ci2 starts bisection 2023-09-22 01:38:55.521585026 +0000 UTC m=+753667.550759129
bisecting fixing commit since 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3
building syzkaller on a4ae4f428721da42ac15f07d6f3b54584dedee27
ensuring issue is reproducible on original commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3

testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: bf4a820ec71c4fe77ee635686d2018a3bb4c9ffc392b6e66805c4cdb231b3941
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #8: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #9: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
check whether we can drop unnecessary instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 05e5a01c9dd85b460d5fdc277d739f3a3a1876a545e562619e251357f89a301f
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
the bug reproduces without the instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
kconfig minimization: base=5179 full=6520 leaves diff=250
split chunks (needed=false): <250>
split chunk #0 of len 250 into 5 parts
testing without sub-chunk 1/5
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 437c56549b935cdd3016d44ff4fccfab6f3adea0b133f1246a59d1273a4ad19e
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG LOCKDEP], they are not needed
testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c1edf510998f7417d94f9e4cc370d3a94ddbc13cda1144ac8f0b295c115c1aa3
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 384fd268e4fa8eec1983c12021d6d1a8f4d0f3cca071847bc1c8481a62947e1e
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3d131b8aa7a25e29da0bcb55f23d9c0c2e8ad33e59620562a254f199fd83701b
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
testing without sub-chunk 5/5
disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
failed building 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3: net/socket.c:1225: undefined reference to `wext_handle_ioctl'
net/socket.c:3420: undefined reference to `compat_wext_handle_ioctl'
net/core/net-procfs.c:329: undefined reference to `wext_proc_init'
net/core/net-procfs.c:345: undefined reference to `wext_proc_exit'
minimized to 100 configs; suspects: [COMMON_CLK HID_ZEROPLUS SND SOUND USB_CONFIGFS USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_ACC USB_CONFIGFS_F_AUDIO_SRC USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONFIGFS_UEVENT USB_DWC3_OF_SIMPLE USB_EHSET_TEST_FIXTURE USB_F_ACC USB_F_ACM USB_F_AUDIO_SRC USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_NCM USB_F_OBEX USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_IPHETH USB_ISP1760 USB_ISP1760_HCD USB_ISP1760_HOST_ROLE USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_MON USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF]
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed
testing current HEAD a3cb85bffea164b19b0f650226207200a8439c54
testing commit a3cb85bffea164b19b0f650226207200a8439c54 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e3e3dce107733a6d775869dc07dc7fc2568c449ef1cf0c44daead3f5c99d5282
all runs: OK
false negative chance: 0.000
# git bisect start a3cb85bffea164b19b0f650226207200a8439c54 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3
Bisecting: 320 revisions left to test after this (roughly 8 steps)
[dc8c661b99a07db3eb207494847a3ffc236fc37a] ANDROID: ABI: Add to QCOM symbols list

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit dc8c661b99a07db3eb207494847a3ffc236fc37a gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 516340abdd00d0bdf3ac2b49e772c4f76a5b58d81218aefd13511be37b73f77b
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
# git bisect good dc8c661b99a07db3eb207494847a3ffc236fc37a
Bisecting: 160 revisions left to test after this (roughly 7 steps)
[0ee0062c9486e1cff101fb2ee169bb0a31384208] UPSTREAM: mm: fix memory ordering for mm_lock_seq and vm_lock_seq

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit 0ee0062c9486e1cff101fb2ee169bb0a31384208 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ed264b4274e089f893013804c689a2914486c63225150729dce0c4ab7e1da9c2
all runs: OK
false negative chance: 0.000
# git bisect bad 0ee0062c9486e1cff101fb2ee169bb0a31384208
Bisecting: 79 revisions left to test after this (roughly 6 steps)
[3803ae4a2832706860970b8a81591bd0c7798636] BACKPORT: mm: introduce new 'lock_mm_and_find_vma()' page fault helper

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit 3803ae4a2832706860970b8a81591bd0c7798636 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9a5e2c6d2a9014a82feb41c4dbabd2cde2200140e17d8789a39e95f778ad5ecf
all runs: OK
false negative chance: 0.000
# git bisect bad 3803ae4a2832706860970b8a81591bd0c7798636
Bisecting: 39 revisions left to test after this (roughly 5 steps)
[4a207efbe0b5b01cee3aabd804916e1968eabafb] FROMGIT: mm: add missing VM_FAULT_RESULT_TRACE name for VM_FAULT_COMPLETED

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit 4a207efbe0b5b01cee3aabd804916e1968eabafb gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f79b1e06a98a15aae17c614ac3ec0b2b343b6670658d783149361fb56d3cec12
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
# git bisect good 4a207efbe0b5b01cee3aabd804916e1968eabafb
Bisecting: 19 revisions left to test after this (roughly 4 steps)
[1bb5e7fb374bcc59a940f3eb3dab1a1195ddbbca] ANDROID: abi_gki_aarch64_qcom: update abi

determine whether the revision contains the guilty commit
revision dc8c661b99a07db3eb207494847a3ffc236fc37a crashed and is reachable
testing commit 1bb5e7fb374bcc59a940f3eb3dab1a1195ddbbca gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: fad7e05d8e38b7295df8ab87b2fb4d89b94ff2779dd2c58a3c6fad779b445399
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #8: OK
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
# git bisect good 1bb5e7fb374bcc59a940f3eb3dab1a1195ddbbca
Bisecting: 9 revisions left to test after this (roughly 3 steps)
[466448f55f0b6e14b6b1ab874ebe9a704fb7b821] BACKPORT: mm/mmap: Fix error return in do_vmi_align_munmap()

