[syzbot] [usb?] INFO: task hung in i2c_tiny_usb_disconnect

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f0b9d8eb98df Merge tag 'nfsd-6.19-3' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11086922580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=179ba83a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113511fc580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4dbba2a806a3/disk-f0b9d8eb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a52c0f94de7/vmlinux-f0b9d8eb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5ddf9a24988b/bzImage-f0b9d8eb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+30b783...@syzkaller.appspotmail.com

INFO: task kworker/1:0:24 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0 state:D stack:24120 pid:24 tgid:24 ppid:2 task_flags:0x4288060 flags:0x00080000
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
i2c_del_adapter+0x640/0x850 drivers/i2c/i2c-core-base.c:1814
i2c_tiny_usb_disconnect+0x42/0x100 drivers/i2c/busses/i2c-tiny-usb.c:290
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:571 [inline]
device_remove+0x125/0x170 drivers/base/dd.c:563
__device_release_driver drivers/base/dd.c:1282 [inline]
device_release_driver_internal+0x44b/0x620 drivers/base/dd.c:1305
bus_remove_device+0x22f/0x450 drivers/base/bus.c:616
device_del+0x396/0x9f0 drivers/base/core.c:3878
usb_disable_device+0x355/0x820 drivers/usb/core/message.c:1418
usb_disconnect+0x2e1/0x9e0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1d84/0x52f0 drivers/usb/core/hub.c:5953
process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
INFO: task syz.0.273:6595 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.273 state:D stack:26256 pid:6595 tgid:6595 ppid:5924 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776
device_lock include/linux/device.h:895 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:414
do_dentry_open+0x748/0x1590 fs/open.c:962
vfs_open+0x82/0x3f0 fs/open.c:1094
do_open fs/namei.c:4628 [inline]
path_openat+0x2078/0x3140 fs/namei.c:4787
do_filp_open+0x20b/0x470 fs/namei.c:4814
do_sys_openat2+0x121/0x290 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1447
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3b2d38df90
RSP: 002b:00007ffdb4e6d020 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000188301 RCX: 00007f3b2d38df90
RDX: 0000000000188301 RSI: 00007ffdb4e6d0c0 RDI: 00000000ffffff9c
RBP: 00007ffdb4e6d0c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd
R13: 00007f3b2d5e5fa0 R14: 00007f3b2d5e5fa0 R15: 0000000000000003
</TASK>
INFO: task syz.2.274:6596 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.274 state:D stack:26224 pid:6596 tgid:6596 ppid:5932 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776
device_lock include/linux/device.h:895 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:414
do_dentry_open+0x748/0x1590 fs/open.c:962
vfs_open+0x82/0x3f0 fs/open.c:1094
do_open fs/namei.c:4628 [inline]
path_openat+0x2078/0x3140 fs/namei.c:4787
do_filp_open+0x20b/0x470 fs/namei.c:4814
do_sys_openat2+0x121/0x290 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1447
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd7cbb8df90
RSP: 002b:00007fff0be25800 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000188301 RCX: 00007fd7cbb8df90
RDX: 0000000000188301 RSI: 00007fff0be258a0 RDI: 00000000ffffff9c
RBP: 00007fff0be258a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd
R13: 00007fd7cbde5fa0 R14: 00007fd7cbde5fa0 R15: 0000000000000003
</TASK>
INFO: task syz.3.275:6597 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.275 state:D stack:26256 pid:6597 tgid:6597 ppid:5934 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776
device_lock include/linux/device.h:895 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:414
do_dentry_open+0x748/0x1590 fs/open.c:962
vfs_open+0x82/0x3f0 fs/open.c:1094
do_open fs/namei.c:4628 [inline]
path_openat+0x2078/0x3140 fs/namei.c:4787
do_filp_open+0x20b/0x470 fs/namei.c:4814
do_sys_openat2+0x121/0x290 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1447
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6f3df8df90
RSP: 002b:00007ffe4db0dd90 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000188301 RCX: 00007f6f3df8df90
RDX: 0000000000188301 RSI: 00007ffe4db0de30 RDI: 00000000ffffff9c
RBP: 00007ffe4db0de30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd
R13: 00007f6f3e1e5fa0 R14: 00007f6f3e1e5fa0 R15: 0000000000000003
</TASK>
INFO: task syz.1.276:6598 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.276 state:D stack:25704 pid:6598 tgid:6598 ppid:5930 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776
device_lock include/linux/device.h:895 [inline]
usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
chrdev_open+0x234/0x6a0 fs/char_dev.c:414
do_dentry_open+0x748/0x1590 fs/open.c:962
vfs_open+0x82/0x3f0 fs/open.c:1094
do_open fs/namei.c:4628 [inline]
path_openat+0x2078/0x3140 fs/namei.c:4787
do_filp_open+0x20b/0x470 fs/namei.c:4814
do_sys_openat2+0x121/0x290 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1447
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36b5b8df90
RSP: 002b:00007ffd7720b280 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000188301 RCX: 00007f36b5b8df90
RDX: 0000000000188301 RSI: 00007ffd7720b320 RDI: 00000000ffffff9c
RBP: 00007ffd7720b320 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd
R13: 00007f36b5de5fa0 R14: 00007f36b5de5fa0 R15: 0000000000000003
</TASK>

