program: r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]}) [ 101.667445][ T5329] comedi comedi0: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached [ 101.715578][ T5329] comedi comedi1: comedi_bond: 0:2 attached, 32 channels from 1 devices [ 101.717246][ T5329] [ 101.721288][ T5329] ============================================ [ 101.723661][ T5329] WARNING: possible recursive locking detected [ 101.726031][ T5329] syzkaller #0 Not tainted [ 101.727769][ T5329] -------------------------------------------- [ 101.730117][ T5329] syz.0.0/5329 is trying to acquire lock: [ 101.732234][ T5329] ffff88803f0990f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_do_insn+0x38/0x3d0 [ 101.735780][ T5329] [ 101.735780][ T5329] but task is already holding lock: [ 101.738735][ T5329] ffff88803f0988f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x210/0x1af0 [ 101.742451][ T5329] [ 101.742451][ T5329] other info that might help us debug this: [ 101.745582][ T5329] Possible unsafe locking scenario: [ 101.745582][ T5329] [ 101.748497][ T5329] CPU0 [ 101.749895][ T5329] ---- [ 101.751372][ T5329] lock(&dev->mutex#4); [ 101.753109][ T5329] lock(&dev->mutex#4); [ 101.754874][ T5329] [ 101.754874][ T5329] *** DEADLOCK *** [ 101.754874][ T5329] [ 101.758130][ T5329] May be due to missing lock nesting notation [ 101.758130][ T5329] [ 101.761403][ T5329] locks held by syz.0.0/5329: 1, last CPU#0: [ 101.763854][ T5329] #0: ffff88803f0988f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x210/0x1af0 [ 101.767887][ T5329] [ 101.767887][ T5329] stack backtrace: [ 101.770258][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.773812][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.777805][ T5329] Call Trace: [ 101.779191][ T5329] [ 101.780428][ T5329] dump_stack_lvl+0xe8/0x150 [ 101.782339][ T5329] print_deadlock_bug+0x27a/0x290 [ 101.784381][ T5329] __lock_acquire+0x25db/0x2de0 [ 101.786359][ T5329] ? __bfs+0x153/0x290 [ 101.787978][ T5329] ? __pfx_hlock_conflict+0x10/0x10 [ 101.790051][ T5329] lock_acquire+0x115/0x350 [ 101.792004][ T5329] ? comedi_do_insn+0x38/0x3d0 [ 101.794075][ T5329] __mutex_lock+0x19d/0x1550 [ 101.796056][ T5329] ? comedi_do_insn+0x38/0x3d0 [ 101.798130][ T5329] ? comedi_do_insn+0x38/0x3d0 [ 101.800208][ T5329] ? __pfx___mutex_lock+0x10/0x10 [ 101.802415][ T5329] ? rcu_is_watching+0x16/0xb0 [ 101.804529][ T5329] ? __pfx___up_read+0x10/0x10 [ 101.806622][ T5329] comedi_do_insn+0x38/0x3d0 [ 101.808678][ T5329] comedi_dio_bitfield2+0x2fc/0x3d0 [ 101.810938][ T5329] ? __pfx_comedi_dio_bitfield2+0x10/0x10 [ 101.813435][ T5329] ? __kasan_kmalloc+0x93/0xb0 [ 101.815664][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.818298][ T5329] ? __lock_acquire+0x747/0x2de0 [ 101.820455][ T5329] bonding_dio_insn_bits+0x2cc/0x5e0 [ 101.822697][ T5329] ? __pfx_bonding_dio_insn_bits+0x10/0x10 [ 101.825190][ T5329] ? comedi_check_chanlist+0x299/0x330 [ 101.827521][ T5329] parse_insn+0xe75/0x1b20 [ 101.829467][ T5329] ? __pfx_parse_insn+0x10/0x10 [ 101.831593][ T5329] do_insn_ioctl+0x17c/0x5b0 [ 101.833783][ T5329] comedi_unlocked_ioctl+0xe06/0x1af0 [ 101.836003][ T5329] ? kasan_quarantine_put+0xbb/0x1f0 [ 101.838160][ T5329] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 101.840561][ T5329] ? tomoyo_path_number_perm+0x219/0x5f0 [ 101.842827][ T5329] ? tomoyo_path_number_perm+0x219/0x5f0 [ 101.845143][ T5329] ? do_vfs_ioctl+0x116f/0x1530 [ 101.847079][ T5329] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 101.849199][ T5329] ? hook_file_ioctl+0x1f2/0x600 [ 101.851208][ T5329] ? __fget_files+0x2a/0x420 [ 101.853082][ T5329] ? __fget_files+0x3a2/0x420 [ 101.854932][ T5329] ? __fget_files+0x2a/0x420 [ 101.856799][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 101.858884][ T5329] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 101.861222][ T5329] __se_sys_ioctl+0xfc/0x170 [ 101.863110][ T5329] do_syscall_64+0x166/0x520 [ 101.864998][ T5329] ? trace_irq_disable+0x3b/0x140 [ 101.867101][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.869608][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 101.871559][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.873914][ T5329] RIP: 0033:0x7fb28139e159 [ 101.875731][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.883481][ T5329] RSP: 002b:00007fb282223fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.886932][ T5329] RAX: ffffffffffffffda RBX: 00007fb281625fa0 RCX: 00007fb28139e159 [ 101.890244][ T5329] RDX: 0000200000000400 RSI: 000000008028640c RDI: 0000000000000004 [ 101.894517][ T5329] RBP: 00007fb28143503b R08: 0000000000000000 R09: 0000000000000000 [ 101.897765][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.900997][ T5329] R13: 00007fb281626038 R14: 00007fb281625fa0 R15: 00007ffebbcf9b38 [ 101.904235][ T5329] [ 101.917865][ T5294] Bluetooth: hci0: command tx timeout