[syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    ca91b9500108 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=130c88d4580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16dc5368580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13def270580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d6e8d6537504/disk-ca91b950.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0de81a10c06a/vmlinux-ca91b950.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0e828bb2de22/bzImage-ca91b950.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0dcc341ee61fc9e4032f@syzkaller.appspotmail.com

INFO: task kworker/0:3:5829 blocked for more than 143 seconds.
      Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:3     state:D stack:22760 pid:5829  tgid:5829  ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x116f/0x5de0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6860
 schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:116
 i2c_del_adapter+0x546/0x6f0 drivers/i2c/i2c-core-base.c:1812
 dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46
 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline]
 dvb_usb_device_exit+0x334/0x580 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
 cxusb_probe+0x1c9/0x7d0 drivers/media/usb/dvb-usb/cxusb.c:1664
 usb_probe_interface+0x300/0x9c0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
 usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:657
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
 __device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
 bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
 bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
 device_add+0x1148/0x1a70 drivers/base/core.c:3692
 usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
 hub_port_connect drivers/usb/core/hub.c:5531 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5671 [inline]
 port_event drivers/usb/core/hub.c:5831 [inline]
 hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5913
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor329:5845 blocked for more than 143 seconds.
      Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:28168 pid:5845  tgid:5845  ppid:5817   task_flags:0x400040 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x116f/0x5de0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
 device_lock include/linux/device.h:922 [inline]
 usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3880 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4039
 do_filp_open+0x20b/0x470 fs/namei.c:4066
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 0000000000010006 R15: 00007ffe7889bf7c
 </TASK>
INFO: task syz-executor329:5847 blocked for more than 144 seconds.
      Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:28792 pid:5847  tgid:5847  ppid:5820   task_flags:0x400040 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x116f/0x5de0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
 device_lock include/linux/device.h:922 [inline]
 usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3880 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4039
 do_filp_open+0x20b/0x470 fs/namei.c:4066
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 0000000000010005 R15: 00007ffe7889bf7c
 </TASK>
INFO: task syz-executor329:5848 blocked for more than 144 seconds.
      Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:28184 pid:5848  tgid:5848  ppid:5814   task_flags:0x400040 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x116f/0x5de0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
 device_lock include/linux/device.h:922 [inline]
 usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3880 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4039
 do_filp_open+0x20b/0x470 fs/namei.c:4066
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 000000000000ffeb R15: 00007ffe7889bf7c
 </TASK>
INFO: task syz-executor329:5850 blocked for more than 144 seconds.
      Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:27560 pid:5850  tgid:5850  ppid:5813   task_flags:0x400040 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x116f/0x5de0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
 device_lock include/linux/device.h:922 [inline]
 usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3880 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4039
 do_filp_open+0x20b/0x470 fs/namei.c:4066
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 000000000000ffeb R15: 00007ffe7889bf7c
 </TASK>
INFO: task syz-executor329:5851 blocked for more than 145 seconds.
      Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:27560 pid:5851  tgid:5851  ppid:5819   task_flags:0x400040 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x116f/0x5de0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
 device_lock include/linux/device.h:922 [inline]
 usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3880 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4039
 do_filp_open+0x20b/0x470 fs/namei.c:4066
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 000000000001054d R15: 00007ffe7889bf7c
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6764
2 locks held by getty/5579:
 #0: ffff8880326d60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
5 locks held by kworker/0:3/5829:
 #0: ffff88801f284948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
 #1: ffffc9000412fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
 #2: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #2: ffff888145310198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 drivers/usb/core/hub.c:5859
 #3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1004
 #4: ffff88807ccea160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #4: ffff88807ccea160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1004
4 locks held by udevd/5834:
 #0: ffff88802e1f38b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x12c0 fs/seq_file.c:182
 #1: ffff88802c20a088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4d/0x240 fs/kernfs/file.c:154
 #2: ffff88802f69a4b8 (kn->active#18){.+.+}-{0:0}, at: kernfs_seq_start+0x71/0x240 fs/kernfs/file.c:155
 #3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:927 [inline]
 #3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
1 lock held by syz-executor329/5845:
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5847:
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5848:
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5850:
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5851:
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
2 locks held by dhcpcd/5861:
 #0: ffff888012f64408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
 #0: ffff888012f64408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
 #1: ffffffff8e3caaf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x280/0x3c0 kernel/rcu/tree_exp.h:304
2 locks held by dhcpcd/5862:
 #0: ffff888012f62c08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
 #0: ffff888012f62c08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
 #1: ffffffff8e3caaf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:336