Showing all locks held in the system:
5 locks held by kworker/1:0/24:
#0: ffff8880212a0948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 kernel/workqueue.c:3232
#1: ffffc900001e7c90 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 kernel/workqueue.c:3233
#2: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x52f0 drivers/usb/core/hub.c:5899
#3: ffff888073ad6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888073ad6198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9e0 drivers/usb/core/hub.c:2336
#4: ffff88807976e160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88807976e160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1104 [inline]
#4: ffff88807976e160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa4/0x620 drivers/base/dd.c:1302
1 lock held by khungtaskd/31:
#0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
1 lock held by klogd/5174:
#0: ffff8880b853ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:639
2 locks held by getty/5581:
#0: ffff88814d52e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x1510 drivers/tty/n_tty.c:2211
1 lock held by syz.0.273/6595:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.2.274/6596:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.3.275/6597:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.1.276/6598:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.5.282/6719:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.6.283/6721:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.7.284/6723:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.8.285/6726:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.0.293/6836:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.2.294/6840:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.1.295/6841:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.9.292/6842:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.3.303/6904:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.7.305/6951:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.5.304/6961:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.6.306/6964:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.8.313/7018:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.0.315/7049:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.2.317/7073:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.9.316/7078:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.1.323/7112:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.3.325/7142:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.7.326/7193:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.5.328/7194:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.6.333/7234:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.8.335/7260:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.0.337/7304:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.2.338/7305:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.9.343/7345:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.1.344/7367:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.3.347/7416:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
2 locks held by kworker/u8:53/7419:
#0: ffff8880b853ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:639
#1: ffff8880b8524608 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline]
#1: ffff8880b8524608 (psi_seq){-.-.}-{0:0}, at: __schedule+0x19b1/0x6150 kernel/sched/core.c:6857
1 lock held by syz.5.348/7421:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz.7.352/7454:
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#0: ffff88802a025198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 drivers/usb/core/devio.c:1054
1 lock held by syz-executor/7455:
#0: ffffffff8e3d4df8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 kernel/rcu/tree_exp.h:311
3 locks held by kworker/0:14/7462:
#0: ffff88813ff51948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 kernel/workqueue.c:3232
#1: ffffc9000f2c7c90 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 kernel/workqueue.c:3233
#2: ffff888035684240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x65f0 drivers/net/netdevsim/fib.c:1490

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x133/0x180 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xe66/0x1180 kernel/hung_task.c:515
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 7485 Comm: syz.6.354 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:io_serial_in+0x87/0xb0 drivers/tty/serial/8250/8250_port.c:401
Code: 75 8c fc 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c e9 3d d0 48 06 e8 38 4a f6 fc eb a2 e8 c1 4a
RSP: 0018:ffffc9000f2a78c8 EFLAGS: 00000002
RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: ffffffff85327330 RDI: ffffffff9aeedc40
RBP: ffffffff9aeedc00 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: ffff888087e80b30 R12: 0000000000000000
R13: 0000000000000020 R14: fffffbfff35ddbda R15: dffffc0000000000
FS: 0000555573d50500(0000) GS:ffff8881249f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f00b51733e0 CR3: 00000000a834a000 CR4: 00000000003526f0
Call Trace:
<TASK>
serial_in drivers/tty/serial/8250/8250.h:128 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline]
wait_for_lsr+0x13a/0x210 drivers/tty/serial/8250/8250_port.c:1961
fifo_wait_for_lsr drivers/tty/serial/8250/8250_port.c:3234 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3257 [inline]
serial8250_console_write+0xf81/0x1890 drivers/tty/serial/8250/8250_port.c:3342
console_emit_next_record kernel/printk/printk.c:3129 [inline]
console_flush_one_record+0x796/0xc60 kernel/printk/printk.c:3215
console_flush_all kernel/printk/printk.c:3289 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
console_unlock+0xef/0x240 kernel/printk/printk.c:3359
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426
_printk+0xc7/0x100 kernel/printk/printk.c:2451
usb_gadget_register_driver_owner+0x1fb/0x330 drivers/usb/gadget/udc/core.c:1729
raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
raw_ioctl+0x17ec/0x2e60 drivers/usb/gadget/legacy/raw_gadget.c:1307
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00b518f34b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffe8bc9e9d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f00b518f34b
RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003
RBP: 00007ffe8bc9faa0 R08: 0000000000000000 R09: 00362e6364755f79
R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe8bc9ea70 R14: 0000200000000440 R15: 00007f00b5510320
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkall...@googlegroups.com.

