* Re: [PATCH v2 3/6] iio: hid-sensors: Use implicit NULL pointer checks
From: Sanjay Chitroda @ 2026-07-05 18:17 UTC (permalink / raw)
To: Jonathan Cameron, Sanjay Chitroda via B4 Relay
Cc: David Lechner, Nuno Sá, Andy Shevchenko, Jiri Kosina,
Srinivas Pandruvada, linux-iio, linux-kernel, linux-input,
Maxwell Doose
In-Reply-To: <20260702182205.388efe24@jic23-huawei>
On 2 July 2026 10:52:05 pm IST, Jonathan Cameron <jic23@kernel.org> wrote:
>On Thu, 02 Jul 2026 21:48:00 +0530
>Sanjay Chitroda via B4 Relay <devnull+sanjayembeddedse.gmail.com@kernel.org> wrote:
>
>> From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
>>
>> Replace explicit NULL pointer comparisons with implicit checks across
>> HID sensor IIO drivers to follow the preferred kernel coding style.
>Is there anything in the kernel wide style guides about this?
>
>I do prefer this style in IIO but perhaps we should document it
>as local IIO style rather than implying general guidance (unless
>there is some!)
>
Hi Jonathan,
I took reference of existing IIO commit message and followed the same.
There is no kernel coding guideline for NULL pointer. If you think it would be useful, I would be happy to work on documenting the preferred conventions under "Documentation/driver-api/iio/", for example as a new "coding-style.rst" or similar document.
Thanks, Sanjay
>>
>> Convert 'if (indio_dev == NULL)' -> 'if (!indio_dev)'.
>>
>> No functional change.
>>
>> Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
>> Reviewed-by: Maxwell Doose <m32285159@gmail.com>
>> ---
>> drivers/iio/accel/hid-sensor-accel-3d.c | 2 +-
>> drivers/iio/magnetometer/hid-sensor-magn-3d.c | 2 +-
>> drivers/iio/orientation/hid-sensor-incl-3d.c | 2 +-
>> drivers/iio/orientation/hid-sensor-rotation.c | 2 +-
>> 4 files changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
>> index 9197f3424c0c..225f8dd65ab1 100644
>> --- a/drivers/iio/accel/hid-sensor-accel-3d.c
>> +++ b/drivers/iio/accel/hid-sensor-accel-3d.c
>> @@ -325,7 +325,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
>>
>> indio_dev = devm_iio_device_alloc(&pdev->dev,
>> sizeof(struct accel_3d_state));
>> - if (indio_dev == NULL)
>> + if (!indio_dev)
>> return -ENOMEM;
>>
>> platform_set_drvdata(pdev, indio_dev);
>> diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
>> index ad10fa20fae0..738bad65d74d 100644
>> --- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
>> +++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
>> @@ -463,7 +463,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
>>
>> indio_dev = devm_iio_device_alloc(&pdev->dev,
>> sizeof(struct magn_3d_state));
>> - if (indio_dev == NULL)
>> + if (!indio_dev)
>> return -ENOMEM;
>>
>> platform_set_drvdata(pdev, indio_dev);
>> diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
>> index 870c8929491e..c8efb0dab8b6 100644
>> --- a/drivers/iio/orientation/hid-sensor-incl-3d.c
>> +++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
>> @@ -302,7 +302,7 @@ static int hid_incl_3d_probe(struct platform_device *pdev)
>>
>> indio_dev = devm_iio_device_alloc(&pdev->dev,
>> sizeof(struct incl_3d_state));
>> - if (indio_dev == NULL)
>> + if (!indio_dev)
>> return -ENOMEM;
>>
>> platform_set_drvdata(pdev, indio_dev);
>> diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
>> index 2dad0453fc67..6db253c1635d 100644
>> --- a/drivers/iio/orientation/hid-sensor-rotation.c
>> +++ b/drivers/iio/orientation/hid-sensor-rotation.c
>> @@ -274,7 +274,7 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
>>
>> indio_dev = devm_iio_device_alloc(&pdev->dev,
>> sizeof(struct dev_rot_state));
>> - if (indio_dev == NULL)
>> + if (!indio_dev)
>> return -ENOMEM;
>>
>> platform_set_drvdata(pdev, indio_dev);
>>
>
^ permalink raw reply
* [PATCH] HID: apple: Add Endorfy Thock TKL Wireless to the non-apple keyboard list
From: Michal Slustik @ 2026-07-05 18:50 UTC (permalink / raw)
To: jikos, bentiss; +Cc: linux-input, linux-kernel, Michal Slustik
The Endorfy Thock TKL Wireless uses the same device ID as an
Apple keyboard (05ac:024f), but its F1-F12 function keys do
not work correctly by default.
