bisecting fixing commit since 1e986fe9ad15b8406034c504afc5ae76f0a8e852 building syzkaller on 3c7fef3361a6007112b26adc1c5a550189ef43fe testing commit 1e986fe9ad15b8406034c504afc5ae76f0a8e852 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 6181657ed78f18fdf94a6b1500e9d17f6ea74398cd44b47c542c557c2972ee17 all runs: crashed: possible deadlock in vmci_qp_broker_detach testing current HEAD 6ca2f514c57864e3085a65c5e9d2adca4144bc4c testing commit 6ca2f514c57864e3085a65c5e9d2adca4144bc4c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 81a334d08e57163d2a9caf75f2b7a5c77e8ceed8803341e3c0d2ede79cabb604 all runs: crashed: possible deadlock in vmci_qp_broker_detach revisions tested: 2, total time: 33m57.015864268s (build: 16m55.64734041s, test: 16m25.7628544s) the crash still happens on HEAD commit msg: Linux 4.19.201 crash: possible deadlock in vmci_qp_broker_detach Failed to enqueue queue_pair DETACH event datagram for context (ID=0x10) Failed to enqueue queue_pair DETACH event datagram for context (ID=0x10) Failed to enqueue queue_pair DETACH event datagram for context (ID=0x1) ============================================ WARNING: possible recursive locking detected 4.19.201-syzkaller #0 Not tainted -------------------------------------------- syz-executor.5/14862 is trying to acquire lock: 000000009c2d773c (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 but task is already holding lock: 000000009c2d773c (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(qp_broker_list.mutex); lock(qp_broker_list.mutex); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by syz-executor.5/14862: #0: 000000009c2d773c (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 stack backtrace: CPU: 0 PID: 14862 Comm: syz-executor.5 Not tainted 4.19.201-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:1764 [inline] check_deadlock kernel/locking/lockdep.c:1808 [inline] validate_chain kernel/locking/lockdep.c:2404 [inline] __lock_acquire.cold.40+0x344/0x744 kernel/locking/lockdep.c:3416 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __mutex_lock_common kernel/locking/mutex.c:938 [inline] __mutex_lock+0xf5/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:452 [inline] kref_put include/linux/kref.h:70 [inline] vmci_ctx_put+0x4ab/0xc90 drivers/misc/vmw_vmci/vmci_context.c:505 vmci_ctx_enqueue_datagram+0x387/0x4b0 drivers/misc/vmw_vmci/vmci_context.c:368 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:283 [inline] vmci_datagram_dispatch drivers/misc/vmw_vmci/vmci_datagram.c:347 [inline] vmci_datagram_dispatch+0x283/0x960 drivers/misc/vmw_vmci/vmci_datagram.c:322 qp_notify_peer+0x1bd/0x230 drivers/misc/vmw_vmci/vmci_queue_pair.c:1488 vmci_qp_broker_detach+0x460/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2192 ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:452 [inline] kref_put include/linux/kref.h:70 [inline] vmci_ctx_put+0x4ab/0xc90 drivers/misc/vmw_vmci/vmci_context.c:505 vmci_ctx_destroy+0xe3/0x130 drivers/misc/vmw_vmci/vmci_context.c:203 vmci_host_close+0xf8/0x180 drivers/misc/vmw_vmci/vmci_host.c:147 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4193eb Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffc89186ff0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00000000004193eb RDX: 0000000000570478 RSI: 0000000000000080 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000570420 R10: 00007ffc891870e0 R11: 0000000000000293 R12: 000000000005638e R13: 00000000000003e8 R14: 000000000056bf80 R15: 000000000005637e