[syzbot] [usb?] INFO: task hung in dvb_usb_i2c_exit

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ca91b9500108 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=130c88d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16dc5368580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13def270580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d6e8d6537504/disk-ca91b950.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0de81a10c06a/vmlinux-ca91b950.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0e828bb2de22/bzImage-ca91b950.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0dcc34...@syzkaller.appspotmail.com

INFO: task kworker/0:3:5829 blocked for more than 143 seconds.
Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:3 state:D stack:22760 pid:5829 tgid:5829 ppid:2 task_flags:0x4208060 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x116f/0x5de0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:116
i2c_del_adapter+0x546/0x6f0 drivers/i2c/i2c-core-base.c:1812
dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46
dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline]
dvb_usb_device_exit+0x334/0x580 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
cxusb_probe+0x1c9/0x7d0 drivers/media/usb/dvb-usb/cxusb.c:1664
usb_probe_interface+0x300/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_set_configuration+0x1187/0x1e20 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:957
bus_for_each_drv+0x156/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e4/0x4b0 drivers/base/dd.c:1029
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x1148/0x1a70 drivers/base/core.c:3692
usb_new_device+0xd07/0x1a20 drivers/usb/core/hub.c:2663
hub_port_connect drivers/usb/core/hub.c:5531 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5671 [inline]
port_event drivers/usb/core/hub.c:5831 [inline]
hub_event+0x2eb7/0x4fa0 drivers/usb/core/hub.c:5913
process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c2/0x780 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task syz-executor329:5845 blocked for more than 143 seconds.
Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:28168 pid:5845 tgid:5845 ppid:5817 task_flags:0x400040 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x116f/0x5de0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
device_lock include/linux/device.h:922 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x231/0x6a0 fs/char_dev.c:414
do_dentry_open+0x741/0x1c10 fs/open.c:956
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3880 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4039
do_filp_open+0x20b/0x470 fs/namei.c:4066
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 0000000000010006 R15: 00007ffe7889bf7c
</TASK>
INFO: task syz-executor329:5847 blocked for more than 144 seconds.
Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:28792 pid:5847 tgid:5847 ppid:5820 task_flags:0x400040 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x116f/0x5de0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
device_lock include/linux/device.h:922 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x231/0x6a0 fs/char_dev.c:414
do_dentry_open+0x741/0x1c10 fs/open.c:956
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3880 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4039
do_filp_open+0x20b/0x470 fs/namei.c:4066
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 0000000000010005 R15: 00007ffe7889bf7c
</TASK>
INFO: task syz-executor329:5848 blocked for more than 144 seconds.
Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:28184 pid:5848 tgid:5848 ppid:5814 task_flags:0x400040 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x116f/0x5de0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
device_lock include/linux/device.h:922 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x231/0x6a0 fs/char_dev.c:414
do_dentry_open+0x741/0x1c10 fs/open.c:956
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3880 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4039
do_filp_open+0x20b/0x470 fs/namei.c:4066
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 000000000000ffeb R15: 00007ffe7889bf7c
</TASK>
INFO: task syz-executor329:5850 blocked for more than 144 seconds.
Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:27560 pid:5850 tgid:5850 ppid:5813 task_flags:0x400040 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x116f/0x5de0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
device_lock include/linux/device.h:922 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x231/0x6a0 fs/char_dev.c:414
do_dentry_open+0x741/0x1c10 fs/open.c:956
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3880 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4039
do_filp_open+0x20b/0x470 fs/namei.c:4066
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 000000000000ffeb R15: 00007ffe7889bf7c
</TASK>
INFO: task syz-executor329:5851 blocked for more than 145 seconds.
Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor329 state:D stack:27560 pid:5851 tgid:5851 ppid:5819 task_flags:0x400040 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x116f/0x5de0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
device_lock include/linux/device.h:922 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x231/0x6a0 fs/char_dev.c:414
do_dentry_open+0x741/0x1c10 fs/open.c:956
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3880 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4039
do_filp_open+0x20b/0x470 fs/namei.c:4066
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf4207851
RSP: 002b:00007ffe7889bab0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcdf4207851
RDX: 0000000000000002 RSI: 00007ffe7889bb50 RDI: 00000000ffffff9c
RBP: 00007ffe7889bb50 R08: 000000000000000f R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe7889bf80
R13: 00007ffe7889bfa0 R14: 000000000001054d R15: 00007ffe7889bf7c
</TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6764
2 locks held by getty/5579:
#0: ffff8880326d60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
5 locks held by kworker/0:3/5829:
#0: ffff88801f284948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc9000412fd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
#2: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#2: ffff888145310198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 drivers/usb/core/hub.c:5859
#3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1004
#4: ffff88807ccea160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#4: ffff88807ccea160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1004
4 locks held by udevd/5834:
#0: ffff88802e1f38b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x12c0 fs/seq_file.c:182
#1: ffff88802c20a088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4d/0x240 fs/kernfs/file.c:154
#2: ffff88802f69a4b8 (kn->active#18){.+.+}-{0:0}, at: kernfs_seq_start+0x71/0x240 fs/kernfs/file.c:155
#3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:927 [inline]
#3: ffff88807f727198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
1 lock held by syz-executor329/5845:
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5847:
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5848:
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5850:
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor329/5851:
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#0: ffff888145310198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
2 locks held by dhcpcd/5861:
#0: ffff888012f64408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
#0: ffff888012f64408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
#1: ffffffff8e3caaf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x280/0x3c0 kernel/rcu/tree_exp.h:304
2 locks held by dhcpcd/5862:
#0: ffff888012f62c08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
#0: ffff888012f62c08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
#1: ffffffff8e3caaf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:336

