[v5.15] possible deadlock in hid_hw_open (3)
0 views
Skip to first unread message
syzbot
2:54 AM (15 hours ago) 2:54 AM
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 68efe5a6c16a Linux 5.15.197
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14b7caac580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e6ed99963d6ee1d
dashboard link: https://syzkaller.appspot.com/bug?extid=ca0bc2efb292ea80411d
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/900f9b9bd850/disk-68efe5a6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1e089a5019a6/vmlinux-68efe5a6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b319f477b907/bzImage-68efe5a6.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ca0bc2...@syzkaller.appspotmail.com
input: HID 045e:07da as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:045E:07DA.0028/input/input34
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/0:14/4406 is trying to acquire lock:
ffff8880604c9ee0 (
&hdev->ll_open_lock){+.+.}-{3:3}, at: hid_hw_open+0x23/0x160 drivers/hid/hid-core.c:2127
but task is already holding lock:
ffff88804ba802c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_open_device+0x4e/0x2e0 drivers/input/input.c:620
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&dev->mutex#2){+.+.}-{3:3}:
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
input_disconnect_device drivers/input/input.c:748 [inline]
__input_unregister_device+0x2e/0x320 drivers/input/input.c:2278
input_unregister_device+0x97/0xf0 drivers/input/input.c:2473
steam_client_ll_open+0x73/0x90 drivers/hid/hid-steam.c:640
hid_hw_open+0xdd/0x160 drivers/hid/hid-core.c:2132
hidraw_open+0x28f/0x8b0 drivers/hid/hidraw.c:289
chrdev_open+0x597/0x670 fs/char_dev.c:414
do_dentry_open+0x7ff/0xf80 fs/open.c:826
do_open fs/namei.c:3616 [inline]
path_openat+0x2682/0x2f30 fs/namei.c:3750
do_filp_open+0x1b3/0x3e0 fs/namei.c:3777
do_sys_openat2+0x142/0x4a0 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #0 (&hdev->ll_open_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_killable_nested+0x17/0x20 kernel/locking/mutex.c:758
hid_hw_open+0x23/0x160 drivers/hid/hid-core.c:2127
input_open_device+0x16c/0x2e0 drivers/input/input.c:640
kbd_connect+0xe9/0x130 drivers/tty/vt/keyboard.c:1581
input_attach_handler drivers/input/input.c:1046 [inline]
input_register_device+0xda7/0x1140 drivers/input/input.c:2429
hidinput_connect+0x2440/0x2d90 drivers/hid/hid-input.c:2030
hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1983
hid_hw_start+0x99/0x100 drivers/hid/hid-core.c:2090
ms_probe+0x179/0x420 drivers/hid/hid-microsoft.c:391
hid_device_probe+0x271/0x360 drivers/hid/hid-core.c:2318
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
hid_add_device+0x389/0x530 drivers/hid/hid-core.c:2470
usbhid_probe+0xb92/0xf40 drivers/hid/usbhid/hid-core.c:1427
usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5497 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
port_event drivers/usb/core/hub.c:5799 [inline]
hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mutex#2
);
lock(&hdev->ll_open_lock);
lock(
&dev->mutex#2);
lock(&hdev->ll_open_lock);
*** DEADLOCK ***
8 locks held by kworker/0:14/4406:
#0: ffff88801ba1bd38 ((wq_completion)usb_hub_wq
){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1:
ffffc90003acfd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffff8880246a2220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#2: ffff8880246a2220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1a7/0x5560 drivers/usb/core/hub.c:5827
#3: ffff888021196220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#3: ffff888021196220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x85/0x460 drivers/base/dd.c:954
#4: ffff888073a321a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#4: ffff888073a321a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x85/0x460 drivers/base/dd.c:954
#5: ffff8880604c9ab0 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#5: ffff8880604c9ab0 (&dev->mutex){....}-{3:3}, at: __device_attach+0x85/0x460 drivers/base/dd.c:954
#6: ffffffff8cd3e4e8 (input_mutex){+.+.}-{3:3}
, at: input_register_device+0xb66/0x1140 drivers/input/input.c:2422
#7: ffff88804ba802c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_open_device+0x4e/0x2e0 drivers/input/input.c:620
stack backtrace:
CPU: 0 PID: 4406 Comm: kworker/0:14 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_killable_nested+0x17/0x20 kernel/locking/mutex.c:758
hid_hw_open+0x23/0x160 drivers/hid/hid-core.c:2127
input_open_device+0x16c/0x2e0 drivers/input/input.c:640
kbd_connect+0xe9/0x130 drivers/tty/vt/keyboard.c:1581
input_attach_handler drivers/input/input.c:1046 [inline]
input_register_device+0xda7/0x1140 drivers/input/input.c:2429
hidinput_connect+0x2440/0x2d90 drivers/hid/hid-input.c:2030
hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1983
hid_hw_start+0x99/0x100 drivers/hid/hid-core.c:2090
ms_probe+0x179/0x420 drivers/hid/hid-microsoft.c:391
hid_device_probe+0x271/0x360 drivers/hid/hid-core.c:2318
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
hid_add_device+0x389/0x530 drivers/hid/hid-core.c:2470
usbhid_probe+0xb92/0xf40 drivers/hid/usbhid/hid-core.c:1427
usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5497 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
port_event drivers/usb/core/hub.c:5799 [inline]
hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
microsoft 0003:045E:07DA.0028: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.9-1/input0
usb 10-1: USB disconnect, device number 4
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 68efe5a6c16a Linux 5.15.197
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14b7caac580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e6ed99963d6ee1d