Adding two entries to the non-apple keyboard list:
one for Bluetooth mode, identified as "Thock TKL Wireless"
one for 2.4GHz wireless mode, identified as "USB Dongle"
Signed-off-by: Michal Slustik <michal.slustik@gmail.com>
---
drivers/hid/hid-apple.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index bf7dd0fbf249..0bd1af58d837 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -368,6 +368,8 @@ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
{ "TH87" }, /* EPOMAKER TH87 BT mode */
{ "HFD Epomaker TH87" }, /* EPOMAKER TH87 USB mode */
{ "2.4G Wireless Receiver" }, /* EPOMAKER TH87 dongle */
+ { "Thock TKL Wireless" }, /* ENDORFY THOCK TKL BT mode */
+ { "USB Dongle" }, /* ENDORFY THOCK TKL dongle */
};
static bool apple_is_non_apple_keyboard(struct hid_device *hdev)
--
2.53.0
^ permalink raw reply related
* Re: [PATCH 25/26] Input: maplecontrol - fix style issues
From: Adrian McMenamin @ 2026-07-05 19:28 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Yoshinori Sato, Rich Felker, John Paul Adrian Glaubitz,
Florian Fuchs, linux-kernel, Dmitry Torokhov, linux-input,
linux-mtd, linux-sh
In-Reply-To: <20260703-b4-maple-cleanup-v1-25-41e424964da5@gmail.com>
On Sat, 4 Jul 2026 at 06:58, Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:
>
> Fix coding style and formatting issues reported by checkpatch.pl and
> switch to using BIT(). When reporting D-PAD events avoid conditionals.
>
> Assisted-by: Antigravity:gemini-3.5-flash
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
> drivers/input/joystick/maplecontrol.c | 25 ++++++++++++-------------
> 1 file changed, 12 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/input/joystick/maplecontrol.c b/drivers/input/joystick/maplecontrol.c
> index 3ef6652d40cb..457a73d91239 100644
> --- a/drivers/input/joystick/maplecontrol.c
> +++ b/drivers/input/joystick/maplecontrol.c
> @@ -35,22 +35,22 @@ static void dc_pad_callback(struct mapleq *mq)
> buttons = ~le16_to_cpup((__le16 *)(res + 8));
>
> input_report_abs(dev, ABS_HAT0Y,
> - (buttons & 0x0010 ? -1 : 0) + (buttons & 0x0020 ? 1 : 0));
> + !!(buttons & BIT(5)) - !!(buttons & BIT(4)));
> input_report_abs(dev, ABS_HAT0X,
> - (buttons & 0x0040 ? -1 : 0) + (buttons & 0x0080 ? 1 : 0));
> + !!(buttons & BIT(7)) - !!(buttons & BIT(6)));
Maybe I have missed something but what is this !! operator?
