program: r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]}) [ 101.489881][ T5329] comedi comedi0: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached [ 101.541471][ T5329] comedi comedi1: comedi_bond: 0:2 attached, 32 channels from 1 devices [ 101.541802][ T5329] [ 101.545862][ T5329] ============================================ [ 101.548129][ T5329] WARNING: possible recursive locking detected [ 101.550387][ T5329] syzkaller #0 Not tainted [ 101.552103][ T5329] -------------------------------------------- [ 101.554501][ T5329] syz.0.0/5329 is trying to acquire lock: [ 101.556610][ T5329] ffff88803f0e98f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_do_insn+0x38/0x3d0 [ 101.560100][ T5329] [ 101.560100][ T5329] but task is already holding lock: [ 101.563058][ T5329] ffff88803f0e90f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x210/0x1af0 [ 101.566921][ T5329] [ 101.566921][ T5329] other info that might help us debug this: [ 101.570068][ T5329] Possible unsafe locking scenario: [ 101.570068][ T5329] [ 101.573006][ T5329] CPU0 [ 101.574386][ T5329] ---- [ 101.575749][ T5329] lock(&dev->mutex#4); [ 101.577402][ T5329] lock(&dev->mutex#4); [ 101.579154][ T5329] [ 101.579154][ T5329] *** DEADLOCK *** [ 101.579154][ T5329] [ 101.582368][ T5329] May be due to missing lock nesting notation [ 101.582368][ T5329] [ 101.585608][ T5329] locks held by syz.0.0/5329: 1, last CPU#0: [ 101.587998][ T5329] #0: ffff88803f0e90f0 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x210/0x1af0 [ 101.592158][ T5329] [ 101.592158][ T5329] stack backtrace: [ 101.594613][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.598554][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.602731][ T5329] Call Trace: [ 101.604272][ T5329] [ 101.605530][ T5329] dump_stack_lvl+0xe8/0x150 [ 101.607500][ T5329] print_deadlock_bug+0x27a/0x290 [ 101.609625][ T5329] __lock_acquire+0x25db/0x2de0 [ 101.611719][ T5329] ? __bfs+0x153/0x290 [ 101.613473][ T5329] ? __pfx_hlock_conflict+0x10/0x10 [ 101.615674][ T5329] lock_acquire+0x115/0x350 [ 101.617590][ T5329] ? comedi_do_insn+0x38/0x3d0 [ 101.619608][ T5329] __mutex_lock+0x19d/0x1550 [ 101.621565][ T5329] ? comedi_do_insn+0x38/0x3d0 [ 101.623604][ T5329] ? comedi_do_insn+0x38/0x3d0 [ 101.625612][ T5329] ? __pfx___mutex_lock+0x10/0x10 [ 101.627712][ T5329] ? rcu_is_watching+0x16/0xb0 [ 101.629766][ T5329] ? __pfx___up_read+0x10/0x10 [ 101.631616][ T5329] comedi_do_insn+0x38/0x3d0 [ 101.633604][ T5329] comedi_dio_bitfield2+0x2fc/0x3d0 [ 101.635801][ T5329] ? __pfx_comedi_dio_bitfield2+0x10/0x10 [ 101.638138][ T5329] ? __kasan_kmalloc+0x93/0xb0 [ 101.640107][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.642714][ T5329] ? __lock_acquire+0x747/0x2de0 [ 101.644798][ T5329] bonding_dio_insn_bits+0x2cc/0x5e0 [ 101.646974][ T5329] ? __pfx_bonding_dio_insn_bits+0x10/0x10 [ 101.649480][ T5329] ? comedi_check_chanlist+0x299/0x330 [ 101.653000][ T5329] parse_insn+0xe75/0x1b20 [ 101.654928][ T5329] ? __pfx_parse_insn+0x10/0x10 [ 101.656974][ T5329] do_insn_ioctl+0x17c/0x5b0 [ 101.658939][ T5329] comedi_unlocked_ioctl+0xe06/0x1af0 [ 101.661258][ T5329] ? kasan_quarantine_put+0xbb/0x1f0 [ 101.663543][ T5329] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 101.665928][ T5329] ? tomoyo_path_number_perm+0x219/0x5f0 [ 101.667997][ T5329] ? tomoyo_path_number_perm+0x219/0x5f0 [ 101.670132][ T5329] ? do_vfs_ioctl+0x116f/0x1530 [ 101.672090][ T5329] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 101.674180][ T5329] ? hook_file_ioctl+0x1f2/0x600 [ 101.676166][ T5329] ? __fget_files+0x2a/0x420 [ 101.678071][ T5329] ? __fget_files+0x3a2/0x420 [ 101.679984][ T5329] ? __fget_files+0x2a/0x420 [ 101.681917][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 101.683970][ T5329] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 101.686334][ T5329] __se_sys_ioctl+0xfc/0x170 [ 101.688185][ T5329] do_syscall_64+0x166/0x520 [ 101.690152][ T5329] ? trace_irq_disable+0x3b/0x140 [ 101.692230][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.694776][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 101.696700][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.699087][ T5329] RIP: 0033:0x7f98b3f9e159 [ 101.701013][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.708919][ T5329] RSP: 002b:00007f98b4ed5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.712471][ T5329] RAX: ffffffffffffffda RBX: 00007f98b4225fa0 RCX: 00007f98b3f9e159 [ 101.715801][ T5329] RDX: 0000200000000400 RSI: 000000008028640c RDI: 0000000000000004 [ 101.719164][ T5329] RBP: 00007f98b403503b R08: 0000000000000000 R09: 0000000000000000 [ 101.722487][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.725938][ T5329] R13: 00007f98b4226038 R14: 00007f98b4225fa0 R15: 00007ffc28f203b8 [ 101.729125][ T5329] [ 101.753361][ T5293] Bluetooth: hci0: command tx timeout