syzbot


possible deadlock in vb2_video_unregister_device

Status: upstream: reported C repro on 2024/02/07 08:44
Subsystems: media usb
[Documentation on labels]
Reported-by: syzbot+3b1d4b3d5f7a358bf9a9@syzkaller.appspotmail.com
First crash: 80d, last: 54d
Cause bisection: introduced by (bisect log) :
commit c838530d230bc638d79b78737fc4488ffc28c1ee
Author: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Date: Thu Nov 9 16:34:59 2023 +0000

  media: media videobuf2: Be more flexible on the number of queue stored buffers

Crash: possible deadlock in vb2_video_unregister_device (log)
Repro: C syz .config
  
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] Monthly media report (Mar 2024) 0 (1) 2024/03/13 13:39
[syzbot] [usb?] [media?] possible deadlock in vb2_video_unregister_device 4 (7) 2024/02/20 04:49
Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/03/19 08:22 30m retest repro upstream error OK
2024/03/04 04:10 6m retest repro https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing report log
2024/02/07 11:08 15m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing OK log

Sample crash report:
============================================
WARNING: possible recursive locking detected
6.8.0-rc5-syzkaller #0 Not tainted
--------------------------------------------
kworker/0:0/8 is trying to acquire lock:
ffff888022964b78 (&usbtv->vb2q_lock){+.+.}-{3:3}, at: vb2_video_unregister_device+0x15f/0x230 drivers/media/common/videobuf2/videobuf2-v4l2.c:1269

but task is already holding lock:
ffff888022964b78 (&usbtv->vb2q_lock){+.+.}-{3:3}, at: usbtv_video_free+0x22/0x70 drivers/media/usb/usbtv/usbtv-video.c:966

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&usbtv->vb2q_lock);
  lock(&usbtv->vb2q_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

7 locks held by kworker/0:0/8:
 #0: ffff88801bad1d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2608 [inline]
 #0: ffff88801bad1d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x1420 kernel/workqueue.c:2706
 #1: ffffc900000d7d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2608 [inline]
 #1: ffffc900000d7d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x1420 kernel/workqueue.c:2706
 #2: ffff888023c22190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:990 [inline]
 #2: ffff888023c22190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x50f0 drivers/usb/core/hub.c:5811
 #3: ffff88802955d190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:990 [inline]
 #3: ffff88802955d190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2258
 #4: ffff88807a3cc160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:990 [inline]
 #4: ffff88807a3cc160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
 #4: ffff88807a3cc160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292
 #5: ffff888022964b78 (&usbtv->vb2q_lock){+.+.}-{3:3}, at: usbtv_video_free+0x22/0x70 drivers/media/usb/usbtv/usbtv-video.c:966
 #6: ffff888022964ae8 (&usbtv->v4l2_lock){+.+.}-{3:3}, at: usbtv_video_free+0x33/0x70 drivers/media/usb/usbtv/usbtv-video.c:967

stack backtrace:
CPU: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain+0x15c0/0x58e0 kernel/locking/lockdep.c:3856
 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
 vb2_video_unregister_device+0x15f/0x230 drivers/media/common/videobuf2/videobuf2-v4l2.c:1269
 usbtv_video_free+0x47/0x70 drivers/media/usb/usbtv/usbtv-video.c:970
 usbtv_disconnect+0x6d/0xd0 drivers/media/usb/usbtv/usbtv-core.c:138
 usb_unbind_interface+0x1d4/0x850 drivers/usb/core/driver.c:461
 device_remove drivers/base/dd.c:569 [inline]
 __device_release_driver drivers/base/dd.c:1272 [inline]
 device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295
 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574
 device_del+0x580/0xa30 drivers/base/core.c:3828
 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1416
 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2267
 hub_port_connect drivers/usb/core/hub.c:5323 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5623 [inline]
 port_event drivers/usb/core/hub.c:5783 [inline]
 hub_event+0x1e62/0x50f0 drivers/usb/core/hub.c:5865
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706
 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
 kthread+0x2ef/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/19 02:29 upstream b401b621758e 578f7538 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in vb2_video_unregister_device
2024/02/07 03:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing ed5551279c91 6404acf9 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in vb2_video_unregister_device
2024/02/07 02:34 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing ed5551279c91 6404acf9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb possible deadlock in vb2_video_unregister_device
* Struck through repros no longer work on HEAD.