Adrian
^ permalink raw reply
* Re: [syzbot] [input?] [usb?] INFO: task hung in devres_release_group (2)
From: syzbot @ 2026-07-05 19:30 UTC (permalink / raw)
To: anna-maria, frederic, linux-input, linux-kernel, linux-usb,
syzkaller-bugs, tglx
In-Reply-To: <69e31ea7.050a0220.24bfd3.0002.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 2b763db0c276 Add linux-next specific files for 20260703
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=129e3b39580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3c288f117a992ca4
dashboard link: https://syzkaller.appspot.com/bug?extid=d789904ff97c2f3dac88
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=169e3b39580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119e3b39580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8089f1fba297/disk-2b763db0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/97090b3387c9/vmlinux-2b763db0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/48e3e98867f8/bzImage-2b763db0.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d789904ff97c2f3dac88@syzkaller.appspotmail.com
INFO: task kworker/0:2:200 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:2 state:D stack:21496 pid:200 tgid:200 ppid:2 task_flags:0x4288060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7323
schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153
i2c_del_adapter+0x281/0x430 drivers/i2c/i2c-core-base.c:1840
release_nodes drivers/base/devres.c:546 [inline]
devres_release_group+0x264/0x360 drivers/base/devres.c:739
hid_device_remove+0x11c/0x1d0 drivers/hid/hid-core.c:2897
device_remove drivers/base/dd.c:616 [inline]
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
bus_remove_device+0x449/0x560 drivers/base/bus.c:664
device_del+0x528/0x8f0 drivers/base/core.c:3961
hid_remove_device drivers/hid/hid-core.c:3078 [inline]
hid_destroy_device+0x6b/0x1b0 drivers/hid/hid-core.c:3100
usbhid_disconnect+0x9f/0xc0 drivers/hid/usbhid/hid-core.c:1479
usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:618 [inline]
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372
bus_remove_device+0x449/0x560 drivers/base/bus.c:664
device_del+0x528/0x8f0 drivers/base/core.c:3961
usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478
usb_disconnect+0x32d/0x990 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1bb7/0x4cf0 drivers/usb/core/hub.c:5953
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task syz.3.113:6124 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.113 state:D stack:24712 pid:6124 tgid:6124 ppid:5776 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7604
rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
device_lock include/linux/device.h:1104 [inline]
usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
chrdev_open+0x4dc/0x600 fs/char_dev.c:411
do_dentry_open+0x849/0x1420 fs/open.c:947
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4694 [inline]
path_openat+0x2e64/0x3850 fs/namei.c:4857
do_file_open+0x23e/0x4a0 fs/namei.c:4886
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6b1e81e68e
RSP: 002b:00007fff96046768 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055558f391500 RCX: 00007f6b1e81e68e
RDX: 000000000000a401 RSI: 00007fff96046840 RDI: ffffffffffffff9c
RBP: 00007fff96046840 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f6b1eae5fac R14: 00007f6b1eae5fa0 R15: 00007f6b1eae5fa0
</TASK>
INFO: task syz.4.114:6125 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.114 state:D stack:24712 pid:6125 tgid:6125 ppid:5777 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7604
rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
device_lock include/linux/device.h:1104 [inline]
usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
chrdev_open+0x4dc/0x600 fs/char_dev.c:411
do_dentry_open+0x849/0x1420 fs/open.c:947
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4694 [inline]
path_openat+0x2e64/0x3850 fs/namei.c:4857
do_file_open+0x23e/0x4a0 fs/namei.c:4886
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f23e29fe68e
RSP: 002b:00007ffd83e58858 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00005555860fe500 RCX: 00007f23e29fe68e
RDX: 000000000000a401 RSI: 00007ffd83e58930 RDI: ffffffffffffff9c
RBP: 00007ffd83e58930 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f23e2cc5fac R14: 00007f23e2cc5fa0 R15: 00007f23e2cc5fa0
</TASK>
INFO: task syz.2.115:6126 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.115 state:D stack:24712 pid:6126 tgid:6126 ppid:5770 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7604
rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
device_lock include/linux/device.h:1104 [inline]
usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
chrdev_open+0x4dc/0x600 fs/char_dev.c:411
do_dentry_open+0x849/0x1420 fs/open.c:947
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4694 [inline]
path_openat+0x2e64/0x3850 fs/namei.c:4857
do_file_open+0x23e/0x4a0 fs/namei.c:4886
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f807aa2e68e
RSP: 002b:00007ffe18ae0728 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000555582e4d500 RCX: 00007f807aa2e68e