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0xf70/0x12c0 kernel/hung_task.c:437
kthread+0x3c2/0x780 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.15.0-rc4-syzkaller-00021-gca91b9500108 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:81
Code: 95 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 73 aa 1d 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff8e007e10 EFLAGS: 000002c6
RAX: 00000000000e2f7d RBX: 0000000000000000 RCX: ffffffff8b6c4419
RDX: 0000000000000000 RSI: ffffffff8dbdf8c1 RDI: ffffffff8bf47e20
RBP: fffffbfff1c12ee8 R08: 0000000000000001 R09: ffffed10170865bd
R10: ffff8880b8432deb R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e097740 R14: ffffffff9084f110 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881249e4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b05125c680 CR3: 000000000e180000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:748
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
cpuidle_idle_call kernel/sched/idle.c:185 [inline]
do_idle+0x391/0x510 kernel/sched/idle.c:325
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
rest_init+0x16b/0x2b0 init/main.c:743
start_kernel+0x3e9/0x4d0 init/main.c:1099
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:513
x86_64_start_kernel+0xb0/0xc0 arch/x86/kernel/head64.c:494
common_startup_64+0x13e/0x148
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

On Sat, 03 May 2025 14:21:30 -0700

> syzbot found the following issue on:
>
> HEAD commit: ca91b9500108 Merge tag 'v6.15-rc4-ksmbd-server-fixes' of g..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=130c88d4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
> dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16dc5368580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13def270580000
>

#syz test

--- x/drivers/i2c/i2c-core-base.c
+++ y/drivers/i2c/i2c-core-base.c
@@ -1809,7 +1809,6 @@ void i2c_del_adapter(struct i2c_adapter
*/
init_completion(&adap->dev_released);
device_unregister(&adap->dev);
- wait_for_completion(&adap->dev_released);

/* free bus id */
mutex_lock(&core_lock);
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in module_put

Oops: general protection fault, probably for non-canonical address 0xfbd59c00000000bd: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead0000000005e8-0xdead0000000005ef]
CPU: 0 UID: 0 PID: 6827 Comm: syz.3.19 Not tainted 6.15.0-rc4-syzkaller-00296-ge8ab83e34bdc-dirty #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025

RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:raw_atomic_dec_if_positive include/linux/atomic/atomic-arch-fallback.h:2554 [inline]
RIP: 0010:atomic_dec_if_positive include/linux/atomic/atomic-instrumented.h:1594 [inline]
RIP: 0010:module_put.part.0+0x2c/0x1a0 kernel/module/main.c:874
Code: be 04 00 00 00 55 48 89 fd 53 48 8d 9f e8 04 00 00 48 89 df e8 45 85 7b 00 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 37
RSP: 0018:ffffc900030afda0 EFLAGS: 00010a06

