bisecting fixing commit since 830a059cbba6832c11fefc0894c7ec7a27f75734 building syzkaller on 6a81331a1d4c744da9204d02ec88d558f7eea9c9 testing commit 830a059cbba6832c11fefc0894c7ec7a27f75734 with gcc (GCC) 8.4.1 20210217 kernel signature: 110c014e9555b7b3d1ad8f5b75d554ee2766c8f73c9b608dea690171f3a40ca6 all runs: crashed: possible deadlock in vmci_qp_broker_detach testing current HEAD 3c8c23092588a23bf1856a64f58c37f477a413be testing commit 3c8c23092588a23bf1856a64f58c37f477a413be with gcc (GCC) 8.4.1 20210217 kernel signature: 9705f74a76732d58a227a9e1d7e883aa42c3bcb47167fa9a2be19e80bb85ef96 all runs: crashed: possible deadlock in vmci_qp_broker_detach revisions tested: 2, total time: 27m27.369780998s (build: 19m1.561084268s, test: 7m58.952480084s) the crash still happens on HEAD commit msg: Linux 4.19.190 crash: possible deadlock in vmci_qp_broker_detach R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff3558c8df R14: 00007f6b8e19e300 R15: 0000000000022000 Failed to allocate memory for datagram ============================================ WARNING: possible recursive locking detected 4.19.190-syzkaller #0 Not tainted -------------------------------------------- syz-executor.4/13752 is trying to acquire lock: 00000000a2161a54 (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 but task is already holding lock: 00000000a2161a54 (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(qp_broker_list.mutex); lock(qp_broker_list.mutex); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by syz-executor.4/13752: #0: 00000000a2161a54 (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 stack backtrace: CPU: 1 PID: 13752 Comm: syz-executor.4 Not tainted 4.19.190-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:1764 [inline] check_deadlock kernel/locking/lockdep.c:1808 [inline] validate_chain kernel/locking/lockdep.c:2404 [inline] __lock_acquire.cold.40+0x344/0x744 kernel/locking/lockdep.c:3416 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __mutex_lock_common kernel/locking/mutex.c:928 [inline] __mutex_lock+0xf5/0x1200 kernel/locking/mutex.c:1075 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1090 vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:452 [inline] kref_put include/linux/kref.h:70 [inline] vmci_ctx_put+0x4ab/0xc90 drivers/misc/vmw_vmci/vmci_context.c:505 vmci_ctx_enqueue_datagram.cold.7+0x14/0x1e drivers/misc/vmw_vmci/vmci_context.c:328 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:283 [inline] vmci_datagram_dispatch drivers/misc/vmw_vmci/vmci_datagram.c:347 [inline] vmci_datagram_dispatch+0x283/0x960 drivers/misc/vmw_vmci/vmci_datagram.c:322 qp_notify_peer+0x1bd/0x230 drivers/misc/vmw_vmci/vmci_queue_pair.c:1488 vmci_qp_broker_detach+0x460/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2192 ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:452 [inline] kref_put include/linux/kref.h:70 [inline] vmci_ctx_put+0x4ab/0xc90 drivers/misc/vmw_vmci/vmci_context.c:505 vmci_ctx_destroy+0xe3/0x130 drivers/misc/vmw_vmci/vmci_context.c:203 vmci_host_close+0xf8/0x180 drivers/misc/vmw_vmci/vmci_host.c:147 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6b8e19e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000124 RAX: 0000000000000004 RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 RBP: 00007f6b8e19e1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff3558c8df R14: 00007f6b8e19e300 R15: 0000000000022000