Hello,
syzbot found the following issue on:
HEAD commit: 347385861c50 Linux 6.1.84
git tree: linux-6.1.y
console output:
https://syzkaller.appspot.com/x/log.txt?x=17025d9d180000
kernel config:
https://syzkaller.appspot.com/x/.config?x=40dfd13b04bfc094
dashboard link:
https://syzkaller.appspot.com/bug?extid=74e452172ac5a1e20d64
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/73d2a8622b6e/disk-34738586.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/e7bc2e0101a7/vmlinux-34738586.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/7b96d1168608/bzImage-34738586.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+74e452...@syzkaller.appspotmail.com
usbhid 3-1:0.0: can't add hid device: -71
usbhid: probe of 3-1:0.0 failed with error -71
usb 3-1: USB disconnect, device number 74
============================================
WARNING: possible recursive locking detected
6.1.84-syzkaller #0 Not tainted
--------------------------------------------
kworker/0:14/5096 is trying to acquire lock:
ffff88805ab05218 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x146/0x4b0 kernel/bpf/queue_stack_maps.c:109
but task is already holding lock:
ffff888046600218 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x146/0x4b0 kernel/bpf/queue_stack_maps.c:109
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&qs->lock);
lock(&qs->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
8 locks held by kworker/0:14/5096:
#0: ffff8881432b8538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#1: ffffc90018a7fd20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#2: ffff888144b28190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:837 [inline]
#2: ffff888144b28190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5730 drivers/usb/core/hub.c:5789
#3: ffff888012473548 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_remove_by_name_ns+0x76/0x150 fs/kernfs/dir.c:1645
#4: ffff8880b983aa18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2272 [inline]
#5: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x16a/0x470 kernel/trace/bpf_trace.c:2314
#6: ffff888046600218 (&qs->lock){-.-.}-{2:2}, at: __queue_map_get+0x146/0x4b0 kernel/bpf/queue_stack_maps.c:109
#7: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#7: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#7: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2272 [inline]
#7: ffffffff8d12a980 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run2+0x110/0x410 kernel/trace/bpf_trace.c:2312
stack backtrace:
CPU: 0 PID: 5096 Comm: kworker/0:14 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2983 [inline]
check_deadlock kernel/locking/lockdep.c:3026 [inline]
validate_chain+0x4711/0x5950 kernel/locking/lockdep.c:3812
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
__queue_map_get+0x146/0x4b0 kernel/bpf/queue_stack_maps.c:109
bpf_prog_00798911c748094f+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
bpf_trace_run2+0x1fd/0x410 kernel/trace/bpf_trace.c:2312
trace_contention_end+0x14c/0x190 include/trace/events/lock.h:122
__pv_queued_spin_lock_slowpath+0x935/0xc50 kernel/locking/qspinlock.c:560
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x269/0x370 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0xdd/0x120 kernel/locking/spinlock.c:162
__queue_map_get+0x146/0x4b0 kernel/bpf/queue_stack_maps.c:109
bpf_prog_00798911c748094f+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:989 [inline]
__bpf_prog_run include/linux/filter.h:603 [inline]
bpf_prog_run include/linux/filter.h:610 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2273 [inline]
bpf_trace_run4+0x253/0x470 kernel/trace/bpf_trace.c:2314
__traceiter_sched_switch+0x91/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x2116/0x4550 kernel/sched/core.c:6555
preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:6727
preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6751
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
__raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
_raw_spin_unlock+0x36/0x40 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:391 [inline]
kernfs_put+0x2fe/0x4a0 fs/kernfs/dir.c:561
kernfs_remove_by_name_ns+0xdc/0x150 fs/kernfs/dir.c:1651
sysfs_remove_file include/linux/sysfs.h:629 [inline]
device_remove_file drivers/base/core.c:3045 [inline]
device_del+0x6d2/0xbd0 drivers/base/core.c:3857
usb_disconnect+0x58f/0x8c0 drivers/usb/core/hub.c:2295
hub_port_connect drivers/usb/core/hub.c:5309 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5605 [inline]
port_event drivers/usb/core/hub.c:5761 [inline]
hub_event+0x1f78/0x5730 drivers/usb/core/hub.c:5843
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
process_scheduled_works kernel/workqueue.c:2355 [inline]
worker_thread+0xd04/0x1200 kernel/workqueue.c:2441
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
</TASK>
usb 5-1: new high-speed USB device number 91 using dummy_hcd
usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 5-1: config 0 descriptor??
usbhid 5-1:0.0: can't add hid device: -71
usbhid: probe of 5-1:0.0 failed with error -71
usb 5-1: USB disconnect, device number 91
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup