From: syzbot <syzbot+1a7507a194fff09e5c44@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_open
Date: Thu, 19 Mar 2026 02:29:02 -0700 [thread overview]
Message-ID: <69bbc1de.050a0220.3a088d.000f.GAE@google.com> (raw)
In-Reply-To: <tencent_ACB567DE3DC5361A967836764AA0754F7609@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in em28xx_v4l2_open
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
v4l_id/6669 is trying to acquire lock:
ffff888030ac9cd0 (&dev->lock#3){+.+.}-{4:4}
, at: em28xx_v4l2_open+0xf0/0xa20 drivers/media/usb/em28xx/em28xx-video.c:2146
but task is already holding lock:
ffffffff8f6a0520 (videodev_lock){+.+.}-{4:4}, at: v4l2_open+0x32/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:417
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (videodev_lock
){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:632 [inline]
__mutex_lock+0x19e/0x1420 kernel/locking/mutex.c:794
__video_register_device+0x54e/0x4d20 drivers/media/v4l2-core/v4l2-dev.c:1008
video_register_device include/media/v4l2-dev.h:390 [inline]
em28xx_v4l2_init+0x1d32/0x2e70 drivers/media/usb/em28xx/em28xx-video.c:2788
em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1117
process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288
process_scheduled_works kernel/workqueue.c:3379 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #0 (&dev->lock#3){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
__mutex_lock_common kernel/locking/mutex.c:632 [inline]
__mutex_lock+0x19e/0x1420 kernel/locking/mutex.c:794
em28xx_v4l2_open+0xf0/0xa20 drivers/media/usb/em28xx/em28xx-video.c:2146
v4l2_open+0x1b1/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:432
chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
do_dentry_open+0x785/0x14e0 fs/open.c:949
vfs_open+0x3b/0x340 fs/open.c:1081
do_open fs/namei.c:4693 [inline]
path_openat+0x2e08/0x3860 fs/namei.c:4852
do_file_open+0x23e/0x4a0 fs/namei.c:4881
do_sys_openat2+0x113/0x200 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(videodev_lock);
lock(&dev->lock#3);
lock(videodev_lock);
lock(&dev->lock#3
);
*** DEADLOCK ***
1 lock held by v4l_id/6669:
#0:
ffffffff8f6a0520 (videodev_lock){+.+.}-{4:4}, at: v4l2_open+0x32/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:417
stack backtrace:
CPU: 0 UID: 0 PID: 6669 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
__mutex_lock_common kernel/locking/mutex.c:632 [inline]
__mutex_lock+0x19e/0x1420 kernel/locking/mutex.c:794
em28xx_v4l2_open+0xf0/0xa20 drivers/media/usb/em28xx/em28xx-video.c:2146
v4l2_open+0x1b1/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:432
chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
do_dentry_open+0x785/0x14e0 fs/open.c:949
vfs_open+0x3b/0x340 fs/open.c:1081
do_open fs/namei.c:4693 [inline]
path_openat+0x2e08/0x3860 fs/namei.c:4852
do_file_open+0x23e/0x4a0 fs/namei.c:4881
do_sys_openat2+0x113/0x200 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80328a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffdfce9d3b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8033087880 RCX: 00007f80328a7407
RDX: 0000000000000000 RSI: 00007ffdfce9df1d RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffdfce9d600 R14: 00007f80331ee000 R15: 0000556e3f2c74d8
</TASK>
Tested on:
commit: 8e42d251 Add linux-next specific files for 20260318
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=178e4a06580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7f5b21566f9d8af6
dashboard link: https://syzkaller.appspot.com/bug?extid=1a7507a194fff09e5c44
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=12e57352580000
next prev parent reply other threads:[~2026-03-19 9:29 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-19 7:21 [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_open syzbot
2026-03-19 9:00 ` Edward Adam Davis
2026-03-19 9:29 ` syzbot [this message]
2026-03-19 12:20 ` Edward Adam Davis
2026-03-20 5:31 ` syzbot
2026-03-19 12:40 ` Forwarded: [PATCH] media: em28xx: fix use-after-free in v4l2_open() during init error path syzbot
2026-03-19 16:45 ` [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_open Edward Adam Davis
2026-03-20 10:30 ` syzbot
2026-03-19 16:49 ` [PATCH] media: usb: em28xx: fix the race condition between init extension and open Edward Adam Davis
2026-03-20 6:23 ` Forwarded: [PATCH] media: em28xx: fix use-after-free in v4l2_open() during init error path syzbot
[not found] <20260319124025.1093288-1-kartikey406@gmail.com>
2026-03-20 5:44 ` [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_open syzbot
[not found] <20260320062304.1097949-1-kartikey406@gmail.com>
2026-03-20 11:05 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69bbc1de.050a0220.3a088d.000f.GAE@google.com \
--to=syzbot+1a7507a194fff09e5c44@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox