[syzbot] [nfc?] [net?] WARNING: locking bug in nci_close_device (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 707081b61156 Merge branch 'for-next/core', remote-tracking..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=12ae3185180000
kernel config: https://syzkaller.appspot.com/x/.config?x=caeac3f3565b057a
dashboard link: https://syzkaller.appspot.com/bug?extid=e29c204bd2e3906fe69c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6cad68bf7532/disk-707081b6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1a27e5400778/vmlinux-707081b6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/67dfc53755d0/Image-707081b6.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e29c20...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 0 PID: 10856 at kernel/locking/lockdep.c:232 check_wait_context kernel/locking/lockdep.c:4773 [inline]
WARNING: CPU: 0 PID: 10856 at kernel/locking/lockdep.c:232 __lock_acquire+0x78c/0x763c kernel/locking/lockdep.c:5087
Modules linked in:
CPU: 0 PID: 10856 Comm: syz-executor.1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_wait_context kernel/locking/lockdep.c:4773 [inline]
pc : __lock_acquire+0x78c/0x763c kernel/locking/lockdep.c:5087
lr : hlock_class kernel/locking/lockdep.c:232 [inline]
lr : check_wait_context kernel/locking/lockdep.c:4773 [inline]
lr : __lock_acquire+0x780/0x763c kernel/locking/lockdep.c:5087
sp : ffff800099ba7240
x29: ffff800099ba7500 x28: ffff0000d7f65a00 x27: ffff0000d7f664f0
x26: 1fffe0001afecc9e x25: ffff0000d7f66458 x24: 0000000000000001
x23: 0000000000000003 x22: 0000000000000c17 x21: ffff8000922364c0
x20: 0000000000000000 x19: ffff0000d7f664f4 x18: 1fffe000367fff96
x17: 0000000000000000 x16: ffff80008ad6b09c x15: 0000000000000001
x14: 1fffe00036800002 x13: 0000000000000000 x12: dfff800000000000
x11: 0000000000040000 x10: 0000000000022c3d x9 : afcfeb2b6d9f9a00
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800099ba6b38 x4 : ffff80008ed822c0 x3 : ffff8000805ba130
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
check_wait_context kernel/locking/lockdep.c:4773 [inline]
__lock_acquire+0x78c/0x763c kernel/locking/lockdep.c:5087
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5754
__flush_workqueue+0x14c/0x11c4 kernel/workqueue.c:3146
nci_close_device+0x140/0x5b8 net/nfc/nci/core.c:567
nci_dev_down+0x40/0x54 net/nfc/nci/core.c:639
nfc_dev_down net/nfc/core.c:161 [inline]
nfc_rfkill_set_block+0x14c/0x2d0 net/nfc/core.c:179
rfkill_set_block+0x18c/0x37c net/rfkill/core.c:346
rfkill_fop_write+0x578/0x734 net/rfkill/core.c:1305
vfs_write+0x3c0/0xc3c fs/read_write.c:588
ksys_write+0x15c/0x26c fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:652
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
irq event stamp: 2283
hardirqs last enabled at (2283): [<ffff800080297cac>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1397 [inline]
hardirqs last enabled at (2283): [<ffff800080297cac>] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:5154
hardirqs last disabled at (2282): [<ffff80008ae46784>] __schedule+0x2bc/0x24b4 kernel/sched/core.c:6625
softirqs last enabled at (546): [<ffff80008003165c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (544): [<ffff800080031628>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff800000000018
KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000018] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 10856 Comm: syz-executor.1 Tainted: G W 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_wait_context kernel/locking/lockdep.c:4773 [inline]
pc : __lock_acquire+0x568/0x763c kernel/locking/lockdep.c:5087
lr : hlock_class kernel/locking/lockdep.c:232 [inline]
lr : check_wait_context kernel/locking/lockdep.c:4773 [inline]
lr : __lock_acquire+0x780/0x763c kernel/locking/lockdep.c:5087
sp : ffff800099ba7240
x29: ffff800099ba7500 x28: ffff0000d7f65a00 x27: ffff0000d7f664f0
x26: 1fffe0001afecc9e x25: ffff0000d7f66458 x24: 0000000000000001
x23: 0000000000000003 x22: 0000000000000c17 x21: ffff8000922364c0
x20: 0000000000000000 x19: 00000000000000c4 x18: 1fffe000367fff96
x17: 0000000000000000 x16: ffff80008ad6b09c x15: 0000000000000001
x14: 1fffe00036800002 x13: 0000000000000000 x12: dfff800000000000
x11: 0000000000040000 x10: 0000000000022c3d x9 : afcfeb2b6d9f9a00
x8 : 0000000000000018 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800099ba6b38 x4 : ffff80008ed822c0 x3 : ffff8000805ba130
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
check_wait_context kernel/locking/lockdep.c:4773 [inline]
__lock_acquire+0x568/0x763c kernel/locking/lockdep.c:5087
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5754
__flush_workqueue+0x14c/0x11c4 kernel/workqueue.c:3146
nci_close_device+0x140/0x5b8 net/nfc/nci/core.c:567
nci_dev_down+0x40/0x54 net/nfc/nci/core.c:639
nfc_dev_down net/nfc/core.c:161 [inline]
nfc_rfkill_set_block+0x14c/0x2d0 net/nfc/core.c:179
rfkill_set_block+0x18c/0x37c net/rfkill/core.c:346
rfkill_fop_write+0x578/0x734 net/rfkill/core.c:1305
vfs_write+0x3c0/0xc3c fs/read_write.c:588
ksys_write+0x15c/0x26c fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:652
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: 34000ee8 aa1f03e8 91031113 d343fe68 (38ec6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 34000ee8 cbz w8, 0x1dc
4: aa1f03e8 mov x8, xzr
8: 91031113 add x19, x8, #0xc4
c: d343fe68 lsr x8, x19, #3
* 10: 38ec6908 ldrsb w8, [x8, x12] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14337af9180000
kernel config: https://syzkaller.appspot.com/x/.config?x=4d90a36f0cab495a