dashboard link: https://syzkaller.appspot.com/bug?extid=ca0bc2efb292ea80411d
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/900f9b9bd850/disk-68efe5a6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1e089a5019a6/vmlinux-68efe5a6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b319f477b907/bzImage-68efe5a6.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ca0bc2...@syzkaller.appspotmail.com
input: HID 045e:07da as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:045E:07DA.0028/input/input34
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/0:14/4406 is trying to acquire lock:
ffff8880604c9ee0 (
&hdev->ll_open_lock){+.+.}-{3:3}, at: hid_hw_open+0x23/0x160 drivers/hid/hid-core.c:2127
but task is already holding lock:
ffff88804ba802c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_open_device+0x4e/0x2e0 drivers/input/input.c:620
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&dev->mutex#2){+.+.}-{3:3}:
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
input_disconnect_device drivers/input/input.c:748 [inline]
__input_unregister_device+0x2e/0x320 drivers/input/input.c:2278
input_unregister_device+0x97/0xf0 drivers/input/input.c:2473
steam_client_ll_open+0x73/0x90 drivers/hid/hid-steam.c:640
hid_hw_open+0xdd/0x160 drivers/hid/hid-core.c:2132
hidraw_open+0x28f/0x8b0 drivers/hid/hidraw.c:289
chrdev_open+0x597/0x670 fs/char_dev.c:414
do_dentry_open+0x7ff/0xf80 fs/open.c:826
do_open fs/namei.c:3616 [inline]
path_openat+0x2682/0x2f30 fs/namei.c:3750
do_filp_open+0x1b3/0x3e0 fs/namei.c:3777
do_sys_openat2+0x142/0x4a0 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
-> #0 (&hdev->ll_open_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_killable_nested+0x17/0x20 kernel/locking/mutex.c:758
hid_hw_open+0x23/0x160 drivers/hid/hid-core.c:2127
input_open_device+0x16c/0x2e0 drivers/input/input.c:640
kbd_connect+0xe9/0x130 drivers/tty/vt/keyboard.c:1581
input_attach_handler drivers/input/input.c:1046 [inline]
input_register_device+0xda7/0x1140 drivers/input/input.c:2429
hidinput_connect+0x2440/0x2d90 drivers/hid/hid-input.c:2030
hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1983
hid_hw_start+0x99/0x100 drivers/hid/hid-core.c:2090
ms_probe+0x179/0x420 drivers/hid/hid-microsoft.c:391
hid_device_probe+0x271/0x360 drivers/hid/hid-core.c:2318
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
hid_add_device+0x389/0x530 drivers/hid/hid-core.c:2470
usbhid_probe+0xb92/0xf40 drivers/hid/usbhid/hid-core.c:1427
usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5497 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
port_event drivers/usb/core/hub.c:5799 [inline]
hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mutex#2
);
lock(&hdev->ll_open_lock);
lock(
&dev->mutex#2);
lock(&hdev->ll_open_lock);
*** DEADLOCK ***
8 locks held by kworker/0:14/4406:
#0: ffff88801ba1bd38 ((wq_completion)usb_hub_wq
){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1:
ffffc90003acfd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffff8880246a2220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#2: ffff8880246a2220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1a7/0x5560 drivers/usb/core/hub.c:5827
#3: ffff888021196220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#3: ffff888021196220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x85/0x460 drivers/base/dd.c:954
#4: ffff888073a321a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#4: ffff888073a321a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x85/0x460 drivers/base/dd.c:954
#5: ffff8880604c9ab0 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#5: ffff8880604c9ab0 (&dev->mutex){....}-{3:3}, at: __device_attach+0x85/0x460 drivers/base/dd.c:954
#6: ffffffff8cd3e4e8 (input_mutex){+.+.}-{3:3}
, at: input_register_device+0xb66/0x1140 drivers/input/input.c:2422
#7: ffff88804ba802c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_open_device+0x4e/0x2e0 drivers/input/input.c:620
stack backtrace:
CPU: 0 PID: 4406 Comm: kworker/0:14 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_killable_nested+0x17/0x20 kernel/locking/mutex.c:758
hid_hw_open+0x23/0x160 drivers/hid/hid-core.c:2127
input_open_device+0x16c/0x2e0 drivers/input/input.c:640
kbd_connect+0xe9/0x130 drivers/tty/vt/keyboard.c:1581
input_attach_handler drivers/input/input.c:1046 [inline]
input_register_device+0xda7/0x1140 drivers/input/input.c:2429
hidinput_connect+0x2440/0x2d90 drivers/hid/hid-input.c:2030
hid_connect+0x458/0xdf0 drivers/hid/hid-core.c:1983
hid_hw_start+0x99/0x100 drivers/hid/hid-core.c:2090
ms_probe+0x179/0x420 drivers/hid/hid-microsoft.c:391
hid_device_probe+0x271/0x360 drivers/hid/hid-core.c:2318
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
hid_add_device+0x389/0x530 drivers/hid/hid-core.c:2470
usbhid_probe+0xb92/0xf40 drivers/hid/usbhid/hid-core.c:1427
usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x284/0xc80 drivers/base/dd.c:595
__driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
__device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
__device_attach+0x29b/0x460 drivers/base/dd.c:979
bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
device_add+0xa00/0xfb0 drivers/base/core.c:3412
usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
hub_port_connect drivers/usb/core/hub.c:5497 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
port_event drivers/usb/core/hub.c:5799 [inline]
hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
microsoft 0003:045E:07DA.0028: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.9-1/input0
usb 10-1: USB disconnect, device number 4
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages