WARNING: still has locks held in __fdget_pos

Status: upstream: reported C repro on 2026/08/17 20:32
Reported-by: syzbot+62bd9723fc028bfd53bd@syzkaller.appspotmail.com
First crash: 13d, last: 12d

Sample crash report:
af9005: boot packet bulk message failed: -71 (252/0)
dvb-usb: found a 'Afatech DVB-T USB1.1 stick' in cold state, will try to load a firmware
usb 1-1: Direct firmware load for af9005.fw failed with error -2
usb 1-1: Falling back to sysfs fallback for: af9005.fw
====================================
WARNING: syz.0.17/4431 still has locks held!
syzkaller #0 Not tainted
------------------------------------
5 locks held by syz.0.17/4431:
 #0: ffff888077f6afe8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038
 #1: ffff88801e730460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580
 #2: ffff88807a62e488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1d8/0x520 fs/kernfs/file.c:343
 #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
 #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1098 [inline]
 #3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xa5/0x1c0 drivers/base/dd.c:1130
 #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
 #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1099 [inline]
 #4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xce/0x1c0 drivers/base/dd.c:1130

stack backtrace:
CPU: 0 PID: 4431 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 try_to_freeze include/linux/freezer.h:57 [inline]
 usermodehelper_read_trylock+0x204/0x2b0 kernel/umh.c:234
 fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:143 [inline]
 firmware_fallback_sysfs+0x16a/0x950 drivers/base/firmware_loader/fallback.c:234
 _request_firmware+0xccb/0x1280 drivers/base/firmware_loader/main.c:884
 request_firmware+0x32/0x50 drivers/base/firmware_loader/main.c:933
 dvb_usb_download_firmware+0xb2/0x250 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:93
 dvb_usb_device_init+0xd26/0x2490 drivers/media/usb/dvb-usb/dvb-usb-init.c:298
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 device_driver_attach+0xd9/0x1c0 drivers/base/dd.c:1131
 bind_store+0x33b/0x380 drivers/base/bus.c:216
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f131199e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f13127bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1311c25fa0 RCX: 00007f131199e0d9
RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004
RBP: 00007f1311a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1311c26038 R14: 00007f1311c25fa0 R15: 00007fffde630448
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/19 16:24 linux-6.1.y e4f7d8be268e 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan WARNING: still has locks held in __fdget_pos
2026/08/17 20:32 linux-6.1.y e4f7d8be268e 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan WARNING: still has locks held in __fdget_pos
* Struck through repros no longer work on HEAD.