***

Subject: Re: [syzbot] [usb?] INFO: task hung in i2c_tiny_usb_disconnect
Author: coderl...@gmail.com

#syz test
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 57dfe5f1a7d9..ee41d0469882 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -12,6 +12,7 @@
#include <linux/slab.h>
#include <linux/string_choices.h>
#include <linux/types.h>
+#include <linux/workqueue.h>

/* include interfaces to usb layer */
#include <linux/usb.h>
@@ -172,6 +173,8 @@ struct i2c_tiny_usb {
struct usb_device *usb_dev; /* the usb device for this device */
struct usb_interface *interface; /* the interface for this device */
struct i2c_adapter adapter; /* i2c related things */
+ bool disconnected; /* set to true on disconnect */
+ struct work_struct release_work; /* work struct to release the adapter */
};

static int usb_read(struct i2c_adapter *adapter, int cmd,
@@ -184,6 +187,11 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
if (!dmadata)
return -ENOMEM;

+ if (READ_ONCE(dev->disconnected)) {
+ kfree(dmadata);
+ return -ENODEV;
+ }
+
/* do control transfer */
ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
@@ -204,6 +212,11 @@ static int usb_write(struct i2c_adapter *adapter, int cmd,
if (!dmadata)
return -ENOMEM;

+ if (READ_ONCE(dev->disconnected)) {
+ kfree(dmadata);
+ return -ENODEV;
+ }
+
/* do control transfer */
ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
@@ -219,6 +232,15 @@ static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
kfree(dev);
}

+static void i2c_tiny_usb_release(struct work_struct *work)
+{
+ struct i2c_tiny_usb *dev = container_of(work, struct i2c_tiny_usb,
+ release_work);
+
+ i2c_del_adapter(&dev->adapter);
+ i2c_tiny_usb_free(dev);
+}
+
static int i2c_tiny_usb_probe(struct usb_interface *interface,
const struct usb_device_id *id)
{
@@ -268,6 +290,8 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,

dev->adapter.dev.parent = &dev->interface->dev;

+ INIT_WORK(&dev->release_work, i2c_tiny_usb_release);
+
/* and finally attach to i2c layer */
i2c_add_adapter(&dev->adapter);

@@ -287,9 +311,9 @@ static void i2c_tiny_usb_disconnect(struct usb_interface *interface)
{
struct i2c_tiny_usb *dev = usb_get_intfdata(interface);

- i2c_del_adapter(&dev->adapter);
usb_set_intfdata(interface, NULL);
- i2c_tiny_usb_free(dev);
+ atomic_set(&dev->disconnected, 1);
+ queue_work(system_long_wq, &dev->release_work);

dev_dbg(&interface->dev, "disconnected\n");

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file drivers/i2c/busses/i2c-tiny-usb.c
Hunk #1 FAILED at 12.
Hunk #2 FAILED at 172.
Hunk #5 FAILED at 229.
Hunk #7 succeeded at 299 with fuzz 1.
3 out of 7 hunks FAILED



Tested on:

commit: 0f61b186 Linux 6.19-rc5
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=17c239fc580000

[syzbot]

For archival purposes, forwarding an incoming command email to
syzkall...@googlegroups.com.