RAX: dffffc0000000000 RBX: dead0000000005e8 RCX: 0000000000000000
RDX: 1bd5a000000000bd RSI: 0000000000000004 RDI: ffffc900030afd48
RBP: dead000000000100 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888029df6758
R13: ffff888029f8cfe0 R14: ffffffff87b61660 R15: ffff888029f8cfe0
FS: 0000555565b2c500(0000) GS:ffff8881249e2000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000001b2fd5ffff CR3: 000000006149d000 CR4: 00000000003526f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

i2c_put_adapter drivers/i2c/i2c-core-base.c:2624 [inline]
i2c_put_adapter+0x36/0x60 drivers/i2c/i2c-core-base.c:2619
i2cdev_release+0x53/0xa0 drivers/i2c/i2c-dev.c:632
__fput+0x3ff/0xb70 fs/file_table.c:465
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6f3678e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcf1eb9828 EFLAGS: 00000246
ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f6f369b7ba0 RCX: 00007f6f3678e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f6f369b7ba0 R08: 0000000000000000 R09: 00000003f1eb9b1f
R10: 000000000003fdc8 R11: 0000000000000246 R12: 000000000001e11e
R13: 00007ffcf1eb9920 R14: ffffffffffffffff R15: 00007ffcf1eb9940
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: be 04 00 00 00 mov $0x4,%esi
5: 55 push %rbp
6: 48 89 fd mov %rdi,%rbp
9: 53 push %rbx
a: 48 8d 9f e8 04 00 00 lea 0x4e8(%rdi),%rbx
11: 48 89 df mov %rbx,%rdi
14: e8 45 85 7b 00 call 0x7b855e
19: 48 89 da mov %rbx,%rdx
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 d8 mov %rbx,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 d0 cmp %dl,%al
39: 7c 08 jl 0x43
3b: 84 d2 test %dl,%dl
3d: 0f .byte 0xf
3e: 85 37 test %esi,(%rdi)


Tested on:

commit: e8ab83e3 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=126310f4580000

kernel config: https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1002d774580000

[Edward Adam Davis]

#syz test

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index f44529b40989..855d66043b85 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1600,13 +1600,12 @@ static int cxusb_probe(struct usb_interface *intf,
struct dvb_usb_device *dvbdev;
int ret;

+ if (!cxusb_medion_check_intf(intf)) {
+ return -ENODEV;
+
/* Medion 95700 */
if (!dvb_usb_device_init(intf, &cxusb_medion_properties,
THIS_MODULE, &dvbdev, adapter_nr)) {
- if (!cxusb_medion_check_intf(intf)) {
- ret = -ENODEV;
- goto ret_uninit;
- }

_cxusb_power_ctrl(dvbdev, 1);
ret = cxusb_medion_set_mode(dvbdev, false);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

drivers/media/usb/dvb-usb/cxusb.c:1668:13: error: invalid storage class for function 'cxusb_disconnect'
drivers/media/usb/dvb-usb/cxusb.c:2389:27: error: initializer element is not constant
drivers/media/usb/dvb-usb/cxusb.c:2393:19: error: invalid storage class for function 'cxusb_driver_init'
./include/linux/compiler.h:286:52: error: initializer element is not constant
drivers/media/usb/dvb-usb/cxusb.c:2393:19: error: invalid storage class for function 'cxusb_driver_exit'
drivers/media/usb/dvb-usb/cxusb.c:2393:19: error: initializer element is not constant
drivers/media/usb/dvb-usb/cxusb.c:2400:1: error: expected declaration or statement at end of input


Tested on:

commit: e9565e23 Merge tag 'sched_ext-for-6.15-rc6-fixes' of g..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=ca17f2d2ba38f7a0
dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1509e2f4580000

[Edward Adam Davis]

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+0dcc34...@syzkaller.appspotmail.com
Tested-by: syzbot+0dcc34...@syzkaller.appspotmail.com

Tested on:

commit: e9565e23 Merge tag 'sched_ext-for-6.15-rc6-fixes' of g..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1153f670580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ca187b35f3c61c60

dashboard link: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=147facd4580000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

dvb_usb_device_exit() is entered because the number of alternate setting
is less than 2. Check the USB interface in advance to avoid unnecessary
dvb device initialization and exit.

Reported-by: syzbot+0dcc34...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0dcc341ee61fc9e4032f
Tested-by: syzbot+0dcc34...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
drivers/media/usb/dvb-usb/cxusb.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index f44529b40989..df86ae7106c1 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1601,13 +1601,9 @@ static int cxusb_probe(struct usb_interface *intf,
int ret;

/* Medion 95700 */
- if (!dvb_usb_device_init(intf, &cxusb_medion_properties,
+ if (cxusb_medion_check_intf(intf) &&
+ !dvb_usb_device_init(intf, &cxusb_medion_properties,

THIS_MODULE, &dvbdev, adapter_nr)) {
- if (!cxusb_medion_check_intf(intf)) {
- ret = -ENODEV;
- goto ret_uninit;
- }
-
_cxusb_power_ctrl(dvbdev, 1);
ret = cxusb_medion_set_mode(dvbdev, false);

if (ret)
--
2.43.0