syzbot


possible deadlock in evdev_pass_values (2)

Status: upstream: reported on 2023/04/21 09:42
Subsystems: input
[Documentation on labels]
Reported-by: syzbot+13d3cb2a3dc61e6092f5@syzkaller.appspotmail.com
First crash: 856d, last: 4d09h
Discussions (25)
Title Replies (including bot) Last reply
[syzbot] Monthly input report (Aug 2025) 0 (1) 2025/08/14 12:42
[syzbot] Monthly input report (Jul 2025) 0 (1) 2025/07/14 07:23
[syzbot] Monthly input report (Jun 2025) 0 (1) 2025/06/13 12:25
[syzbot] Monthly input report (May 2025) 0 (1) 2025/05/12 13:34
[syzbot] Monthly input report (Apr 2025) 0 (1) 2025/04/09 07:11
[syzbot] Monthly input report (Mar 2025) 0 (1) 2025/03/08 22:15
[syzbot] Monthly input report (Jan 2025) 0 (1) 2025/01/06 10:01
[syzbot] Monthly input report (Dec 2024) 0 (1) 2024/12/05 09:04
[syzbot] Monthly input report (Nov 2024) 0 (1) 2024/11/04 08:58
[syzbot] Monthly input report (Oct 2024) 0 (1) 2024/10/03 09:03
[syzbot] Monthly input report (Sep 2024) 0 (1) 2024/09/02 08:17
[syzbot] Monthly input report (Aug 2024) 0 (1) 2024/08/02 07:26
[syzbot] Monthly input report (Jul 2024) 0 (1) 2024/07/01 10:27
[syzbot] Monthly input report (May 2024) 0 (1) 2024/05/31 06:48
[syzbot] Monthly input report (Apr 2024) 0 (1) 2024/04/29 12:34
[syzbot] Monthly input report (Mar 2024) 0 (1) 2024/03/19 12:48
[syzbot] Monthly input report (Feb 2024) 0 (1) 2024/02/17 20:23
[syzbot] Monthly input report (Jan 2024) 0 (1) 2024/01/17 09:21
[syzbot] Monthly input report (Dec 2023) 0 (1) 2023/12/16 23:58
[syzbot] Monthly input report (Nov 2023) 0 (1) 2023/11/16 04:11
[syzbot] Monthly input report (Oct 2023) 0 (1) 2023/10/16 08:53
[syzbot] Monthly fs report (Aug 2023) 0 (1) 2023/08/08 12:55
[syzbot] Monthly fs report (Jul 2023) 0 (1) 2023/07/10 09:36
[syzbot] Monthly fs report (May 2023) 0 (1) 2023/05/06 14:02
[syzbot] [fs?] possible deadlock in evdev_pass_values (2) 0 (1) 2023/04/21 09:42
Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in evdev_pass_values fuse kernfs 4 351 861d 1683d 0/29 closed as dup on 2021/07/02 09:55
linux-5.15 possible deadlock in evdev_pass_values (3) 4 11 357d 390d 0/3 auto-obsoleted due to no activity on 2024/11/05 23:17
linux-6.1 possible deadlock in evdev_pass_values (3) 4 17 442d 509d 0/3 auto-obsoleted due to no activity on 2024/08/12 15:10
linux-5.15 possible deadlock in evdev_pass_values (4) 4 2 197d 208d 0/3 auto-obsoleted due to no activity on 2025/05/14 14:17
linux-6.1 possible deadlock in evdev_pass_values 4 1 780d 780d 0/3 auto-obsoleted due to no activity on 2023/10/09 19:52
linux-6.6 possible deadlock in evdev_pass_values 4 2 12d 21d 0/2 upstream: reported on 2025/07/29 23:28
linux-5.15 possible deadlock in evdev_pass_values 4 6 658d 761d 0/3 auto-obsoleted due to no activity on 2024/02/09 07:09
linux-6.1 possible deadlock in evdev_pass_values (4) 4 11 7d13h 139d 0/3 upstream: reported on 2025/04/03 09:00
linux-5.15 possible deadlock in evdev_pass_values (2) 4 22 476d 553d 0/3 auto-obsoleted due to no activity on 2024/07/10 03:27
linux-6.1 possible deadlock in evdev_pass_values (2) 4 1 641d 641d 0/3 auto-obsoleted due to no activity on 2024/02/25 22:49

Sample crash report:
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
6.16.0-syzkaller #0 Not tainted
-----------------------------------------------------
syz.0.3046/17563 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
ffffffff8de0c058 (tasklist_lock){.+.+}-{3:3}, at: send_sigio+0x101/0x370 fs/fcntl.c:921

and this task is already holding:
ffff88805890e620 (&f_owner->lock){....}-{3:3}, at: send_sigio+0x38/0x370 fs/fcntl.c:907
which would create a new lock dependency:
 (&f_owner->lock){....}-{3:3} -> (tasklist_lock){.+.+}-{3:3}

but this new dependency connects a SOFTIRQ-irq-safe lock:
 (&client->buffer_lock){..-.}-{3:3}

