syzbot


WARNING: locking bug in nci_close_device (3)

Status: upstream: reported on 2026/01/07 15:44
Subsystems: nfc net
[Documentation on labels]
Reported-by: syzbot+f9c5fd1a0874f9069dce@syzkaller.appspotmail.com
Fix commit: d2492688bb9f nfc: nci: Fix race between rfkill and nci_unregister_device().
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci2-upstream-usb]
First crash: 27d, last: 1d22h
Discussions (4)
Title Replies (including bot) Last reply
[PATCH v2 net] nfc: nci: Fix race between rfkill and nci_unregister_device(). 3 (3) 2026/01/29 03:40
[PATCH v1 net] nfc: nci: Fix race between rfkill and nci_unregister_device(). 1 (1) 2026/01/26 07:13
[syzbot] Monthly nfc report (Jan 2026) 0 (1) 2026/01/12 08:40
[syzbot] [net?] [nfc?] WARNING: locking bug in nci_close_device (3) 0 (1) 2026/01/07 15:44
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: locking bug in nci_close_device (2) nfc net 4 C error 11 655d 671d 0/29 auto-obsoleted due to no activity on 2024/06/24 08:40
upstream WARNING: locking bug in nci_close_device net nfc 4 1 1096d 1092d 0/29 auto-obsoleted due to no activity on 2023/05/30 15:14

Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.5.24815/24929
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:227 [inline], CPU#0: syz.5.24815/24929
WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.5.24815/24929
WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x163b/0x2630 kernel/locking/lockdep.c:5187, CPU#0: syz.5.24815/24929
Modules linked in:
CPU: 0 UID: 0 PID: 24929 Comm: syz.5.24815 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline]
RIP: 0010:hlock_class kernel/locking/lockdep.c:227 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline]
RIP: 0010:__lock_acquire+0x1642/0x2630 kernel/locking/lockdep.c:5187
Code: 0f 16 c3 8d 67 48 0f b9 3a 44 8b 44 24 18 0f b6 54 24 10 8b 4c 24 08 e9 b6 f9 ff ff 48 8d 3d 25 8c d7 0e 48 c7 c6 0f 16 c3 8d <67> 48 0f b9 3a 44 8b 44 24 10 8b 4c 24 08 e9 c9 f9 ff ff e8 06 16
RSP: 0018:ffffc90007c77878 EFLAGS: 00010046
RAX: 0000000000000001 RBX: ffff8880585cb068 RCX: 0000000000000003
RDX: ffff8880585ca4c0 RSI: ffffffff8dc3160f RDI: ffffffff90ba9960
RBP: ffff8880585ca4c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 00000000000015c8 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f3d5bfc76c0(0000) GS:ffff8880d65db000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cbffe6a6b0 CR3: 000000004e80b000 CR4: 0000000000352ef0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
 touch_wq_lockdep_map+0xad/0x1c0 kernel/workqueue.c:3940
 __flush_workqueue+0x131/0x1200 kernel/workqueue.c:3982
 nci_close_device.isra.0+0xc5/0x380 net/nfc/nci/core.c:567
 nci_dev_down+0x37/0x50 net/nfc/nci/core.c:639
 nfc_dev_down+0x19d/0x300 net/nfc/core.c:161
 nfc_rfkill_set_block+0x3b/0x100 net/nfc/core.c:179
 rfkill_set_block+0x205/0x510 net/rfkill/core.c:346
 rfkill_fop_write+0x2c0/0x580 net/rfkill/core.c:1301
 vfs_write+0x2aa/0x1070 fs/read_write.c:684
 ksys_write+0x1f8/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d5b19aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3d5bfc7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3d5b415fa0 RCX: 00007f3d5b19aeb9
RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f3d5b208c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3d5b416038 R14: 00007f3d5b415fa0 R15: 00007ffe3d2a7ee8
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 16 c3             	movlhps %xmm3,%xmm0
   3:	8d 67 48             	lea    0x48(%rdi),%esp
   6:	0f b9 3a             	ud1    (%rdx),%edi
   9:	44 8b 44 24 18       	mov    0x18(%rsp),%r8d
   e:	0f b6 54 24 10       	movzbl 0x10(%rsp),%edx
  13:	8b 4c 24 08          	mov    0x8(%rsp),%ecx
  17:	e9 b6 f9 ff ff       	jmp    0xfffff9d2
  1c:	48 8d 3d 25 8c d7 0e 	lea    0xed78c25(%rip),%rdi        # 0xed78c48
  23:	48 c7 c6 0f 16 c3 8d 	mov    $0xffffffff8dc3160f,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	44 8b 44 24 10       	mov    0x10(%rsp),%r8d
  34:	8b 4c 24 08          	mov    0x8(%rsp),%ecx
  38:	e9 c9 f9 ff ff       	jmp    0xfffffa06
  3d:	e8                   	.byte 0xe8
  3e:	06                   	(bad)
  3f:	16                   	(bad)

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/29 01:12 upstream 8dfce8991b95 0adc945e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: locking bug in nci_close_device
2026/01/28 14:24 net a040afa3bca4 004c195c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/28 01:02 net e9acda52fd2e 3029c699 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/27 18:03 net 8d7ba71e4621 9a514c2f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/27 10:40 net 8d7ba71e4621 9a514c2f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/26 00:15 net 8016dc5ee19a 55756628 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/25 01:47 net 8016dc5ee19a 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/24 05:56 net 8016dc5ee19a 4f25b9b4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/23 06:50 net 4a3dba481882 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
2026/01/03 15:40 net dbf8fe85a16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: locking bug in nci_close_device
* Struck through repros no longer work on HEAD.