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
 watchdog+0xf70/0x12c0 kernel/hung_task.c:437
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:81
Code: 95 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 73 aa 1d 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff8e007e10 EFLAGS: 000002c6
RAX: 00000000000e2f7d RBX: 0000000000000000 RCX: ffffffff8b6c4419
RDX: 0000000000000000 RSI: ffffffff8dbdf8c1 RDI: ffffffff8bf47e20
RBP: fffffbfff1c12ee8 R08: 0000000000000001 R09: ffffed10170865bd
R10: ffff8880b8432deb R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e097740 R14: ffffffff9084f110 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881249e4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b05125c680 CR3: 000000000e180000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:748
 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:185 [inline]
 do_idle+0x391/0x510 kernel/sched/idle.c:325
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
 rest_init+0x16b/0x2b0 init/main.c:743
 start_kernel+0x3e9/0x4d0 init/main.c:1099
 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:513
 x86_64_start_kernel+0xb0/0xc0 arch/x86/kernel/head64.c:494
 common_startup_64+0x13e/0x148
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in module_put

Oops: general protection fault, probably for non-canonical address 0xfbd59c00000000bd: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead0000000005e8-0xdead0000000005ef]
CPU: 0 UID: 0 PID: 6827 Comm: syz.3.19 Not tainted 6.15.0-rc4-syzkaller-00296-ge8ab83e34bdc-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:raw_atomic_dec_if_positive include/linux/atomic/atomic-arch-fallback.h:2554 [inline]
RIP: 0010:atomic_dec_if_positive include/linux/atomic/atomic-instrumented.h:1594 [inline]
RIP: 0010:module_put.part.0+0x2c/0x1a0 kernel/module/main.c:874
Code: be 04 00 00 00 55 48 89 fd 53 48 8d 9f e8 04 00 00 48 89 df e8 45 85 7b 00 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 37
RSP: 0018:ffffc900030afda0 EFLAGS: 00010a06

RAX: dffffc0000000000 RBX: dead0000000005e8 RCX: 0000000000000000
RDX: 1bd5a000000000bd RSI: 0000000000000004 RDI: ffffc900030afd48
RBP: dead000000000100 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888029df6758
R13: ffff888029f8cfe0 R14: ffffffff87b61660 R15: ffff888029f8cfe0
FS:  0000555565b2c500(0000) GS:ffff8881249e2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fd5ffff CR3: 000000006149d000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 i2c_put_adapter drivers/i2c/i2c-core-base.c:2624 [inline]
 i2c_put_adapter+0x36/0x60 drivers/i2c/i2c-core-base.c:2619
 i2cdev_release+0x53/0xa0 drivers/i2c/i2c-dev.c:632
 __fput+0x3ff/0xb70 fs/file_table.c:465
 task_work_run+0x14d/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6f3678e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcf1eb9828 EFLAGS: 00000246
 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f6f369b7ba0 RCX: 00007f6f3678e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f6f369b7ba0 R08: 0000000000000000 R09: 00000003f1eb9b1f
R10: 000000000003fdc8 R11: 0000000000000246 R12: 000000000001e11e
R13: 00007ffcf1eb9920 R14: ffffffffffffffff R15: 00007ffcf1eb9940
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	be 04 00 00 00       	mov    $0x4,%esi
   5:	55                   	push   %rbp
   6:	48 89 fd             	mov    %rdi,%rbp
   9:	53                   	push   %rbx
   a:	48 8d 9f e8 04 00 00 	lea    0x4e8(%rdi),%rbx
  11:	48 89 df             	mov    %rbx,%rdi
  14:	e8 45 85 7b 00       	call   0x7b855e
  19:	48 89 da             	mov    %rbx,%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx <-- trapping instruction
  2e:	48 89 d8             	mov    %rbx,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 d0                	cmp    %dl,%al
  39:	7c 08                	jl     0x43
  3b:	84 d2                	test   %dl,%dl
  3d:	0f                   	.byte 0xf
  3e:	85 37                	test   %esi,(%rdi)