***

Subject: Re: [syzbot] [usb?] INFO: task hung in i2c_tiny_usb_disconnect
Author: coderl...@gmail.com

#syz test

diff --git a/drivers/i2c/busses/i2c-tiny-usb.c
b/drivers/i2c/busses/i2c-tiny-usb.c

index 57dfe5f1a7d9..79b7c97514c9 100644

+    WRITE_ONCE(dev->disconnected, true);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file drivers/i2c/busses/i2c-tiny-usb.c
Hunk #1 FAILED at 12.
Hunk #2 FAILED at 172.

2 out of 2 hunks FAILED

Tested on:

commit: 0f61b186 Linux 6.19-rc5
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765
dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=11d9b922580000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 72.435490][ T30] audit: type=1400 audit(1768278064.403:80): avc: denied { open } for pid=5828 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 72.472115][ T30] audit: type=1400 audit(1768278064.423:81): avc: denied { mounton } for pid=5828 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 72.614307][ T30] audit: type=1400 audit(1768278064.723:82): avc: denied { mounton } for pid=5827 comm="syz-executor" path="/root/syzkaller.oRvwjY/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 72.647781][ T30] audit: type=1400 audit(1768278064.723:83): avc: denied { mount } for pid=5827 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 72.680449][ T5827] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 72.710613][ T30] audit: type=1400 audit(1768278064.723:84): avc: denied { mounton } for pid=5827 comm="syz-executor" path="/root/syzkaller.oRvwjY/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[ 72.747865][ T30] audit: type=1400 audit(1768278064.723:85): avc: denied { mount } for pid=5827 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
[ 72.770404][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.778851][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 72.834660][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 72.843508][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 73.164131][ T5138] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 73.172297][ T5138] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 73.180246][ T5138] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 73.196749][ T5138] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 73.204345][ T5138] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 74.264425][ T5845] chnl_net:caif_netlink_parms(): no params data found
[ 74.807351][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.821439][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state
[ 74.828899][ T5845] bridge_slave_0: entered allmulticast mode
[ 74.836593][ T5845] bridge_slave_0: entered promiscuous mode
[ 74.864560][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.871733][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state
[ 74.879122][ T5845] bridge_slave_1: entered allmulticast mode
[ 74.886071][ T5845] bridge_slave_1: entered promiscuous mode
[ 74.955828][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 74.987690][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 75.079143][ T5845] team0: Port device team_slave_0 added
[ 75.098503][ T5845] team0: Port device team_slave_1 added
[ 75.204805][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 75.211766][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 75.239767][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 75.255335][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 75.262370][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 75.298894][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 75.443715][ T5845] hsr_slave_0: entered promiscuous mode
[ 75.449871][ T5845] hsr_slave_1: entered promiscuous mode
[ 75.592860][ T5845] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 75.608307][ T5845] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 75.617970][ T5845] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 75.628160][ T5845] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 75.708538][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0
[ 75.728539][ T5845] 8021q: adding VLAN 0 to HW filter on device team0
[ 75.742231][ T34] bridge0: port 1(bridge_slave_0) entered blocking state
[ 75.749498][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 75.768885][ T50] bridge0: port 2(bridge_slave_1) entered blocking state
[ 75.776013][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 75.907923][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 75.945758][ T5845] veth0_vlan: entered promiscuous mode
[ 75.957083][ T5845] veth1_vlan: entered promiscuous mode
[ 75.981363][ T5845] veth0_macvtap: entered promiscuous mode
[ 75.990660][ T5845] veth1_macvtap: entered promiscuous mode
[ 76.006870][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 76.021233][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 76.035693][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.046111][ T50] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.056220][ T50] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.065691][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2026/01/13 04:21:08 executed programs: 0
