On Mon, Aug 25, 2025 at 01:51:29AM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 8d245acc1e88 Merge tag 'char-misc-6.17-rc3' of git://git.k.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=11e42062580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=e1e1566c7726877e > dashboard link: https://syzkaller.appspot.com/bug?extid=8baacc4139f12fa77909 > compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13317062580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d5ea34580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/096739d8f0ec/disk-8d245acc.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/83a21aa9b978/vmlinux-8d245acc.xz > kernel image: https://storage.googleapis.com/syzbot-assets/7e7f165a3b29/bzImage-8d245acc.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+8baacc4139f12fa77909@xxxxxxxxxxxxxxxxxxxxxxxxx > > BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 > in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 6118, name: syz.0.17 > preempt_count: 0, expected: 0 > RCU nest depth: 0, expected: 0 > 1 lock held by syz.0.17/6118: > #0: ffff888144724058 (&dum_hcd->dum->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline] > #0: ffff888144724058 (&dum_hcd->dum->lock){+.+.}-{3:3}, at: dummy_dequeue+0x164/0x480 drivers/usb/gadget/udc/dummy_hcd.c:769 Here's the solution that we settled on. Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ 8d245acc1e88 Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -765,8 +765,7 @@ static int dummy_dequeue(struct usb_ep * if (!dum->driver) return -ESHUTDOWN; - local_irq_save(flags); - spin_lock(&dum->lock); + spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { if (&iter->req != _req) continue; @@ -776,15 +775,16 @@ static int dummy_dequeue(struct usb_ep * retval = 0; break; } - spin_unlock(&dum->lock); if (retval == 0) { dev_dbg(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); + spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); + spin_lock(&dum->lock); } - local_irq_restore(flags); + spin_unlock_irqrestore(&dum->lock, flags); return retval; }