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit 466448f55f0b6e14b6b1ab874ebe9a704fb7b821 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 3d50773785e6e13e9e50bd19c94818885594d4f6c06633f6c8f7154014735e81
all runs: OK
false negative chance: 0.004
# git bisect bad 466448f55f0b6e14b6b1ab874ebe9a704fb7b821
Bisecting: 4 revisions left to test after this (roughly 2 steps)
[58870404915576c071d6f2a8388a3daa97837df6] UPSTREAM: fbdev: fix potential OOB read in fast_imageblit()

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit 58870404915576c071d6f2a8388a3daa97837df6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 31dad136b54d5715369e55dbe965c6ef3272bb72d405fca25016932d5c8c03ca
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #8: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #9: OK
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
# git bisect good 58870404915576c071d6f2a8388a3daa97837df6
Bisecting: 2 revisions left to test after this (roughly 1 step)
[0e477a82e6d9e013a7f26cba2a2012179d28ac74] UPSTREAM: HID: hidraw: fix data race on device refcount

determine whether the revision contains the guilty commit
revision 1bb5e7fb374bcc59a940f3eb3dab1a1195ddbbca crashed and is reachable
testing commit 0e477a82e6d9e013a7f26cba2a2012179d28ac74 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9fac60cb103a0a1002b688b6727461a953393e252912fb1242ed3ad6cb5f5716
all runs: OK
false negative chance: 0.004
# git bisect bad 0e477a82e6d9e013a7f26cba2a2012179d28ac74
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[af2d741bf3d9a11e28b2a7785199829039bdfc12] UPSTREAM: can: isotp: isotp_sendmsg(): fix return error fix on TX path

determine whether the revision contains the guilty commit
revision 312dfb3b7ec3beb9ff305db3b194e19eec7f2bc3 crashed and is reachable
testing commit af2d741bf3d9a11e28b2a7785199829039bdfc12 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f1b053e57ff4004277aa7db3478c89f33010160b81ffa6e667b6fccf0bdea4a1
run #0: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #1: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #2: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #3: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #4: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #5: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #6: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #7: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #8: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #9: crashed: KASAN: null-ptr-deref Write in hidraw_release
run #10: OK
run #11: OK
run #12: OK
run #13: OK
run #14: OK
run #15: OK
run #16: OK
run #17: OK
run #18: OK
run #19: OK
representative crash: KASAN: null-ptr-deref Write in hidraw_release, types: [KASAN]
# git bisect good af2d741bf3d9a11e28b2a7785199829039bdfc12
0e477a82e6d9e013a7f26cba2a2012179d28ac74 is the first bad commit
commit 0e477a82e6d9e013a7f26cba2a2012179d28ac74
Author: Ludvig Michaelsson <ludvig.michaelsson@yubico.com>
Date:   Wed Jun 21 13:17:43 2023 +0200

    UPSTREAM: HID: hidraw: fix data race on device refcount
    
    commit 944ee77dc6ec7b0afd8ec70ffc418b238c92f12b upstream.
    
    The hidraw_open() function increments the hidraw device reference
    counter. The counter has no dedicated synchronization mechanism,
    resulting in a potential data race when concurrently opening a device.
    
    The race is a regression introduced by commit 8590222e4b02 ("HID:
    hidraw: Replace hidraw device table mutex with a rwsem"). While
    minors_rwsem is intended to protect the hidraw_table itself, by instead
    acquiring the lock for writing, the reference counter is also protected.
    This is symmetrical to hidraw_release().
    
    Link: https://github.com/systemd/systemd/issues/27947
    Fixes: 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ludvig Michaelsson <ludvig.michaelsson@yubico.com>
    Link: https://lore.kernel.org/r/20230621-hidraw-race-v1-1-a58e6ac69bab@yubico.com
    Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Change-Id: I312349145e8f2d55ea2182b94a3b3293b839818d
    (cherry picked from commit 879e79c3aead41b8aa2e91164354b30bd1c4ef3b)
    Signed-off-by: Suren Baghdasaryan <surenb@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

 drivers/hid/hidraw.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

accumulated error probability: 0.01
culprit signature: 9fac60cb103a0a1002b688b6727461a953393e252912fb1242ed3ad6cb5f5716
parent  signature: f1b053e57ff4004277aa7db3478c89f33010160b81ffa6e667b6fccf0bdea4a1
reproducer is flaky (0.24 repro chance estimate)
revisions tested: 16, total time: 4h4m11.456080791s (build: 44m43.165601307s, test: 3h13m49.60886648s)
first good commit: 0e477a82e6d9e013a7f26cba2a2012179d28ac74 UPSTREAM: HID: hidraw: fix data race on device refcount
recipients (to): ["benjamin.tissoires@redhat.com" "gregkh@google.com" "gregkh@linuxfoundation.org" "ludvig.michaelsson@yubico.com" "surenb@google.com"]
recipients (cc): []