del_device_store() holds nsim_bus_dev_list_lock while calling nsim_bus_dev_del(), which calls device_unregister() which internally acquires the device lock. Similarly, nsim_bus_exit() holds the same lock while calling nsim_bus_dev_del(). If another thread already holds the device lock and tries to acquire nsim_bus_dev_list_lock, a deadlock occurs: INFO: task hung in nsim_bus_dev_del Fix this by releasing nsim_bus_dev_list_lock before calling nsim_bus_dev_del() in both locations, after the devices have already been removed from the list with list_del(). A similar issue exists in new_device_store() which can be addressed separately. Reported-by: syzbot+1cf303af03cf30b1275a@syzkaller.appspot.com Closes: https://syzkaller.appspot.com/bug?extid=1cf303af03cf30b1275a Signed-off-by: Moksh Panicker --- drivers/net/netdevsim/bus.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c index 41483e371..0f02ff8ad 100644 --- a/drivers/net/netdevsim/bus.c +++ b/drivers/net/netdevsim/bus.c @@ -241,11 +241,12 @@ del_device_store(const struct bus_type *bus, const char *buf, size_t count) if (nsim_bus_dev->dev.id != id) continue; list_del(&nsim_bus_dev->list); - nsim_bus_dev_del(nsim_bus_dev); err = 0; break; } mutex_unlock(&nsim_bus_dev_list_lock); + if (!err) + nsim_bus_dev_del(nsim_bus_dev); return !err ? count : err; } static BUS_ATTR_WO(del_device); @@ -527,11 +528,11 @@ void nsim_bus_exit(void) complete(&nsim_bus_devs_released); mutex_lock(&nsim_bus_dev_list_lock); - list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) { + list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) list_del(&nsim_bus_dev->list); - nsim_bus_dev_del(nsim_bus_dev); - } mutex_unlock(&nsim_bus_dev_list_lock); + list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) + nsim_bus_dev_del(nsim_bus_dev); wait_for_completion(&nsim_bus_devs_released); -- 2.34.1