bisecting fixing commit since 1e986fe9ad15b8406034c504afc5ae76f0a8e852 building syzkaller on 3c7fef3361a6007112b26adc1c5a550189ef43fe testing commit 1e986fe9ad15b8406034c504afc5ae76f0a8e852 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 19276847d017b8fe96cab062c5a1b8e1d98c752eb5900e4af8a2efd8ffbffe47 all runs: crashed: possible deadlock in vmci_qp_broker_detach testing current HEAD c2276d585654e8d573366c29c565043ec36adf63 testing commit c2276d585654e8d573366c29c565043ec36adf63 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f796d937e481b4f26c1b8324ee5263566f79d18ca9ec85db04d5703aabb49612 all runs: crashed: possible deadlock in vmci_qp_broker_detach revisions tested: 2, total time: 31m20.168854438s (build: 16m22.606532211s, test: 14m22.64100304s) the crash still happens on HEAD commit msg: Linux 4.19.208 crash: possible deadlock in vmci_qp_broker_detach Failed to enqueue queue_pair DETACH event datagram for context (ID=0x10) Failed to enqueue queue_pair DETACH event datagram for context (ID=0x10) Failed to enqueue queue_pair DETACH event datagram for context (ID=0x10) ============================================ WARNING: possible recursive locking detected 4.19.208-syzkaller #0 Not tainted -------------------------------------------- syz-executor.1/1589 is trying to acquire lock: 00000000728c28a4 (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 but task is already holding lock: 00000000728c28a4 (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(qp_broker_list.mutex); lock(qp_broker_list.mutex); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by syz-executor.1/1589: #0: 00000000728c28a4 (qp_broker_list.mutex){+.+.}, at: vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 stack backtrace: CPU: 0 PID: 1589 Comm: syz-executor.1 Not tainted 4.19.208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:1764 [inline] check_deadlock kernel/locking/lockdep.c:1808 [inline] validate_chain kernel/locking/lockdep.c:2404 [inline] __lock_acquire.cold.40+0x344/0x744 kernel/locking/lockdep.c:3416 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __mutex_lock_common kernel/locking/mutex.c:937 [inline] __mutex_lock+0xf5/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 vmci_qp_broker_detach+0x11d/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2099 ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:452 [inline] kref_put include/linux/kref.h:70 [inline] vmci_ctx_put+0x4ab/0xc90 drivers/misc/vmw_vmci/vmci_context.c:505 vmci_ctx_enqueue_datagram+0x387/0x4b0 drivers/misc/vmw_vmci/vmci_context.c:368 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:283 [inline] vmci_datagram_dispatch drivers/misc/vmw_vmci/vmci_datagram.c:347 [inline] vmci_datagram_dispatch+0x283/0x960 drivers/misc/vmw_vmci/vmci_datagram.c:322 qp_notify_peer+0x1bd/0x230 drivers/misc/vmw_vmci/vmci_queue_pair.c:1488 vmci_qp_broker_detach+0x460/0x15e0 drivers/misc/vmw_vmci/vmci_queue_pair.c:2192 ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:452 [inline] kref_put include/linux/kref.h:70 [inline] vmci_ctx_put+0x4ab/0xc90 drivers/misc/vmw_vmci/vmci_context.c:505 vmci_ctx_destroy+0xe3/0x130 drivers/misc/vmw_vmci/vmci_context.c:203 vmci_host_close+0xf8/0x180 drivers/misc/vmw_vmci/vmci_host.c:147 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4193eb Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffef435a8e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00000000004193eb RDX: 0000000000570478 RSI: 0000000000000080 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000570420 R10: 00007ffef435a9d0 R11: 0000000000000293 R12: 0000000000033424 R13: 00000000000003e8 R14: 000000000056bf80 R15: 0000000000033416