[ 76.180451][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 76.188555][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 76.196772][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 76.210549][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 76.220325][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 76.223744][ T72] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 76.302193][ T72] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 76.393644][ T72] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 76.413627][ T5926] chnl_net:caif_netlink_parms(): no params data found
[ 76.438442][ T72] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 76.494052][ T5926] bridge0: port 1(bridge_slave_0) entered blocking state
[ 76.501225][ T5926] bridge0: port 1(bridge_slave_0) entered disabled state
[ 76.508469][ T5926] bridge_slave_0: entered allmulticast mode
[ 76.515622][ T5926] bridge_slave_0: entered promiscuous mode
[ 76.523432][ T5926] bridge0: port 2(bridge_slave_1) entered blocking state
[ 76.530728][ T5926] bridge0: port 2(bridge_slave_1) entered disabled state
[ 76.538432][ T5926] bridge_slave_1: entered allmulticast mode
[ 76.546031][ T5926] bridge_slave_1: entered promiscuous mode
[ 76.578006][ T5926] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 76.589208][ T5926] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 76.615543][ T5926] team0: Port device team_slave_0 added
[ 76.622696][ T5926] team0: Port device team_slave_1 added
[ 76.645027][ T5926] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 76.651985][ T5926] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 76.678290][ T5926] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 76.690400][ T5926] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 76.697754][ T5926] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 76.726622][ T5926] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 76.762434][ T5926] hsr_slave_0: entered promiscuous mode
[ 76.768716][ T5926] hsr_slave_1: entered promiscuous mode
[ 76.775549][ T5926] debugfs: 'hsr0' already exists in 'hsr'
[ 76.781345][ T5926] Cannot create hsr debugfs directory
[ 78.304272][ T5138] Bluetooth: hci0: command tx timeout
[ 78.996240][ T72] bridge_slave_1: left allmulticast mode
[ 79.002028][ T72] bridge_slave_1: left promiscuous mode
[ 79.009209][ T72] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.021301][ T72] bridge_slave_0: left allmulticast mode
[ 79.027964][ T72] bridge_slave_0: left promiscuous mode
[ 79.034032][ T72] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.289281][ T72] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 79.302958][ T72] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 79.313901][ T72] bond0 (unregistering): Released all slaves
[ 79.411479][ T72] hsr_slave_0: left promiscuous mode
[ 79.418172][ T72] hsr_slave_1: left promiscuous mode
[ 79.424372][ T72] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 79.431764][ T72] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 79.443151][ T72] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 79.450543][ T72] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 79.464996][ T72] veth1_macvtap: left promiscuous mode
[ 79.470591][ T72] veth0_macvtap: left promiscuous mode
[ 79.476732][ T72] veth1_vlan: left promiscuous mode
[ 79.482025][ T72] veth0_vlan: left promiscuous mode
[ 79.704321][ T72] team0 (unregistering): Port device team_slave_1 removed
[ 79.727145][ T72] team0 (unregistering): Port device team_slave_0 removed
[ 80.255625][ T5926] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 80.269626][ T5926] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 80.282305][ T5926] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.301156][ T5926] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.379053][ T5926] 8021q: adding VLAN 0 to HW filter on device bond0
[ 80.393475][ T5138] Bluetooth: hci0: command tx timeout
[ 80.396938][ T5926] 8021q: adding VLAN 0 to HW filter on device team0
[ 80.418036][ T3673] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.425216][ T3673] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.436608][ T3673] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.443785][ T3673] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 80.681996][ T5926] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 80.742496][ T5926] veth0_vlan: entered promiscuous mode
[ 80.755265][ T5926] veth1_vlan: entered promiscuous mode
[ 80.789608][ T5926] veth0_macvtap: entered promiscuous mode
[ 80.800489][ T5926] veth1_macvtap: entered promiscuous mode
[ 80.822452][ T5926] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 80.838062][ T5926] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 80.854331][ T72] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.875850][ T72] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.887437][ T72] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.903437][ T72] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 80.982693][ T1093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 81.002995][ T1093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 81.039017][ T3673] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 81.047802][ T3673] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 81.437183][ T43] cfg80211: failed to load regulatory.db


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2779563656=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at d6526ea3e
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/cchrMEKM.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15184052580000


Tested on:

commit: b71e635f Merge tag 'cgroup-for-6.19-rc5-fixes' of git:..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=1859476832863c41
dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8

compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=153f8052580000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout kernel repo git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/mater: failed to run ["git" "fetch" "--force" "f569e972c8e9057ee9c286220c83a480ebf30cc5" "mater"]: exit status 128


Tested on:

commit: [unknown
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git mater
kernel config: https://syzkaller.appspot.com/x/.config?x=a11e0f726bfb6765

dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=15e7a99a580000

[weipeng]

[weipeng]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[weipeng]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git mater

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+30b783...@syzkaller.appspotmail.com
Tested-by: syzbot+30b783...@syzkaller.appspotmail.com

Tested on:

commit: b71e635f Merge tag 'cgroup-for-6.19-rc5-fixes' of git:..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=17f0699a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1859476832863c41
dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8

compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=117d15fa580000

Note: testing is done by a robot and is best-effort only.

[Oliver Neukum]

On 13.01.26 08:52, weipeng wrote:

> @@ -287,9 +311,9 @@ static void i2c_tiny_usb_disconnect(struct usb_interface *interface)
> {
> struct i2c_tiny_usb *dev = usb_get_intfdata(interface);
>
> - i2c_del_adapter(&dev->adapter);
> usb_set_intfdata(interface, NULL);
> - i2c_tiny_usb_free(dev);
> + WRITE_ONCE(dev->disconnected, true);
> + queue_work(system_long_wq, &dev->release_work);

Hi,

I am sorry, but this fix is looking a bit fishy.
For once what prevents the driver from being unloaded
with a work item queued after disconnect() has run?
How do you make sure that the disconnected flag is ever read?

Regards
Oliver

[weipeng]

On Tue, 13 Jan 2026 10:49:16, Oliver Neukum wrote:

> For once what prevents the driver from being unloaded
> with a work item queued after disconnect() has run?
> How do you make sure that the disconnected flag is ever read?

Hi,

Did you say that we can't make sure the usb_read() and usb_write()
is prevented after the dev->disconnected is set to true?
It is indeed a problem. I will send a new patch soon.

Thanks for review!

[weipeng]

diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 57dfe5f1a7d9..30679c2b787b 100644

--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -12,6 +12,7 @@
#include <linux/slab.h>
#include <linux/string_choices.h>
#include <linux/types.h>
+#include <linux/workqueue.h>

/* include interfaces to usb layer */
#include <linux/usb.h>

@@ -172,6 +173,9 @@ struct i2c_tiny_usb {

struct usb_device *usb_dev; /* the usb device for this device */
struct usb_interface *interface; /* the interface for this device */
struct i2c_adapter adapter; /* i2c related things */
+ bool disconnected; /* set to true on disconnect */
+ struct work_struct release_work; /* work struct to release the adapter */

+ struct mutex usb_lock; /* lock for usb operations */

};

static int usb_read(struct i2c_adapter *adapter, int cmd,

@@ -184,11 +188,20 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
if (!dmadata)
return -ENOMEM;

+ mutex_lock(&dev->usb_lock);
+ if (dev->disconnected) {
+ mutex_unlock(&dev->usb_lock);

+ kfree(dmadata);
+ return -ENODEV;
+ }
+
/* do control transfer */
ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |

USB_DIR_IN, value, index, dmadata, len, 2000);

+ mutex_unlock(&dev->usb_lock);
+
memcpy(data, dmadata, len);
kfree(dmadata);
return ret;
@@ -204,11 +217,20 @@ static int usb_write(struct i2c_adapter *adapter, int cmd,
if (!dmadata)
return -ENOMEM;

+ mutex_lock(&dev->usb_lock);
+ if (dev->disconnected) {
+ mutex_unlock(&dev->usb_lock);

+ kfree(dmadata);
+ return -ENODEV;
+ }
+
/* do control transfer */
ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,

value, index, dmadata, len, 2000);

+ mutex_unlock(&dev->usb_lock);
+
kfree(dmadata);
return ret;
}
@@ -219,6 +241,15 @@ static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)

kfree(dev);
}

+static void i2c_tiny_usb_release(struct work_struct *work)
+{
+ struct i2c_tiny_usb *dev = container_of(work, struct i2c_tiny_usb,
+ release_work);
+
+ i2c_del_adapter(&dev->adapter);
+ i2c_tiny_usb_free(dev);
+}
+
static int i2c_tiny_usb_probe(struct usb_interface *interface,
const struct usb_device_id *id)
{

@@ -239,6 +270,7 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,

dev->usb_dev = usb_get_dev(interface_to_usbdev(interface));
dev->interface = interface;
+ mutex_init(&dev->usb_lock);

/* save our data pointer in this interface device */
usb_set_intfdata(interface, dev);
@@ -268,6 +300,8 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,

dev->adapter.dev.parent = &dev->interface->dev;

+ INIT_WORK(&dev->release_work, i2c_tiny_usb_release);
+
/* and finally attach to i2c layer */
i2c_add_adapter(&dev->adapter);

@@ -287,9 +321,12 @@ static void i2c_tiny_usb_disconnect(struct usb_interface *interface)

{
struct i2c_tiny_usb *dev = usb_get_intfdata(interface);

- i2c_del_adapter(&dev->adapter);