... which became SOFTIRQ-irq-safe at:
  lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  evdev_pass_values+0xb9/0xbd0 drivers/input/evdev.c:261
  evdev_events+0x1e6/0x340 drivers/input/evdev.c:306
  input_pass_values+0x285/0x890 drivers/input/input.c:127
  input_event_dispose+0x3e5/0x6b0 drivers/input/input.c:352
  input_inject_event+0x1fe/0x320 drivers/input/input.c:423
  led_trigger_event+0x138/0x210 drivers/leds/led-triggers.c:420
  kbd_propagate_led_state drivers/tty/vt/keyboard.c:1073 [inline]
  kbd_bh+0x1c6/0x2e0 drivers/tty/vt/keyboard.c:1262
  tasklet_action_common+0x369/0x580 kernel/softirq.c:829
  handle_softirqs+0x283/0x870 kernel/softirq.c:579
  run_ksoftirqd+0x9b/0x100 kernel/softirq.c:968
  smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:164
  kthread+0x70e/0x8a0 kernel/kthread.c:464
  ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

to a SOFTIRQ-irq-unsafe lock:
 (tasklist_lock){.+.+}-{3:3}

... which became SOFTIRQ-irq-unsafe at:
...
  lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
  __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
  _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
  __do_wait+0xde/0x740 kernel/exit.c:1665
  do_wait+0x1f8/0x520 kernel/exit.c:1709
  kernel_wait+0xab/0x170 kernel/exit.c:1885
  call_usermodehelper_exec_sync kernel/umh.c:136 [inline]
  call_usermodehelper_exec_work+0xbe/0x230 kernel/umh.c:163
  process_one_work kernel/workqueue.c:3238 [inline]
  process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
  kthread+0x70e/0x8a0 kernel/kthread.c:464
  ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

other info that might help us debug this:

Chain exists of:
  &client->buffer_lock --> &f_owner->lock --> tasklist_lock

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(tasklist_lock);
                               local_irq_disable();
                               lock(&client->buffer_lock);
                               lock(&f_owner->lock);
  <Interrupt>
    lock(&client->buffer_lock);

 *** DEADLOCK ***

5 locks held by syz.0.3046/17563:
 #0: ffff888043fa6428 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:557
 #1: ffff888076c057b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:914 [inline]
 #1: ffff888076c057b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_create+0x1f9/0x470 fs/namei.c:4148
 #2: ffffffff99af1e90 (&fsnotify_mark_srcu){.+.?}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
 #2: ffffffff99af1e90 (&fsnotify_mark_srcu){.+.?}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
 #2: ffffffff99af1e90 (&fsnotify_mark_srcu){.+.?}-{0:0}, at: fsnotify+0x735/0x1a80 fs/notify/fsnotify.c:612
 #3: ffff88803363e420 (&mark->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #3: ffff88803363e420 (&mark->lock){+.+.}-{3:3}, at: dnotify_handle_event+0x62/0x440 fs/notify/dnotify/dnotify.c:105
 #4: ffff88805890e620 (&f_owner->lock){....}-{3:3}, at: send_sigio+0x38/0x370 fs/fcntl.c:907