RDX: 000000000000a401 RSI: 00007ffe18ae0800 RDI: ffffffffffffff9c
RBP: 00007ffe18ae0800 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f807acf5fac R14: 00007f807acf5fa0 R15: 00007f807acf5fa0
</TASK>
INFO: task syz.1.116:6127 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.116 state:D stack:24712 pid:6127 tgid:6127 ppid:5774 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7604
rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
device_lock include/linux/device.h:1104 [inline]
usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
chrdev_open+0x4dc/0x600 fs/char_dev.c:411
do_dentry_open+0x849/0x1420 fs/open.c:947
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4694 [inline]
path_openat+0x2e64/0x3850 fs/namei.c:4857
do_file_open+0x23e/0x4a0 fs/namei.c:4886
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0c6723e68e
RSP: 002b:00007ffd2928b0e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055555f817500 RCX: 00007f0c6723e68e
RDX: 000000000000a401 RSI: 00007ffd2928b1c0 RDI: ffffffffffffff9c
RBP: 00007ffd2928b1c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f0c67505fac R14: 00007f0c67505fa0 R15: 00007f0c67505fa0
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/39:
#0: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6821
7 locks held by kworker/u8:5/69:
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000154fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000154fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000154fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88806d354310 (&devlink->lock_key#28){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:909
#3: ffff88807ff3f920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88807ff3f920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff88807ff3f920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffffffff8e0592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#6: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
6 locks held by kworker/0:2/200:
#0: ffff888021ee5538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff888021ee5538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff888021ee5538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc900039dfc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc900039dfc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc900039dfc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4cf0 drivers/usb/core/hub.c:5899
#3: ffff88801f6b4210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff88801f6b4210 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xe3/0x990 drivers/usb/core/hub.c:2336
#4: ffff888021afb1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff888021afb1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#4: ffff888021afb1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
#5: ffff888043dcda90 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#5: ffff888043dcda90 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#5: ffff888043dcda90 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
2 locks held by kworker/u8:11/1173:
#0: ffff888032b53938 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff888032b53938 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff888032b53938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000630fc60 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000630fc60 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000630fc60 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
6 locks held by kworker/u8:16/4350:
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000e78fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000e78fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000e78fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88802f5da310 (&devlink->lock_key#23){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:909
#3: ffff888079055520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff888079055520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff888079055520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
2 locks held by kworker/u8:19/4406:
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88813fe5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000e3cfc60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000e3cfc60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000e3cfc60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
2 locks held by getty/5359:
#0: ffff8880327e20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003cc62e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
1 lock held by kworker/0:3/5747:
#0: ffff88808326f938 ((wq_completion)wg-crypt-wg0#28){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88808326f938 ((wq_completion)wg-crypt-wg0#28){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88808326f938 ((wq_completion)wg-crypt-wg0#28){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
2 locks held by kworker/1:10/6020:
