Re: [syzbot] [fs?] BUG: corrupted list in remove_wait_queue (2)

[Hillf Danton <hdanton@sina.com>]

> Date: Mon, 07 Jul 2025 02:30:02 -0700
> syzbot has bisected this issue to:
> 
> commit 8ffdff6a8cfbdc174a3a390b6f825a277b5bb895
> Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Date:   Wed Apr 14 08:58:10 2021 +0000
> 
>     staging: comedi: move out of staging directory
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13009f70580000
> start commit:   05df91921da6 Merge tag 'v6.16-rc4-smb3-client-fixes' of gi..
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=10809f70580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=17009f70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=45bd916a213c79bb
> dashboard link: https://syzkaller.appspot.com/bug?extid=4e21d5f67b886a692b55
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=161cdc8c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14d1a582580000

#syz test upstream master

--- x/drivers/comedi/comedi_fops.c
+++ y/drivers/comedi/comedi_fops.c
@@ -2454,7 +2454,7 @@ static __poll_t comedi_poll(struct file
 	struct comedi_device *dev = cfp->dev;
 	struct comedi_subdevice *s, *s_read;
 
-	down_read(&dev->attach_lock);
+	down_write(&dev->attach_lock);
 
 	if (!dev->attached) {
 		dev_dbg(dev->class_dev, "no driver attached\n");
@@ -2484,7 +2484,7 @@ static __poll_t comedi_poll(struct file
 	}
 
 done:
-	up_read(&dev->attach_lock);
+	up_write(&dev->attach_lock);
 	return mask;
 }
 
--