dashboard link: https://syzkaller.appspot.com/bug?extid=e29c204bd2e3906fe69c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1601053d180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1201b6d3180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f6c04726a2ae/disk-fe46a7dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/09c26ce901ea/vmlinux-fe46a7dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/134acf7f5322/bzImage-fe46a7dd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e29c20...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)

WARNING: CPU: 1 PID: 5095 at kernel/locking/lockdep.c:232 hlock_class kernel/locking/lockdep.c:232 [inline]
WARNING: CPU: 1 PID: 5095 at kernel/locking/lockdep.c:232 check_wait_context kernel/locking/lockdep.c:4773 [inline]
WARNING: CPU: 1 PID: 5095 at kernel/locking/lockdep.c:232 __lock_acquire+0x573/0x1fd0 kernel/locking/lockdep.c:5087
Modules linked in:
CPU: 1 PID: 5095 Comm: syz-executor108 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:hlock_class kernel/locking/lockdep.c:232 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4773 [inline]
RIP: 0010:__lock_acquire+0x573/0x1fd0 kernel/locking/lockdep.c:5087
Code: 00 00 83 3d ce 9c 14 0e 00 75 23 90 48 c7 c7 80 c0 aa 8b 48 c7 c6 20 c3 aa 8b e8 38 24 e6 ff 48 ba 00 00 00 00 00 fc ff df 90 <0f> 0b 90 90 90 31 db 48 81 c3 c4 00 00 00 48 89 d8 48 c1 e8 03 0f
RSP: 0018:ffffc9000442ef50 EFLAGS: 00010046
RAX: de5230b6c68f0a00 RBX: 000000000000066c RCX: ffff888023db3c00
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000014 R08: ffffffff8157cb22 R09: 1ffff110172a51a2
R10: dffffc0000000000 R11: ffffed10172a51a3 R12: 0000000000000001
R13: ffff888023db3c00 R14: 0000000000000014 R15: ffff888023db4798
FS: 00007f4496c8a6c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4496d2ce90 CR3: 000000007824c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
touch_wq_lockdep_map kernel/workqueue.c:3901 [inline]
__flush_workqueue+0x1c9/0x1710 kernel/workqueue.c:3943
nci_close_device+0x301/0x610 net/nfc/nci/core.c:567
nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:639
nfc_dev_down+0x184/0x280 net/nfc/core.c:161
nfc_genl_dev_down+0x84/0xd0 net/nfc/netlink.c:791
genl_family_rcv_msg_doit net/netlink/genetlink.c:1113 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1193 [inline]
genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1208
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1217
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x8e1/0xcb0 net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f4496cf1a89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4496c8a208 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f4496d7b378 RCX: 00007f4496cf1a89
RDX: 0000000000000000 RSI: 0000000020000780 RDI: 0000000000000005
RBP: 00007f4496d7b370 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00007f4496d7b37c
R13: 00007f4496d4819c R14: 00007ffc71898120 R15: 00007ffc71898208
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Hillf Danton]

On Wed, 03 Apr 2024 12:49:25 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1201b6d3180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe46a7dd189e