#0: ffff888079480d38 ((wq_completion)wg-crypt-wg2#28){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff888079480d38 ((wq_completion)wg-crypt-wg2#28){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff888079480d38 ((wq_completion)wg-crypt-wg2#28){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc900015afc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc900015afc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc900015afc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
9 locks held by kworker/0:8/6023:
#0: ffff888079480d38 ((wq_completion)wg-crypt-wg2#28){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff888079480d38 ((wq_completion)wg-crypt-wg2#28){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff888079480d38 ((wq_completion)wg-crypt-wg2#28){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000157fc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000157fc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000157fc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffffffff8e0592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#3: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#4: ffff88806681b790 (&peer->endpoint_lock){++..}-{3:3}, at: read_lock_bh include/linux/rwlock_rt.h:45 [inline]
#4: ffff88806681b790 (&peer->endpoint_lock){++..}-{3:3}, at: wg_socket_send_skb_to_peer+0x6e/0x200 drivers/net/wireguard/socket.c:172
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#5: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rt_read_lock+0x277/0x4b0 kernel/locking/spinlock_rt.c:251
#6: ffffffff8e0592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#7: ffffffff8e1c3820 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#7: ffffffff8e1c3820 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:893 [inline]
#7: ffffffff8e1c3820 (rcu_read_lock_bh){....}-{1:3}, at: send4+0x217/0xec0 drivers/net/wireguard/socket.c:38
#8: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#8: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#8: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#8: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
3 locks held by kworker/0:10/6027:
#0: ffff88813fe1b938 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88813fe1b938 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88813fe1b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc900042bfc60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc900042bfc60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc900042bfc60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88802b13a280 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x222/0x3e0 drivers/net/netdevsim/fib.c:1490
1 lock held by syz.3.113/6124:
#0: ffff88823bf64210 (&dev->mutex
){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.4.114/6125:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.2.115/6126:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.1.116/6127:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.6.123/6301:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.5.122/6302:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.7.125/6306:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.8.126/6307:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.9.135/6427:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.3.136/6442:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.4.138/6470:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.1.139/6472:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.2.147/6530:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.5.149/6598:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.6.151/6636:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.7.153/6640:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.8.159/6689:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.9.162/6754:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.3.164/6825:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.4.165/6832:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.1.169/6851:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.2.173/6887:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.5.177/6981:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.6.178/7018:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.7.181/7044:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
1 lock held by syz.8.183/7061:
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88823bf64210 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x790 drivers/usb/core/devio.c:1054
5 locks held by syz-executor/7068:
#0: ffffffff8f61d3a0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217
#1: ffffffff8f61d1b8 (genl_mutex){+.+.}-{4:4}, at: genl_lock net/netlink/genetlink.c:35 [inline]
#1: ffffffff8f61d1b8 (genl_mutex){+.+.}-{4:4}, at: genl_op_lock net/netlink/genetlink.c:60 [inline]
#1: ffffffff8f61d1b8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 net/netlink/genetlink.c:1208
#2: ffffffff8f5ac2f8 (rtnl_mutex){+.+.}-{4:4}, at: wiphy_register+0x1faf/0x2ff0 net/wireless/core.c:1154
#3: ffff8880868c08d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: wiphy_lock include/net/cfg80211.h:6868 [inline]
#3: ffff8880868c08d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: wiphy_register+0x1fb9/0x2ff0 net/wireless/core.c:1155
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
