Extracting prog: 3m18.276536495s
Minimizing prog: 9m15.02802495s
Simplifying prog options: 0s
Extracting C: 1m10.828758564s
Simplifying C: 13m19.088363281s
1 programs, timeouts [15s 6m0s]
extracting reproducer from 1 programs
single: executing 1 programs separately with timeout 15s
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x58, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0xa7, 0xa3, 0xb1, 0x20, 0x9fb, 0xebbe, 0xeafe, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x7a, 0x25, 0xe0, 0x0, [], [{{0x9, 0x5, 0x0, 0x3}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x0, 0x7}]}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x14}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0xf}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0xd4, 0x7}}]}}]}}]}}, 0x0)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x58, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0xa7, 0xa3, 0xb1, 0x20, 0x9fb, 0xebbe, 0xeafe, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x7a, 0x25, 0xe0, 0x0, [], [{{0x9, 0x5, 0x0, 0x3}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x0, 0x7}]}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x14}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0xf}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0xd4, 0x7}}]}}]}}]}}, 0x0)
program crashed: possible deadlock in touch_wq_lockdep_map
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x0, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: possible deadlock in touch_wq_lockdep_map
simplifying C reproducer
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: possible deadlock in touch_wq_lockdep_map
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: no output from test machine
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: possible deadlock in touch_wq_lockdep_map
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: possible deadlock in touch_wq_lockdep_map
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: possible deadlock in touch_wq_lockdep_map
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: possible deadlock in touch_wq_lockdep_map
reproducing took 27m3.221698291s
repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
6.11.0-rc1-syzkaller-00012-gd483f034f032 #0 Not tainted
--------------------------------------------
kworker/0:1H/44 is trying to acquire lock:
ffff888118cfd948 ((wq_completion)xillyusb){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x6e/0x120 kernel/workqueue.c:3876
but task is already holding lock:
ffff888118cfd948 ((wq_completion)xillyusb){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((wq_completion)xillyusb);
lock((wq_completion)xillyusb);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by kworker/0:1H/44:
#0: ffff888118cfd948 ((wq_completion)xillyusb){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc900004f7d80 ((work_completion)(&xdev->wakeup_workitem)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
stack backtrace:
CPU: 0 UID: 0 PID: 44 Comm: kworker/0:1H Not tainted 6.11.0-rc1-syzkaller-00012-gd483f034f032 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: xillyusb wakeup_all
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_deadlock kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3855 [inline]
__lock_acquire+0x2167/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3876
__flush_workqueue+0x129/0x1200 kernel/workqueue.c:3918
drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4082
destroy_workqueue+0xc2/0xaa0 kernel/workqueue.c:5781
cleanup_dev+0xc5/0x150 drivers/char/xillybus/xillyusb.c:558
kref_put include/linux/kref.h:65 [inline]
wakeup_all+0x28c/0x300 drivers/char/xillybus/xillyusb.c:612
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
final repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
6.11.0-rc1-syzkaller-00012-gd483f034f032 #0 Not tainted
--------------------------------------------
kworker/0:1H/44 is trying to acquire lock:
ffff888118cfd948 ((wq_completion)xillyusb){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x6e/0x120 kernel/workqueue.c:3876
but task is already holding lock:
ffff888118cfd948 ((wq_completion)xillyusb){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((wq_completion)xillyusb);
lock((wq_completion)xillyusb);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by kworker/0:1H/44:
#0: ffff888118cfd948 ((wq_completion)xillyusb){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc900004f7d80 ((work_completion)(&xdev->wakeup_workitem)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
stack backtrace:
CPU: 0 UID: 0 PID: 44 Comm: kworker/0:1H Not tainted 6.11.0-rc1-syzkaller-00012-gd483f034f032 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: xillyusb wakeup_all
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_deadlock kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3855 [inline]
__lock_acquire+0x2167/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3876
__flush_workqueue+0x129/0x1200 kernel/workqueue.c:3918
drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4082
destroy_workqueue+0xc2/0xaa0 kernel/workqueue.c:5781
cleanup_dev+0xc5/0x150 drivers/char/xillybus/xillyusb.c:558
kref_put include/linux/kref.h:65 [inline]
wakeup_all+0x28c/0x300 drivers/char/xillybus/xillyusb.c:612
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244