--- x/net/nfc/nci/core.c
+++ y/net/nfc/nci/core.c
@@ -560,7 +560,8 @@ static int nci_close_device(struct nci_d
*/
mutex_lock(&ndev->req_lock);

- if (!test_and_clear_bit(NCI_UP, &ndev->flags)) {
+ if (!test_and_clear_bit(NCI_UP, &ndev->flags) &&
+ !test_bit(NCI_UNREG +1, &ndev->flags)) {
/* Need to flush the cmd wq in case
* there is a queued/running cmd_work
*/
@@ -601,6 +602,7 @@ static int nci_close_device(struct nci_d

/* Clear flags except NCI_UNREG */
ndev->flags &= BIT(NCI_UNREG);
+ set_bit(NCI_UNREG +1, &ndev->flags);

mutex_unlock(&ndev->req_lock);

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in nci_send_cmd

------------[ cut here ]------------
WARNING: CPU: 0 PID: 5484 at kernel/workqueue.c:2322 __queue_work+0xc6a/0xec0 kernel/workqueue.c:2321
Modules linked in:
CPU: 0 PID: 5484 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024

RIP: 0010:__queue_work+0xc6a/0xec0 kernel/workqueue.c:2321
Code: ff e8 1a e5 35 00 eb 21 e8 13 e5 35 00 eb 1a e8 0c e5 35 00 eb 13 e8 05 e5 35 00 90 0f 0b 90 e9 74 fd ff ff e8 f7 e4 35 00 90 <0f> 0b 90 48 83 c4 68 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc
RSP: 0018:ffffc9000511f180 EFLAGS: 00010093
RAX: ffffffff815f0f3d RBX: ffff888028141e00 RCX: ffff888028141e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff815f0413 R09: 1ffff1100e91481f
R10: dffffc0000000000 R11: ffffed100e914820 R12: dffffc0000000000
R13: ffff888029ccf1c0 R14: ffff888029ccf000 R15: 0000000000000008
FS: 00007f9177b796c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055d7c2a04000 CR3: 000000002c63c000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

queue_work_on+0x14f/0x250 kernel/workqueue.c:2435
queue_work include/linux/workqueue.h:605 [inline]
nci_send_cmd+0x1f8/0x320 net/nfc/nci/core.c:1388
nci_reset_req net/nfc/nci/core.c:167 [inline]
__nci_request net/nfc/nci/core.c:108 [inline]
nci_close_device+0x321/0x680 net/nfc/nci/core.c:588
nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:641

nfc_dev_down+0x184/0x280 net/nfc/core.c:161
nfc_genl_dev_down+0x84/0xd0 net/nfc/netlink.c:791
genl_family_rcv_msg_doit net/netlink/genetlink.c:1113 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1193 [inline]
genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1208
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1217
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x8e1/0xcb0 net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75

RIP: 0033:0x7f9176e7dde9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9177b790c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f9176fabf80 RCX: 00007f9176e7dde9

RDX: 0000000000000000 RSI: 0000000020000780 RDI: 0000000000000005

RBP: 00007f9176eca47a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f9176fabf80 R15: 00007ffe23b02ca8
</TASK>


Tested on:

commit: fe46a7dd Merge tag 'sound-6.9-rc1' of git://git.kernel..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=108db6d3180000

kernel config: https://syzkaller.appspot.com/x/.config?x=4d90a36f0cab495a
dashboard link: https://syzkaller.appspot.com/bug?extid=e29c204bd2e3906fe69c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14bceed3180000

[Hillf Danton]

On Wed, 03 Apr 2024 12:49:25 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1201b6d3180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe46a7dd189e

--- x/net/nfc/nci/core.c
+++ y/net/nfc/nci/core.c

@@ -560,6 +560,10 @@ static int nci_close_device(struct nci_d
*/
mutex_lock(&ndev->req_lock);

+ if (test_and_set_bit(NCI_UNREG +1, &ndev->flags)) {
+ mutex_unlock(&ndev->req_lock);
+ return 0;
+ }
if (!test_and_clear_bit(NCI_UP, &ndev->flags)) {

/* Need to flush the cmd wq in case
* there is a queued/running cmd_work

@@ -601,6 +605,7 @@ static int nci_close_device(struct nci_d

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+e29c20...@syzkaller.appspotmail.com

Tested on:

commit: fe46a7dd Merge tag 'sound-6.9-rc1' of git://git.kernel..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=15616223180000

kernel config: https://syzkaller.appspot.com/x/.config?x=4d90a36f0cab495a
dashboard link: https://syzkaller.appspot.com/bug?extid=e29c204bd2e3906fe69c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1110ad29180000

Note: testing is done by a robot and is best-effort only.