#4: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
2 locks held by modprobe/7113:
#0: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8e1c37c0 (rcu_read_lock){....}-{1:3}, at: fast_dput+0x1e/0x670 fs/dcache.c:938
#1: ffff8880339095b0 (&lockref->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#1: ffff8880339095b0 (&lockref->lock){+.+.}-{3:3}, at: fast_dput+0x29c/0x670 fs/dcache.c:947
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 4958 Comm: klogd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:__list_del include/linux/list.h:227 [inline]
RIP: 0010:__list_del_entry include/linux/list.h:249 [inline]
RIP: 0010:list_move include/linux/list.h:329 [inline]
RIP: 0010:set_next_task_fair+0xce9/0x10b0 kernel/sched/fair.c:15171
Code: c1 e8 03 80 3c 28 00 74 08 4c 89 e7 e8 b0 ff 99 00 4d 89 34 24 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 97 ff 99 00 <4d> 89 2e 4c 8b 64 24 08 4d 89 fd 49 c1 ed 03 41 80 7c 2d 00 00 74
RSP: 0018:ffffc90003a6f5b0 EFLAGS: 00000046
RAX: 1ffff110170e78a6 RBX: ffff888036f51fd8 RCX: dffffc0000000000
RDX: ffff888036f51fe8 RSI: ffff888036f51f80 RDI: ffff888036f51fe0
RBP: dffffc0000000000 R08: ffffffff8faf37f7 R09: 1ffffffff1f5e6fe
R10: dffffc0000000000 R11: fffffbfff1f5e6ff R12: ffff888034e8bee0
R13: ffff888034e8bed8 R14: ffff8880b873c530 R15: ffff8880b873c530
FS: 00007f76e13e8c80(0000) GS:ffff888125d49000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007effe5be7e9c CR3: 00000000374a8000 CR4: 00000000003526f0
Call Trace:
<TASK>
put_prev_set_next_task kernel/sched/sched.h:2787 [inline]
__pick_next_task+0x215/0x3c0 kernel/sched/core.c:6149
pick_next_task kernel/sched/core.c:-1 [inline]
__schedule+0x861/0x5530 kernel/sched/core.c:7146
__schedule_loop kernel/sched/core.c:7308 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7323
schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75
unix_wait_for_peer+0x1f5/0x2f0 net/unix/af_unix.c:1615
unix_dgram_sendmsg+0xaf4/0x17b0 net/unix/af_unix.c:2251
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
__sock_sendmsg net/socket.c:825 [inline]
__sys_sendto+0x41e/0x5d0 net/socket.c:2292
__do_sys_sendto net/socket.c:2299 [inline]
__se_sys_sendto net/socket.c:2295 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2295
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76e1538407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe12658f20 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f76e13e8c80 RCX: 00007f76e1538407
RDX: 0000000000000048 RSI: 00007ffe12659060 RDI: 0000000000000003
RBP: 00007ffe12659490 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffe126594a8
R13: 00007ffe12659060 R14: 000000000000002d R15: 00007ffe12659060
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply
* Re: [PATCH v2 3/6] iio: hid-sensors: Use implicit NULL pointer checks
From: Joshua Crofts @ 2026-07-05 19:31 UTC (permalink / raw)
To: Sanjay Chitroda
Cc: Jonathan Cameron, Sanjay Chitroda via B4 Relay, David Lechner,
Nuno Sá, Andy Shevchenko, Jiri Kosina, Srinivas Pandruvada,
linux-iio, linux-kernel, linux-input, Maxwell Doose
In-Reply-To: <BF19024B-D73A-4185-A963-516D0574E416@gmail.com>
On Sun, 5 Jul 2026 at 20:17, Sanjay Chitroda <sanjayembeddedse@gmail.com> wrote:
>
>
>
> On 2 July 2026 10:52:05 pm IST, Jonathan Cameron <jic23@kernel.org> wrote:
> >On Thu, 02 Jul 2026 21:48:00 +0530
> >Sanjay Chitroda via B4 Relay <devnull+sanjayembeddedse.gmail.com@kernel.org> wrote:
> >
> >> From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
> >>
> >> Replace explicit NULL pointer comparisons with implicit checks across
> >> HID sensor IIO drivers to follow the preferred kernel coding style.
> >Is there anything in the kernel wide style guides about this?
> >
> >I do prefer this style in IIO but perhaps we should document it
> >as local IIO style rather than implying general guidance (unless
> >there is some!)
> >
> Hi Jonathan,
>
> I took reference of existing IIO commit message and followed the same.
>
> There is no kernel coding guideline for NULL pointer. If you think it would be useful, I would be happy to work on documenting the preferred conventions under "Documentation/driver-api/iio/", for example as a new "coding-style.rst" or similar document.
Not sure whether any coding style kerneldoc mentions this style,
nevertheless checkpatch prefers (!foo) over (foo == NULL), see the
COMPARISON_TO_NULL section in the checkpatch kerneldoc.
--
Kind regards
CJD
^ permalink raw reply
* Re: [PATCH 25/26] Input: maplecontrol - fix style issues
From: Dmitry Torokhov @ 2026-07-05 20:26 UTC (permalink / raw)
To: Adrian McMenamin
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Yoshinori Sato, Rich Felker, John Paul Adrian Glaubitz,
Florian Fuchs, linux-kernel, linux-input, linux-mtd, linux-sh
In-Reply-To: <CACwZE5RfhwhOoVSPqibM9+XaPJCf-TdnJxi_UT7Dgv71OJPsFQ@mail.gmail.com>
On Sun, Jul 05, 2026 at 08:28:39PM +0100, Adrian McMenamin wrote:
> On Sat, 4 Jul 2026 at 06:58, Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:
> >
> > Fix coding style and formatting issues reported by checkpatch.pl and
> > switch to using BIT(). When reporting D-PAD events avoid conditionals.
