[v5.15] WARNING in as102_dvb_dmx_start_feed

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 91d48252ad4b Linux 5.15.202
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=120ca1d6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=353ae28c40b35af5
dashboard link: https://syzkaller.appspot.com/bug?extid=763a11951983705d8ec7
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/74e75dfcb812/disk-91d48252.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfa72aab00f2/vmlinux-91d48252.xz
kernel image: https://storage.googleapis.com/syzbot-assets/47ea72d1c7dc/bzImage-91d48252.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+763a11...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 1 PID: 14165 at kernel/locking/mutex.c:575 __mutex_lock_common+0x195d/0x2400 kernel/locking/mutex.c:-1
Modules linked in:
CPU: 1 PID: 14165 Comm: syz.0.2242 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__mutex_lock_common+0x195d/0x2400 kernel/locking/mutex.c:575
Code: 00 48 8d bc 24 e0 00 00 00 0f 85 e3 e7 ff ff 48 c7 c7 80 16 2b 8a 48 c7 c6 c0 16 2b 8a e8 6b 83 ec ff 48 8d bc 24 e0 00 00 00 <0f> 0b e9 c1 e7 ff ff e8 17 87 3b f7 e9 00 fc ff ff 0f 0b e9 40 f0
RSP: 0018:ffffc900031cfa60 EFLAGS: 00010246
RAX: c79d88e92803be00 RBX: dffffc0000000000 RCX: 0000000000080000
RDX: ffffc9000590a000 RSI: 000000000000c62f RDI: ffffc900031cfb40
RBP: ffffc900031cfbe8 R08: ffff8880b912795b R09: 1ffff11017224f2b
R10: dffffc0000000000 R11: ffffed1017224f2c R12: 0000000000000000
R13: 1ffff92000639f64 R14: ffffffff86ce1d0c R15: 0000000000000000
FS: 00007f747d5236c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000404030 CR3: 0000000055fe4000 CR4: 00000000003526f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000080083
DR3: ffffffffefffff16 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_interruptible_nested+0x17/0x20 kernel/locking/mutex.c:765
as102_dvb_dmx_start_feed+0x6c/0x280 drivers/media/usb/as102/as102_drv.c:139
dmx_section_feed_start_filtering+0x4f1/0x690 drivers/media/dvb-core/dvb_demux.c:983
dvb_dmxdev_filter_start+0xc87/0x1090 drivers/media/dvb-core/dmxdev.c:766
dvb_demux_do_ioctl+0x463/0x530 drivers/media/dvb-core/dmxdev.c:1077
dvb_usercopy+0x191/0x2b0 drivers/media/dvb-core/dvbdev.c:1017
dvb_demux_ioctl+0x25/0x30 drivers/media/dvb-core/dmxdev.c:1195
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f747f2c9799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f747d523028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f747f542fa0 RCX: 00007f747f2c9799
RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000004
RBP: 00007f747f35fc99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f747f543038 R14: 00007f747f542fa0 R15: 00007ffcff466748
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 91d48252ad4b Linux 5.15.202
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=14866a06580000

kernel config: https://syzkaller.appspot.com/x/.config?x=353ae28c40b35af5
dashboard link: https://syzkaller.appspot.com/bug?extid=763a11951983705d8ec7
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110c24ca580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=143becba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/74e75dfcb812/disk-91d48252.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfa72aab00f2/vmlinux-91d48252.xz
kernel image: https://storage.googleapis.com/syzbot-assets/47ea72d1c7dc/bzImage-91d48252.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+763a11...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)

WARNING: CPU: 1 PID: 4409 at kernel/locking/mutex.c:575 __mutex_lock_common+0x195d/0x2400 kernel/locking/mutex.c:-1
Modules linked in:
CPU: 1 PID: 4409 Comm: syz.0.60 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__mutex_lock_common+0x195d/0x2400 kernel/locking/mutex.c:575
Code: 00 48 8d bc 24 e0 00 00 00 0f 85 e3 e7 ff ff 48 c7 c7 80 16 2b 8a 48 c7 c6 c0 16 2b 8a e8 6b 83 ec ff 48 8d bc 24 e0 00 00 00 <0f> 0b e9 c1 e7 ff ff e8 17 87 3b f7 e9 00 fc ff ff 0f 0b e9 40 f0

