program: r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]}) [ 95.245295][ T4646] Bluetooth: hci0: command tx timeout [ 95.305922][ T5320] comedi comedi0: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached [ 95.384770][ T5321] comedi comedi1: comedi_bond: 0:2 attached, 32 channels from 1 devices [ 95.387812][ T5320] [ 95.392321][ T5320] ============================================ [ 95.394815][ T5320] WARNING: possible recursive locking detected [ 95.397336][ T5320] syzkaller #0 Not tainted [ 95.399212][ T5320] -------------------------------------------- [ 95.401774][ T5320] syz.0.0/5320 is trying to acquire lock: [ 95.404226][ T5320] ffff88803ee878f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_do_insn+0x38/0x3d0 [ 95.408168][ T5320] [ 95.408168][ T5320] but task is already holding lock: [ 95.411463][ T5320] ffff88803ee870f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x210/0x1af0 [ 95.415712][ T5320] [ 95.415712][ T5320] other info that might help us debug this: [ 95.419205][ T5320] Possible unsafe locking scenario: [ 95.419205][ T5320] [ 95.422426][ T5320] CPU0 [ 95.424021][ T5320] ---- [ 95.425504][ T5320] lock(&dev->mutex#4); [ 95.427319][ T5320] lock(&dev->mutex#4); [ 95.429088][ T5320] [ 95.429088][ T5320] *** DEADLOCK *** [ 95.429088][ T5320] [ 95.432463][ T5320] May be due to missing lock nesting notation [ 95.432463][ T5320] [ 95.435798][ T5320] locks held by syz.0.0/5320: 1, last CPU#0: [ 95.438346][ T5320] #0: ffff88803ee870f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x210/0x1af0 [ 95.442509][ T5320] [ 95.442509][ T5320] stack backtrace: [ 95.445017][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.448933][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.453407][ T5320] Call Trace: [ 95.454722][ T5320] [ 95.455714][ T5320] dump_stack_lvl+0xe8/0x150 [ 95.457266][ T5320] print_deadlock_bug+0x27a/0x290 [ 95.459021][ T5320] __lock_acquire+0x25db/0x2de0 [ 95.460716][ T5320] ? __bfs+0x153/0x290 [ 95.462336][ T5320] ? __pfx_hlock_conflict+0x10/0x10 [ 95.464524][ T5320] lock_acquire+0x115/0x350 [ 95.466418][ T5320] ? comedi_do_insn+0x38/0x3d0 [ 95.468557][ T5320] __mutex_lock+0x19d/0x1550 [ 95.470523][ T5320] ? comedi_do_insn+0x38/0x3d0 [ 95.472575][ T5320] ? comedi_do_insn+0x38/0x3d0 [ 95.474540][ T5320] ? __pfx___mutex_lock+0x10/0x10 [ 95.476604][ T5320] ? rcu_is_watching+0x16/0xb0 [ 95.478579][ T5320] ? __pfx___up_read+0x10/0x10 [ 95.480546][ T5320] comedi_do_insn+0x38/0x3d0 [ 95.482321][ T5320] comedi_dio_bitfield2+0x2fc/0x3d0 [ 95.484378][ T5320] ? __pfx_comedi_dio_bitfield2+0x10/0x10 [ 95.486645][ T5320] ? __kasan_kmalloc+0x93/0xb0 [ 95.488724][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.491277][ T5320] ? __lock_acquire+0x747/0x2de0 [ 95.493434][ T5320] bonding_dio_insn_bits+0x2cc/0x5e0 [ 95.495636][ T5320] ? __pfx_bonding_dio_insn_bits+0x10/0x10 [ 95.498091][ T5320] ? comedi_check_chanlist+0x299/0x330 [ 95.500388][ T5320] parse_insn+0xe75/0x1b20 [ 95.502307][ T5320] ? __pfx_parse_insn+0x10/0x10 [ 95.504400][ T5320] do_insn_ioctl+0x17c/0x5b0 [ 95.506427][ T5320] comedi_unlocked_ioctl+0xe06/0x1af0 [ 95.508736][ T5320] ? kasan_quarantine_put+0xbb/0x1f0 [ 95.510931][ T5320] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 95.513411][ T5320] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.515852][ T5320] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.518187][ T5320] ? do_vfs_ioctl+0x116f/0x1530 [ 95.520249][ T5320] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 95.522368][ T5320] ? hook_file_ioctl+0x1f2/0x600 [ 95.524382][ T5320] ? __fget_files+0x2a/0x420 [ 95.526438][ T5320] ? __fget_files+0x3a2/0x420 [ 95.528548][ T5320] ? __fget_files+0x2a/0x420 [ 95.530512][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.532656][ T5320] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 95.535100][ T5320] __se_sys_ioctl+0xfc/0x170 [ 95.537086][ T5320] do_syscall_64+0x166/0x520 [ 95.539063][ T5320] ? trace_irq_disable+0x3b/0x140 [ 95.541196][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.543708][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 95.545754][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.548332][ T5320] RIP: 0033:0x7f2ed699e159 [ 95.550204][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.558137][ T5320] RSP: 002b:00007f2ed78d1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.561621][ T5320] RAX: ffffffffffffffda RBX: 00007f2ed6c25fa0 RCX: 00007f2ed699e159 [ 95.564893][ T5320] RDX: 0000200000000400 RSI: 000000008028640c RDI: 0000000000000004 [ 95.568278][ T5320] RBP: 00007f2ed6a3503b R08: 0000000000000000 R09: 0000000000000000 [ 95.571544][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.574835][ T5320] R13: 00007f2ed6c26038 R14: 00007f2ed6c25fa0 R15: 00007ffe448be2d8 [ 95.578139][ T5320]