> >
> > Assisted-by: Antigravity:gemini-3.5-flash
> > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > ---
> > drivers/input/joystick/maplecontrol.c | 25 ++++++++++++-------------
> > 1 file changed, 12 insertions(+), 13 deletions(-)
> >
> > diff --git a/drivers/input/joystick/maplecontrol.c b/drivers/input/joystick/maplecontrol.c
> > index 3ef6652d40cb..457a73d91239 100644
> > --- a/drivers/input/joystick/maplecontrol.c
> > +++ b/drivers/input/joystick/maplecontrol.c
> > @@ -35,22 +35,22 @@ static void dc_pad_callback(struct mapleq *mq)
> > buttons = ~le16_to_cpup((__le16 *)(res + 8));
> >
> > input_report_abs(dev, ABS_HAT0Y,
> > - (buttons & 0x0010 ? -1 : 0) + (buttons & 0x0020 ? 1 : 0));
> > + !!(buttons & BIT(5)) - !!(buttons & BIT(4)));
> > input_report_abs(dev, ABS_HAT0X,
> > - (buttons & 0x0040 ? -1 : 0) + (buttons & 0x0080 ? 1 : 0));
> > + !!(buttons & BIT(7)) - !!(buttons & BIT(6)));
>
>
> Maybe I have missed something but what is this !! operator?
Double negation to coerce the value to [0, 1] range avoiding
conditional/branching?
--
Dmitry
^ permalink raw reply
* Re: [PATCH v2 3/6] iio: hid-sensors: Use implicit NULL pointer checks
From: Jonathan Cameron @ 2026-07-05 22:29 UTC (permalink / raw)
To: Joshua Crofts
Cc: Sanjay Chitroda, Sanjay Chitroda via B4 Relay, David Lechner,
Nuno Sá, Andy Shevchenko, Jiri Kosina, Srinivas Pandruvada,
linux-iio, linux-kernel, linux-input, Maxwell Doose
In-Reply-To: <CALoEA-wkbbvPA02JFCTuCEQrpGKZfu3NeBScTErTT07U7zJZ_g@mail.gmail.com>
On Sun, 5 Jul 2026 21:31:54 +0200
Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> On Sun, 5 Jul 2026 at 20:17, Sanjay Chitroda <sanjayembeddedse@gmail.com> wrote:
> >
> >
> >
> > On 2 July 2026 10:52:05 pm IST, Jonathan Cameron <jic23@kernel.org> wrote:
> > >On Thu, 02 Jul 2026 21:48:00 +0530
> > >Sanjay Chitroda via B4 Relay <devnull+sanjayembeddedse.gmail.com@kernel.org> wrote:
> > >
> > >> From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
> > >>
> > >> Replace explicit NULL pointer comparisons with implicit checks across
> > >> HID sensor IIO drivers to follow the preferred kernel coding style.
> > >Is there anything in the kernel wide style guides about this?
> > >
> > >I do prefer this style in IIO but perhaps we should document it
> > >as local IIO style rather than implying general guidance (unless
> > >there is some!)
> > >
> > Hi Jonathan,
> >
> > I took reference of existing IIO commit message and followed the same.
> >
> > There is no kernel coding guideline for NULL pointer. If you think it would be useful, I would be happy to work on documenting the preferred conventions under "Documentation/driver-api/iio/", for example as a new "coding-style.rst" or similar document.
>
Probably would go in a subsystem maintainer profile.
https://docs.kernel.org/maintainer/maintainer-entry-profile.html
If you want to take a stab at just a bit on local style preferences
that would be great. I can probably find time to throw something
together for other standard sections like timelines.
> Not sure whether any coding style kerneldoc mentions this style,
> nevertheless checkpatch prefers (!foo) over (foo == NULL), see the
> COMPARISON_TO_NULL section in the checkpatch kerneldoc.
>
Thanks for digging into this. If it got into checkpatch it was
reviewed and is generally accepted, whether or not anyone updated
the descriptive stuff on kernel style. Perhaps just refer to that
in the commit message to avoid confusion.