Tested on:

commit:         e8ab83e3 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=126310f4580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1002d774580000

Re: [syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[Edward Adam Davis]

#syz test

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index f44529b40989..855d66043b85 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1600,13 +1600,12 @@ static int cxusb_probe(struct usb_interface *intf,
 	struct dvb_usb_device *dvbdev;
 	int ret;
 
+	if (!cxusb_medion_check_intf(intf)) {
+		return -ENODEV;
+
 	/* Medion 95700 */
 	if (!dvb_usb_device_init(intf, &cxusb_medion_properties,
 				 THIS_MODULE, &dvbdev, adapter_nr)) {
-		if (!cxusb_medion_check_intf(intf)) {
-			ret = -ENODEV;
-			goto ret_uninit;
-		}
 
 		_cxusb_power_ctrl(dvbdev, 1);
 		ret = cxusb_medion_set_mode(dvbdev, false);

Re: [syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

drivers/media/usb/dvb-usb/cxusb.c:1668:13: error: invalid storage class for function 'cxusb_disconnect'
drivers/media/usb/dvb-usb/cxusb.c:2389:27: error: initializer element is not constant
drivers/media/usb/dvb-usb/cxusb.c:2393:19: error: invalid storage class for function 'cxusb_driver_init'
./include/linux/compiler.h:286:52: error: initializer element is not constant
drivers/media/usb/dvb-usb/cxusb.c:2393:19: error: invalid storage class for function 'cxusb_driver_exit'
drivers/media/usb/dvb-usb/cxusb.c:2393:19: error: initializer element is not constant
drivers/media/usb/dvb-usb/cxusb.c:2400:1: error: expected declaration or statement at end of input


Tested on:

commit:         e9565e23 Merge tag 'sched_ext-for-6.15-rc6-fixes' of g..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1509e2f4580000

Re: [syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[Edward Adam Davis]

#syz test

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index f44529b40989..855d66043b85 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1600,13 +1600,12 @@ static int cxusb_probe(struct usb_interface *intf,
 	struct dvb_usb_device *dvbdev;
 	int ret;
 
+	if (!cxusb_medion_check_intf(intf))
+		return -ENODEV;
+
 	/* Medion 95700 */
 	if (!dvb_usb_device_init(intf, &cxusb_medion_properties,
 				 THIS_MODULE, &dvbdev, adapter_nr)) {
-		if (!cxusb_medion_check_intf(intf)) {
-			ret = -ENODEV;
-			goto ret_uninit;
-		}
 
 		_cxusb_power_ctrl(dvbdev, 1);
 		ret = cxusb_medion_set_mode(dvbdev, false);

Re: [syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+0dcc341ee61fc9e4032f@syzkaller.appspotmail.com
Tested-by: syzbot+0dcc341ee61fc9e4032f@syzkaller.appspotmail.com

Tested on:

commit:         e9565e23 Merge tag 'sched_ext-for-6.15-rc6-fixes' of g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1153f670580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca187b35f3c61c60
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=147facd4580000

Note: testing is done by a robot and is best-effort only.

[PATCH] media: cxusb: Initialize medion after checking intf

[Edward Adam Davis]

dvb_usb_device_exit() is entered because the number of alternate setting
is less than 2. Check the USB interface in advance to avoid unnecessary
dvb device initialization and exit.

Reported-by: syzbot+0dcc341ee61fc9e4032f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
Tested-by: syzbot+0dcc341ee61fc9e4032f@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 drivers/media/usb/dvb-usb/cxusb.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index f44529b40989..df86ae7106c1 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1601,13 +1601,9 @@ static int cxusb_probe(struct usb_interface *intf,
 	int ret;
 
 	/* Medion 95700 */
-	if (!dvb_usb_device_init(intf, &cxusb_medion_properties,
+	if (cxusb_medion_check_intf(intf) &&
+	    !dvb_usb_device_init(intf, &cxusb_medion_properties,
 				 THIS_MODULE, &dvbdev, adapter_nr)) {
-		if (!cxusb_medion_check_intf(intf)) {
-			ret = -ENODEV;
-			goto ret_uninit;
-		}
-
 		_cxusb_power_ctrl(dvbdev, 1);
 		ret = cxusb_medion_set_mode(dvbdev, false);
 		if (ret)
-- 
2.43.0