RSP: 0018:ffffc90002577a60 EFLAGS: 00010246
RAX: b7e3c2c91c34a900 RBX: dffffc0000000000 RCX: ffff888027c69dc0
RDX: 0000000000000000 RSI: 0000000080000000 RDI: ffffc90002577b40
RBP: ffffc90002577be8 R08: ffff8880b912795b R09: 1ffff11017224f2b

R10: dffffc0000000000 R11: ffffed1017224f2c R12: 0000000000000000

R13: 1ffff920004aef64 R14: ffffffff86ce1d0c R15: 0000000000000000
FS: 000055557325b500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000001b30d63fff CR3: 0000000059978000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:
<TASK>
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_interruptible_nested+0x17/0x20 kernel/locking/mutex.c:765
as102_dvb_dmx_start_feed+0x6c/0x280 drivers/media/usb/as102/as102_drv.c:139
dmx_section_feed_start_filtering+0x4f1/0x690 drivers/media/dvb-core/dvb_demux.c:983
dvb_dmxdev_filter_start+0xc87/0x1090 drivers/media/dvb-core/dmxdev.c:766
dvb_demux_do_ioctl+0x463/0x530 drivers/media/dvb-core/dmxdev.c:1077
dvb_usercopy+0x191/0x2b0 drivers/media/dvb-core/dvbdev.c:1017
dvb_demux_ioctl+0x25/0x30 drivers/media/dvb-core/dmxdev.c:1195
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

RIP: 0033:0x7f4b53dfd799

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fff87402f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f4b54076fa0 RCX: 00007f4b53dfd799

RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000004

RBP: 00007f4b53e93c99 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f4b54076fac R14: 00007f4b54076fa0 R15: 00007f4b54076fa0
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c09fbcd31ae6 Linux 6.6.130
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14c35e16580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5b35c4db8465904
dashboard link: https://syzkaller.appspot.com/bug?extid=0d6f3f8513075f9587d8

compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/58165bbf9941/disk-c09fbcd3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/73cbb84fb36b/vmlinux-c09fbcd3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/744ea33ec44b/bzImage-c09fbcd3.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+0d6f3f...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)

WARNING: CPU: 0 PID: 6909 at kernel/locking/mutex.c:582 __mutex_lock_common kernel/locking/mutex.c:582 [inline]
WARNING: CPU: 0 PID: 6909 at kernel/locking/mutex.c:582 __mutex_lock+0xb85/0xcc0 kernel/locking/mutex.c:747
Modules linked in:
CPU: 0 PID: 6909 Comm: syz.4.167 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026

RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:582 [inline]
RIP: 0010:__mutex_lock+0xb85/0xcc0 kernel/locking/mutex.c:747
Code: 04 08 84 c0 0f 85 27 01 00 00 83 3d 94 87 fc 03 00 0f 85 95 f5 ff ff 48 c7 c7 80 b4 ca 8a 48 c7 c6 20 b5 ca 8a e8 5b 28 c2 f6 <0f> 0b e9 7b f5 ff ff 0f 0b e9 5f f9 ff ff 0f 0b e9 18 f6 ff ff e8
RSP: 0018:ffffc9000bc37aa0 EFLAGS: 00010246
RAX: 8f50e32a4ef97e00 RBX: ffff88802db6ece0 RCX: 0000000000080000
RDX: ffffc900196ee000 RSI: 0000000000008c14 RDI: 0000000000008c15
RBP: ffffc9000bc37bf8 R08: ffff8880b8f28c13 R09: 1ffff110171e5182
R10: dffffc0000000000 R11: ffffed10171e5183 R12: 0000000000000000
R13: 1ffff92001786f64 R14: dffffc0000000000 R15: 0000000000000000
FS: 00007f208c2f56c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000110c3be71a CR3: 0000000060ad0000 CR4: 00000000003506f0
Call Trace:
<TASK>
as102_dvb_dmx_start_feed+0x70/0x280 drivers/media/usb/as102/as102_drv.c:139
dmx_section_feed_start_filtering+0x4f5/0x690 drivers/media/dvb-core/dvb_demux.c:973
dvb_dmxdev_filter_start+0xcbd/0x10c0 drivers/media/dvb-core/dmxdev.c:758
dvb_demux_do_ioctl+0x467/0x530 drivers/media/dvb-core/dmxdev.c:1069
dvb_usercopy+0x195/0x2b0 drivers/media/dvb-core/dvbdev.c:999
dvb_demux_ioctl+0x29/0x30 drivers/media/dvb-core/dmxdev.c:1187
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f208b39c799

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f208c2f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f208b615fa0 RCX: 00007f208b39c799

RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000004

RBP: 00007f208b432c99 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f208b616038 R14: 00007f208b615fa0 R15: 00007ffdab3b9978

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1989cd3d56e2 Linux 6.1.167
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11888eda580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=ecc90960c3d0af1ddfbb

compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/814271465bd5/disk-1989cd3d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bd559379c491/vmlinux-1989cd3d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/063c12bf8ba7/bzImage-1989cd3d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+ecc909...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)

WARNING: CPU: 1 PID: 4819 at kernel/locking/mutex.c:582 __mutex_lock_common kernel/locking/mutex.c:582 [inline]
WARNING: CPU: 1 PID: 4819 at kernel/locking/mutex.c:582 __mutex_lock+0xa32/0xaf0 kernel/locking/mutex.c:747
Modules linked in:
CPU: 1 PID: 4819 Comm: syz.4.133 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:582 [inline]

RIP: 0010:__mutex_lock+0xa32/0xaf0 kernel/locking/mutex.c:747
Code: 04 28 84 c0 0f 85 b7 00 00 00 83 3d 9f 4b e9 03 00 0f 85 df f6 ff ff 48 c7 c7 20 fb 8b 8a 48 c7 c6 c0 fb 8b 8a e8 0e 1d 17 f7 <0f> 0b e9 c5 f6 ff ff 0f 0b e9 6b f9 ff ff 48 c7 c1 40 e1 bf 96 80
RSP: 0018:ffffc90003227aa0 EFLAGS: 00010246
RAX: 50a9d98809e7d400 RBX: ffff888056fa6ce0 RCX: 0000000000080000
RDX: ffffc9000e449000 RSI: 00000000000021f0 RDI: 00000000000021f1
RBP: ffffc90003227bf8 R08: ffff8880b8f279db R09: 1ffff110171e4f3b
R10: dffffc0000000000 R11: ffffed10171e4f3c R12: 0000000000000000
R13: dffffc0000000000 R14: ffff888056fa6000 R15: 0000000000000000
FS: 00007f65f25be6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fc9c15e9e80 CR3: 0000000028e74000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

as102_dvb_dmx_start_feed+0x6c/0x280 drivers/media/usb/as102/as102_drv.c:139
dmx_section_feed_start_filtering+0x4f1/0x690 drivers/media/dvb-core/dvb_demux.c:973
dvb_dmxdev_filter_start+0xc87/0x1090 drivers/media/dvb-core/dmxdev.c:758
dvb_demux_do_ioctl+0x463/0x530 drivers/media/dvb-core/dmxdev.c:1069
dvb_usercopy+0x191/0x2b0 drivers/media/dvb-core/dvbdev.c:1007
dvb_demux_ioctl+0x25/0x30 drivers/media/dvb-core/dmxdev.c:1187
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f65f179c799

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f65f25be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f65f1a15fa0 RCX: 00007f65f179c799
RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000005
RBP: 00007f65f1832c99 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f65f1a16038 R14: 00007f65f1a15fa0 R15: 00007ffe5acb2b28

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 1989cd3d56e2 Linux 6.1.167
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=17d88eda580000

kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=ecc90960c3d0af1ddfbb
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17aeecca580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a11cba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/814271465bd5/disk-1989cd3d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bd559379c491/vmlinux-1989cd3d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/063c12bf8ba7/bzImage-1989cd3d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ecc909...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)

WARNING: CPU: 1 PID: 4476 at kernel/locking/mutex.c:582 __mutex_lock_common kernel/locking/mutex.c:582 [inline]
WARNING: CPU: 1 PID: 4476 at kernel/locking/mutex.c:582 __mutex_lock+0xa32/0xaf0 kernel/locking/mutex.c:747
Modules linked in:
CPU: 1 PID: 4476 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:582 [inline]
RIP: 0010:__mutex_lock+0xa32/0xaf0 kernel/locking/mutex.c:747
Code: 04 28 84 c0 0f 85 b7 00 00 00 83 3d 9f 4b e9 03 00 0f 85 df f6 ff ff 48 c7 c7 20 fb 8b 8a 48 c7 c6 c0 fb 8b 8a e8 0e 1d 17 f7 <0f> 0b e9 c5 f6 ff ff 0f 0b e9 6b f9 ff ff 48 c7 c1 40 e1 bf 96 80

RSP: 0018:ffffc90003447aa0 EFLAGS: 00010246
RAX: 122915d99e9ed300 RBX: ffff888075742ce0 RCX: ffff88801f2abb80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90003447bf8 R08: ffff8880b8f279db R09: 1ffff110171e4f3b

R10: dffffc0000000000 R11: ffffed10171e4f3c R12: 0000000000000000

R13: dffffc0000000000 R14: ffff888075742000 R15: 0000000000000000
FS: 000055558c599500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000000000000000 CR3: 000000001ff5a000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
as102_dvb_dmx_start_feed+0x6c/0x280 drivers/media/usb/as102/as102_drv.c:139
dmx_section_feed_start_filtering+0x4f1/0x690 drivers/media/dvb-core/dvb_demux.c:973
dvb_dmxdev_filter_start+0xc87/0x1090 drivers/media/dvb-core/dmxdev.c:758
dvb_demux_do_ioctl+0x463/0x530 drivers/media/dvb-core/dmxdev.c:1069
dvb_usercopy+0x191/0x2b0 drivers/media/dvb-core/dvbdev.c:1007
dvb_demux_ioctl+0x25/0x30 drivers/media/dvb-core/dmxdev.c:1187
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7f3cc3d9c799

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffe6a9a02e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f3cc4015fa0 RCX: 00007f3cc3d9c799
RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000004
RBP: 00007f3cc3e32c99 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f3cc4015fac R14: 00007f3cc4015fa0 R15: 00007f3cc4015fa0

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c09fbcd31ae6 Linux 6.6.130
git tree: linux-6.6.y

console output: https://syzkaller.appspot.com/x/log.txt?x=15503752580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c5b35c4db8465904
dashboard link: https://syzkaller.appspot.com/bug?extid=0d6f3f8513075f9587d8
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13a961d6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11349cba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/58165bbf9941/disk-c09fbcd3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/73cbb84fb36b/vmlinux-c09fbcd3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/744ea33ec44b/bzImage-c09fbcd3.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0d6f3f...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)

WARNING: CPU: 0 PID: 5980 at kernel/locking/mutex.c:582 __mutex_lock_common kernel/locking/mutex.c:582 [inline]
WARNING: CPU: 0 PID: 5980 at kernel/locking/mutex.c:582 __mutex_lock+0xb85/0xcc0 kernel/locking/mutex.c:747
Modules linked in:
CPU: 0 PID: 5980 Comm: syz.2.36 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:582 [inline]
RIP: 0010:__mutex_lock+0xb85/0xcc0 kernel/locking/mutex.c:747
Code: 04 08 84 c0 0f 85 27 01 00 00 83 3d 94 87 fc 03 00 0f 85 95 f5 ff ff 48 c7 c7 80 b4 ca 8a 48 c7 c6 20 b5 ca 8a e8 5b 28 c2 f6 <0f> 0b e9 7b f5 ff ff 0f 0b e9 5f f9 ff ff 0f 0b e9 18 f6 ff ff e8

RSP: 0018:ffffc90003a07aa0 EFLAGS: 00010246
RAX: 9e93a6400bc6fc00 RBX: ffff88802fc44ce0 RCX: ffff888023bdbc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90003a07bf8 R08: ffff8880b8e28c13 R09: 1ffff110171c5182
R10: dffffc0000000000 R11: ffffed10171c5183 R12: 0000000000000000
R13: 1ffff92000740f64 R14: dffffc0000000000 R15: 0000000000000000
FS: 000055557b49d500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000000000000000 CR3: 000000005e182000 CR4: 00000000003506f0

Call Trace:
<TASK>
as102_dvb_dmx_start_feed+0x70/0x280 drivers/media/usb/as102/as102_drv.c:139
dmx_section_feed_start_filtering+0x4f5/0x690 drivers/media/dvb-core/dvb_demux.c:973
dvb_dmxdev_filter_start+0xcbd/0x10c0 drivers/media/dvb-core/dmxdev.c:758
dvb_demux_do_ioctl+0x467/0x530 drivers/media/dvb-core/dmxdev.c:1069
dvb_usercopy+0x195/0x2b0 drivers/media/dvb-core/dvbdev.c:999
dvb_demux_ioctl+0x29/0x30 drivers/media/dvb-core/dmxdev.c:1187
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7f046a19c799

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffe0dcb0a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f046a415fa0 RCX: 00007f046a19c799
RDX: 0000200000000000 RSI: 00000000403c6f2b RDI: 0000000000000004
RBP: 00007f046a232c99 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f046a415fac R14: 00007f046a415fa0 R15: 00007f046a415fa0