Thanks,
Jonathan
^ permalink raw reply
* [syzbot] [input?] KASAN: slab-use-after-free Read in str_to_user (2)
From: syzbot @ 2026-07-06 1:19 UTC (permalink / raw)
To: dmitry.torokhov, linux-input, linux-kernel, linux-usb,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: dc59e4fea9d8 Linux 7.2-rc1
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=105fb11c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6ec4d592e55f7960
dashboard link: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/23fd2bbd359c/disk-dc59e4fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8ffcad9a17ea/vmlinux-dc59e4fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1c2fcc6db866/bzImage-dc59e4fe.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0 lib/string.c:402
Read of size 1 at addr ffff888112fec220 by task syz.3.1096/9318
CPU: 1 UID: 0 PID: 9318 Comm: syz.3.1096 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
strlen+0x85/0xa0 lib/string.c:402
__fortify_strlen include/linux/fortify-string.h:218 [inline]
str_to_user+0x26/0xa0 drivers/input/evdev.c:769
evdev_do_ioctl+0x1529/0x1b60 drivers/input/evdev.c:1172
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4fe1cdde59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4fe0737028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f4fe1f65fa0 RCX: 00007f4fe1cdde59
RDX: 0000200000003d80 RSI: 0000000080404507 RDI: 0000000000000008
RBP: 00007f4fe1d73e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4fe1f66038 R14: 00007f4fe1f65fa0 R15: 00007ffc2d29e718
</TASK>
Allocated by task 5308:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5362 [inline]
__kmalloc_noprof+0x309/0x7c0 mm/slub.c:5387
_kmalloc_noprof include/linux/slab.h:973 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
usb_get_configuration+0x1ac/0x4410 drivers/usb/core/config.c:932
usb_enumerate_device drivers/usb/core/hub.c:2527 [inline]
usb_new_device+0x580/0x7d0 drivers/usb/core/hub.c:2665
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 5418:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free mm/slub.c:6405 [inline]
kfree+0x20c/0x650 mm/slub.c:6720
usb_destroy_configuration+0x561/0x700 drivers/usb/core/config.c:896
usb_release_dev+0x42/0x110 drivers/usb/core/usb.c:494
device_release+0xd2/0x270 drivers/base/core.c:2636
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1f7/0x640 lib/kobject.c:737
put_device+0x1f/0x30 drivers/base/core.c:3880
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888112fec000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 544 bytes inside of
freed 1024-byte region [ffff888112fec000, ffff888112fec400)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fe8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100041dc0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100041dc0 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16487694787, free_ts 14540795040
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3294 [inline]
allocate_slab mm/slub.c:3408 [inline]
new_slab+0xa2/0x670 mm/slub.c:3454
refill_objects+0xe3/0x410 mm/slub.c:7338
refill_sheaf mm/slub.c:2832 [inline]
__pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
alloc_from_pcs mm/slub.c:4801 [inline]
slab_alloc_node mm/slub.c:4933 [inline]
__do_kmalloc_node mm/slub.c:5361 [inline]
__kmalloc_noprof+0x60d/0x7c0 mm/slub.c:5387
_kmalloc_noprof include/linux/slab.h:973 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
__alloc_workqueue+0x1bd/0x1940 kernel/workqueue.c:5827
alloc_workqueue_va kernel/workqueue.c:5946 [inline]
alloc_workqueue_noprof+0xc7/0x130 kernel/workqueue.c:5962
init_netconsole+0xf3a/0x1150 drivers/net/netconsole.c:2418
do_one_initcall+0x11d/0x700 init/main.c:1347
do_initcall_level init/main.c:1409 [inline]
do_initcalls init/main.c:1425 [inline]
do_basic_setup init/main.c:1445 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658
kernel_init+0x1f/0x1e0 init/main.c:1548
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 11 tgid 11 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
free_pages_prepare+0x558/0xcb0 mm/page_alloc.c:1451
__free_contig_range_common.constprop.0+0x12c/0x230 mm/page_alloc.c:6897
__free_contig_range mm/page_alloc.c:6942 [inline]
free_pages_bulk+0x126/0x1f0 mm/page_alloc.c:5257
vm_area_free_pages+0xad/0x2b0 mm/vmalloc.c:3439
vfree mm/vmalloc.c:3488 [inline]
vfree+0x107/0x750 mm/vmalloc.c:3462
delayed_vfree_work+0x56/0x80 mm/vmalloc.c:3392
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff888112fec100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888112fec180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888112fec200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888112fec280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888112fec300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
page: | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox