syzbot
WARNING: still has locks held in __fdget_pos
Status:
upstream: reported C repro on 2026/08/17 20:32
Reported-by: syzbot+62bd9723fc028bfd53bd@syzkaller.appspotmail.com
First crash: 13d, last: 12d
Sample crash report:
af9005: boot packet bulk message failed: -71 (252/0)
dvb-usb: found a 'Afatech DVB-T USB1.1 stick' in cold state, will try to load a firmware
usb 1-1: Direct firmware load for af9005.fw failed with error -2
usb 1-1: Falling back to sysfs fallback for: af9005.fw
====================================
WARNING: syz.0.17/4431 still has locks held!
syzkaller #0 Not tainted
------------------------------------
5 locks held by syz.0.17/4431:
#0: ffff888077f6afe8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038
#1: ffff88801e730460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580
#2: ffff88807a62e488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1d8/0x520 fs/kernfs/file.c:343
#3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
#3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1098 [inline]
#3: ffff88801d785190 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xa5/0x1c0 drivers/base/dd.c:1130
#4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
#4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1099 [inline]
#4: ffff88807b183118 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xce/0x1c0 drivers/base/dd.c:1130
stack backtrace:
CPU: 0 PID: 4431 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
try_to_freeze include/linux/freezer.h:57 [inline]
usermodehelper_read_trylock+0x204/0x2b0 kernel/umh.c:234
fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:143 [inline]
firmware_fallback_sysfs+0x16a/0x950 drivers/base/firmware_loader/fallback.c:234
_request_firmware+0xccb/0x1280 drivers/base/firmware_loader/main.c:884
request_firmware+0x32/0x50 drivers/base/firmware_loader/main.c:933
dvb_usb_download_firmware+0xb2/0x250 drivers/media/usb/dvb-usb/dvb-usb-firmware.c:93
dvb_usb_device_init+0xd26/0x2490 drivers/media/usb/dvb-usb/dvb-usb-init.c:298
usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x24a/0xb40 drivers/base/dd.c:638
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
device_driver_attach+0xd9/0x1c0 drivers/base/dd.c:1131
bind_store+0x33b/0x380 drivers/base/bus.c:216
kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x482/0x9a0 fs/read_write.c:584
ksys_write+0x14d/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f131199e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f13127bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1311c25fa0 RCX: 00007f131199e0d9
RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004
RBP: 00007f1311a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1311c26038 R14: 00007f1311c25fa0 R15: 00007fffde630448
</TASK>
* Struck through repros no longer work on HEAD.