)
   4:	10 01                	adc    %al,(%rcx)
   6:	00 00                	add    %al,(%rax)
   8:	4c 89 f0             	mov    %r14,%rax
   b:	48 c1 e8 03          	shr    $0x3,%rax
   f:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
  14:	84 c0                	test   %al,%al
  16:	0f 85 eb 31 00 00    	jne    0x3207
  1c:	45 88 3e             	mov    %r15b,(%r14)
  1f:	4c 8d 73 02          	lea    0x2(%rbx),%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	48 8b 7c 24 38       	mov    0x38(%rsp),%rdi
  36:	0f 85 eb 31 00 00    	jne    0x3227
  3c:	45 0f b6 3e          	movzbl (%r14),%r15d

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/04 10:21 android16-6.12 c146faa1afa9 4180d919 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust general protection fault in snd_scarlett2_controls_create
2026/03/04 10:04 android16-6.12 c146faa1afa9 4180d919 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust general protection fault in snd_scarlett2_controls_create
2026/03/04 05:04 android16-6.12 c146faa1afa9 4180d919 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust general protection fault in snd_scarlett2_controls_create
2026/03/09 06:22 android16-6.12 f8e2ea1b4bbd 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust general protection fault in snd_scarlett2_controls_create
* Struck through repros no longer work on HEAD.