+ mutex_lock(&dev->usb_lock);
usb_set_intfdata(interface, NULL);
- i2c_tiny_usb_free(dev);
+ dev->disconnected = true;
+ mutex_unlock(&dev->usb_lock);
+

[weipeng]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+30b783...@syzkaller.appspotmail.com
Tested-by: syzbot+30b783...@syzkaller.appspotmail.com

Tested on:

commit: b71e635f Merge tag 'cgroup-for-6.19-rc5-fixes' of git:..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=14a0a59a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=1859476832863c41
dashboard link: https://syzkaller.appspot.com/bug?extid=30b78308ba7e64647ff8
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1331f922580000

[Oliver Neukum]

Hi,

On 13.01.26 16:47, weipeng wrote:

> @@ -287,9 +321,12 @@ static void i2c_tiny_usb_disconnect(struct usb_interface *interface)
> {
> struct i2c_tiny_usb *dev = usb_get_intfdata(interface);
>
> - i2c_del_adapter(&dev->adapter);
> + mutex_lock(&dev->usb_lock);
> usb_set_intfdata(interface, NULL);
> - i2c_tiny_usb_free(dev);
> + dev->disconnected = true;
> + mutex_unlock(&dev->usb_lock);
> +
> + queue_work(system_long_wq, &dev->release_work);
>
> dev_dbg(&interface->dev, "disconnected\n");
> }

what prevents the following sequence:

i2c_tiny_usb_disconnect() -> module unload -> i2c_tiny_usb_release()

As far as I can tell, this can happen and you'd execute already
freed memory.

Regards
Oliver

[weipeng]

On 2026-01-13 20:23, Oliver Neukum wrote:

> what prevents the following sequence:
>
> i2c_tiny_usb_disconnect() -> module unload -> i2c_tiny_usb_release()
>
> As far as I can tell, this can happen and you'd execute already
> freed memory.

Hi,

I got it. It can be solved by using wait_for_completion in the module exit
function to wait for all the i2c_tiny_usb_release() to be done.

But after think twice, I think it is not a good idea. Because that would be
too complicated for a driver. Almost all the usb drivers does not do like this.
They just call release functions in the disconnect() rather than put all the
release works to another task. So I think the key point is not the disconnect().

The key point is the i2c subsystem:

> void i2c_del_adapter(struct i2c_adapter *adap)
> {
> ...
> /* wait until all references to the device are gone
> *
> * FIXME: This is old code and should ideally be replaced by an
> * alternative which results in decoupling the lifetime of the struct
> * device from the i2c_adapter, like spi or netdev do. Any solution
> * should be thoroughly tested with DEBUG_KOBJECT_RELEASE enabled!
> */
> init_completion(&adap->dev_released);
> device_unregister(&adap->dev);
> wait_for_completion(&adap->dev_released);
> ...
> }

The i2c_del_adapter() will wait for all the users to put the reference of the adapter.
It is not a good idea. We can't control the users. So the i2c_del_adapter() can wait
for any time.

Best Regards

weipeng

[Oliver Neukum]

Hi,

On 14.01.26 09:11, weipeng wrote:

> I got it. It can be solved by using wait_for_completion in the module exit
> function to wait for all the i2c_tiny_usb_release() to be done.

At that point the module unload would potentially take forever,
because you cannot control how long it takes to complete.

> The i2c_del_adapter() will wait for all the users to put the reference of the adapter.

That seems reasonable.

> It is not a good idea. We can't control the users. So the i2c_del_adapter() can wait
> for any time.

Who exactly takes references? I think at this point you have a design issue
with the i2c layer and seems proper to include the linux-i2c list.

Regards
Oliver

[weipeng]

Hi,

i2c_del_adapter in i2c-core-base.c:

> void i2c_del_adapter(struct i2c_adapter *adap)
> {
> ...
> /* wait until all references to the device are gone
> *
> * FIXME: This is old code and should ideally be replaced by an
> * alternative which results in decoupling the lifetime of the struct
> * device from the i2c_adapter, like spi or netdev do. Any solution
> * should be thoroughly tested with DEBUG_KOBJECT_RELEASE enabled!
> */
> init_completion(&adap->dev_released);
> device_unregister(&adap->dev);
> wait_for_completion(&adap->dev_released);
> ...
> }

This issue looks like caused by i2c_del_adapter(). It waits for too long so
it may cause the hung.

Thanks,
weipeng