program: syz_usb_connect(0x2, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010001000000085f0500a800010000000109022e0001010080320904000004ff00000007050102080000070582030800010705030240000007058402400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_open_procfs(0x0, &(0x7f0000000400)='fd/3\x00') [ 86.608415][ T4641] Bluetooth: hci0: command tx timeout [ 86.874933][ T1361] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 87.027339][ T1361] usb 5-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 87.032920][ T1361] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.051494][ T1361] mdc800 5-1:1.0: Found Mustek MDC800 on USB. [ 87.300121][ T5313] [ 87.301159][ T5313] ====================================================== [ 87.303725][ T5313] WARNING: possible circular locking dependency detected [ 87.306082][ T5313] syzkaller #0 Not tainted [ 87.307684][ T5313] ------------------------------------------------------ [ 87.310251][ T5313] syz.0.0/5313 is trying to acquire lock: [ 87.312682][ T5313] ffff888036ac3a18 (&mdc800->io_lock){+.+.}-{4:4}, at: mdc800_device_open+0x2e/0x470 [ 87.316791][ T5313] [ 87.316791][ T5313] but task is already holding lock: [ 87.319962][ T5313] ffffffff8f8e2c68 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 [ 87.323136][ T5313] [ 87.323136][ T5313] which lock already depends on the new lock. [ 87.323136][ T5313] [ 87.326905][ T5313] [ 87.326905][ T5313] the existing dependency chain (in reverse order) is: [ 87.330713][ T5313] [ 87.330713][ T5313] -> #1 (minor_rwsem#2){++++}-{4:4}: [ 87.333702][ T5313] down_write+0x96/0x200 [ 87.339985][ T5313] usb_register_dev+0x142/0x5e0 [ 87.342124][ T5313] mdc800_usb_probe+0xf96/0x18c0 [ 87.344407][ T5313] usb_probe_interface+0x653/0xc60 [ 87.346810][ T5313] really_probe+0x254/0xae0 [ 87.349035][ T5313] __driver_probe_device+0x1e8/0x360 [ 87.351560][ T5313] driver_probe_device+0x4f/0x240 [ 87.354012][ T5313] __device_attach_driver+0x270/0x410 [ 87.356638][ T5313] bus_for_each_drv+0x258/0x2f0 [ 87.359017][ T5313] __device_attach+0x2c4/0x450 [ 87.361420][ T5313] device_initial_probe+0xa1/0xd0 [ 87.363900][ T5313] bus_probe_device+0x12a/0x220 [ 87.366231][ T5313] device_add+0x7d7/0xb80 [ 87.368469][ T5313] usb_set_configuration+0x1ad8/0x2180 [ 87.371104][ T5313] usb_generic_driver_probe+0x8d/0x150 [ 87.373783][ T5313] usb_probe_device+0x1c3/0x3b0 [ 87.376149][ T5313] really_probe+0x254/0xae0 [ 87.378404][ T5313] __driver_probe_device+0x1e8/0x360 [ 87.380958][ T5313] driver_probe_device+0x4f/0x240 [ 87.383306][ T5313] __device_attach_driver+0x270/0x410 [ 87.385845][ T5313] bus_for_each_drv+0x258/0x2f0 [ 87.388417][ T5313] __device_attach+0x2c4/0x450 [ 87.390605][ T5313] device_initial_probe+0xa1/0xd0 [ 87.392879][ T5313] bus_probe_device+0x12a/0x220 [ 87.395096][ T5313] device_add+0x7d7/0xb80 [ 87.397197][ T5313] usb_new_device+0x9aa/0x1690 [ 87.399431][ T5313] hub_event+0x28e8/0x4d30 [ 87.401508][ T5313] process_scheduled_works+0xa8e/0x14e0 [ 87.404054][ T5313] worker_thread+0xa47/0xfb0 [ 87.406195][ T5313] kthread+0x388/0x470 [ 87.408168][ T5313] ret_from_fork+0x514/0xb70 [ 87.410342][ T5313] ret_from_fork_asm+0x1a/0x30 [ 87.412617][ T5313] [ 87.412617][ T5313] -> #0 (&mdc800->io_lock){+.+.}-{4:4}: [ 87.415989][ T5313] __lock_acquire+0x1520/0x2cf0 [ 87.418281][ T5313] lock_acquire+0x106/0x350 [ 87.420492][ T5313] __mutex_lock+0x19d/0x1550 [ 87.422706][ T5313] mdc800_device_open+0x2e/0x470 [ 87.425083][ T5313] usb_open+0x156/0x1e0 [ 87.427207][ T5313] chrdev_open+0x4d9/0x600 [ 87.429424][ T5313] do_dentry_open+0x816/0x1380 [ 87.431753][ T5313] vfs_open+0x3b/0x340 [ 87.433797][ T5313] path_openat+0x2e44/0x3830 [ 87.435926][ T5313] do_file_open+0x23e/0x4a0 [ 87.438061][ T5313] do_sys_openat2+0x115/0x200 [ 87.440292][ T5313] __x64_sys_openat+0x138/0x170 [ 87.442611][ T5313] do_syscall_64+0x174/0x580 [ 87.444814][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.447583][ T5313] [ 87.447583][ T5313] other info that might help us debug this: [ 87.447583][ T5313] [ 87.452020][ T5313] Possible unsafe locking scenario: [ 87.452020][ T5313] [ 87.455260][ T5313] CPU0 CPU1 [ 87.457754][ T5313] ---- ---- [ 87.460158][ T5313] rlock(minor_rwsem#2); [ 87.462018][ T5313] lock(&mdc800->io_lock); [ 87.465095][ T5313] lock(minor_rwsem#2); [ 87.468094][ T5313] lock(&mdc800->io_lock); [ 87.470042][ T5313] [ 87.470042][ T5313] *** DEADLOCK *** [ 87.470042][ T5313] [ 87.473388][ T5313] 1 lock held by syz.0.0/5313: [ 87.475411][ T5313] #0: ffffffff8f8e2c68 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1e0 [ 87.479299][ T5313] [ 87.479299][ T5313] stack backtrace: [ 87.481923][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.481939][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.481946][ T5313] Call Trace: [ 87.481955][ T5313] [ 87.481961][ T5313] dump_stack_lvl+0xe8/0x150 [ 87.481983][ T5313] print_circular_bug+0x2e1/0x300 [ 87.482001][ T5313] check_noncircular+0x12e/0x150 [ 87.482019][ T5313] __lock_acquire+0x1520/0x2cf0 [ 87.482033][ T5313] ? stack_trace_save+0xa9/0x100 [ 87.482045][ T5313] ? __pfx_stack_trace_save+0x10/0x10 [ 87.482057][ T5313] ? mark_lock_irq+0x38f/0x420 [ 87.482071][ T5313] ? mdc800_device_open+0x2e/0x470 [ 87.482084][ T5313] lock_acquire+0x106/0x350 [ 87.482095][ T5313] ? mdc800_device_open+0x2e/0x470 [ 87.482112][ T5313] __mutex_lock+0x19d/0x1550 [ 87.482125][ T5313] ? mdc800_device_open+0x2e/0x470 [ 87.482138][ T5313] ? __lock_acquire+0x683/0x2cf0 [ 87.482152][ T5313] ? __mutex_unlock_slowpath+0x731/0x900 [ 87.482162][ T5313] ? mdc800_device_open+0x2e/0x470 [ 87.482175][ T5313] ? __pfx___mutex_lock+0x10/0x10 [ 87.482190][ T5313] mdc800_device_open+0x2e/0x470 [ 87.482203][ T5313] ? __pfx_mdc800_device_open+0x10/0x10 [ 87.482215][ T5313] usb_open+0x156/0x1e0 [ 87.482227][ T5313] chrdev_open+0x4d9/0x600 [ 87.482242][ T5313] ? __pfx_chrdev_open+0x10/0x10 [ 87.482257][ T5313] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 87.482274][ T5313] ? __pfx_chrdev_open+0x10/0x10 [ 87.482295][ T5313] do_dentry_open+0x816/0x1380 [ 87.482310][ T5313] vfs_open+0x3b/0x340 [ 87.482319][ T5313] ? path_openat+0x2e2d/0x3830 [ 87.482336][ T5313] path_openat+0x2e44/0x3830 [ 87.482351][ T5313] ? kasan_save_track+0x3e/0x80 [ 87.482363][ T5313] ? do_sys_openat2+0xcc/0x200 [ 87.482373][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.482388][ T5313] do_file_open+0x23e/0x4a0 [ 87.482401][ T5313] ? __pfx_do_file_open+0x10/0x10 [ 87.482417][ T5313] ? _raw_spin_unlock+0x28/0x50 [ 87.482432][ T5313] ? alloc_fd+0x651/0x6c0 [ 87.482443][ T5313] do_sys_openat2+0x115/0x200 [ 87.482454][ T5313] ? __pfx_do_sys_openat2+0x10/0x10 [ 87.482464][ T5313] ? kfree+0x4d/0x640 [ 87.482481][ T5313] __x64_sys_openat+0x138/0x170 [ 87.482492][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.482501][ T5313] do_syscall_64+0x174/0x580 [ 87.482513][ T5313] ? trace_irq_disable+0x3b/0x140 [ 87.482525][ T5313] ? clear_bhb_loop+0x70/0xc0 [ 87.482536][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.482547][ T5313] RIP: 0033:0x7f4c6935e90e [ 87.482559][ T5313] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 87.482568][ T5313] RSP: 002b:00007f4c6a17fae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 87.482579][ T5313] RAX: ffffffffffffffda RBX: 00007f4c6a1806c0 RCX: 00007f4c6935e90e [ 87.482587][ T5313] RDX: 0000000000000002 RSI: 00007f4c6a17fbc0 RDI: ffffffffffffff9c [ 87.482594][ T5313] RBP: 00007f4c69435024 R08: 0000000000000000 R09: 0000000000000000 [ 87.482601][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.482608][ T5313] R13: 00007f4c69626128 R14: 00007f4c69626090 R15: 00007fffec4d2a78 [ 87.482620][ T5313] [ 88.250775][ T1361] usb 5-1: USB disconnect, device number 2 [ 88.258847][ T1361] mdc800 5-1:1.0: Mustek MDC800 disconnected from USB. [ 88.684979][ T4641] Bluetooth: hci0: command tx timeout