the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
  -> (&client->buffer_lock){..-.}-{3:3} {
     IN-SOFTIRQ-W at:
                        lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                        __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                        _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                        spin_lock include/linux/spinlock.h:351 [inline]
                        evdev_pass_values+0xb9/0xbd0 drivers/input/evdev.c:261
                        evdev_events+0x1e6/0x340 drivers/input/evdev.c:306
                        input_pass_values+0x285/0x890 drivers/input/input.c:127
                        input_event_dispose+0x3e5/0x6b0 drivers/input/input.c:352
                        input_inject_event+0x1fe/0x320 drivers/input/input.c:423
                        led_trigger_event+0x138/0x210 drivers/leds/led-triggers.c:420
                        kbd_propagate_led_state drivers/tty/vt/keyboard.c:1073 [inline]
                        kbd_bh+0x1c6/0x2e0 drivers/tty/vt/keyboard.c:1262
                        tasklet_action_common+0x369/0x580 kernel/softirq.c:829
                        handle_softirqs+0x283/0x870 kernel/softirq.c:579
                        run_ksoftirqd+0x9b/0x100 kernel/softirq.c:968
                        smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:164
                        kthread+0x70e/0x8a0 kernel/kthread.c:464
                        ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
                        ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
     INITIAL USE at:
                       lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
                       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
                       spin_lock include/linux/spinlock.h:351 [inline]
                       evdev_pass_values+0xb9/0xbd0 drivers/input/evdev.c:261
                       evdev_events+0x1e6/0x340 drivers/input/evdev.c:306
                       input_pass_values+0x285/0x890 drivers/input/input.c:127
                       input_event_dispose+0x330/0x6b0 drivers/input/input.c:341
                       input_inject_event+0x1fe/0x320 drivers/input/input.c:423
                       evdev_write+0x2fc/0x480 drivers/input/evdev.c:528
                       vfs_write+0x27e/0xa90 fs/read_write.c:684
                       ksys_write+0x145/0x250 fs/read_write.c:738
                       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
                       do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
                       entry_SYSCALL_64_after_hwframe+0x77/0x7f
   }
   ... key      at: [<ffffffff99dfde00>] evdev_open.__key.25+0x0/0x20
 -> (&new->fa_lock){....}-{3:3} {
    INITIAL USE at:
                     lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                     __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                     _raw_write_lock_irq+0xa2/0xf0 kernel/locking/spinlock.c:326
                     fasync_remove_entry+0xf1/0x1c0 fs/fcntl.c:1001
                     sock_fasync+0x85/0xf0 net/socket.c:1416
                     __fput+0x8a2/0xa70 fs/file_table.c:462
                     task_work_run+0x1d1/0x260 kernel/task_work.c:227
                     resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
                     exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114
                     exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
                     syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
                     syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
                     do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
                     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    INITIAL READ USE at:
                          lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                          __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
                          _raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
                          kill_fasync_rcu fs/fcntl.c:1124 [inline]
                          kill_fasync+0x199/0x4d0 fs/fcntl.c:1148
                          anon_pipe_read+0xf06/0x1040 fs/pipe.c:402
                          new_sync_read fs/read_write.c:491 [inline]
                          vfs_read+0x4d0/0x980 fs/read_write.c:572
                          ksys_read+0x145/0x250 fs/read_write.c:715
                          do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
                          do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
                          entry_SYSCALL_64_after_hwframe+0x77/0x7f
  }
  ... key      at: [<ffffffff99aeef80>] fasync_insert_entry.__key+0x0/0x20
  ... acquired at:
   lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
   __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
   _raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
   kill_fasync_rcu fs/fcntl.c:1124 [inline]
   kill_fasync+0x199/0x4d0 fs/fcntl.c:1148
   __pass_event drivers/input/evdev.c:240 [inline]
   evdev_pass_values+0x627/0xbd0 drivers/input/evdev.c:278
   evdev_events+0x1e6/0x340 drivers/input/evdev.c:306
   input_pass_values+0x285/0x890 drivers/input/input.c:127
   input_event_dispose+0x330/0x6b0 drivers/input/input.c:341
   input_inject_event+0x1fe/0x320 drivers/input/input.c:423
   evdev_write+0x2fc/0x480 drivers/input/evdev.c:528
   vfs_write+0x27e/0xa90 fs/read_write.c:684
   ksys_write+0x145/0x250 fs/read_write.c:738
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> (&f_owner->lock){....}-{3:3} {
   INITIAL USE at:
                   lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                   __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                   _raw_write_lock_irq+0xa2/0xf0 kernel/locking/spinlock.c:326
                   __f_setown+0x67/0x370 fs/fcntl.c:136
                   fcntl_dirnotify+0x3fa/0x6a0 fs/notify/dnotify/dnotify.c:369
                   do_fcntl+0x6d0/0x1910 fs/fcntl.c:539
                   __do_sys_fcntl fs/fcntl.c:591 [inline]
                   __se_sys_fcntl+0xc8/0x150 fs/fcntl.c:576
                   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
                   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
                   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   INITIAL READ USE at:
                        lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                        __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
                        _raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
                        send_sigio+0x38/0x370 fs/fcntl.c:907
                        kill_fasync_rcu fs/fcntl.c:1133 [inline]
                        kill_fasync+0x24d/0x4d0 fs/fcntl.c:1148
                        fsnotify_insert_event+0x32e/0x3e0 fs/notify/notification.c:128
                        fsnotify_add_event include/linux/fsnotify_backend.h:734 [inline]
                        inotify_handle_inode_event+0x3ea/0x5f0 fs/notify/inotify/inotify_fsnotify.c:126
                        inotify_ignored_and_remove_idr+0x29/0x70 fs/notify/inotify/inotify_user.c:526
                        fsnotify_destroy_marks+0x155/0x330 fs/notify/mark.c:952
                        fsnotify_inoderemove include/linux/fsnotify.h:334 [inline]
                        dentry_unlink_inode+0x2c2/0x3f0 fs/dcache.c:462
                        d_delete_notify include/linux/fsnotify.h:400 [inline]
                        vfs_rmdir+0x262/0x520 fs/namei.c:4483
                        do_rmdir+0x2ac/0x630 fs/namei.c:4525
                        __do_sys_rmdir fs/namei.c:4544 [inline]
                        __se_sys_rmdir fs/namei.c:4542 [inline]
                        __x64_sys_rmdir+0x47/0x50 fs/namei.c:4542
                        do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
                        do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
                        entry_SYSCALL_64_after_hwframe+0x77/0x7f
 }
 ... key      at: [<ffffffff99aeef60>] file_f_owner_allocate.__key+0x0/0x20
 ... acquired at:
   lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
   __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
   _raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
   send_sigio+0x38/0x370 fs/fcntl.c:907
   kill_fasync_rcu fs/fcntl.c:1133 [inline]
   kill_fasync+0x24d/0x4d0 fs/fcntl.c:1148
   fsnotify_insert_event+0x32e/0x3e0 fs/notify/notification.c:128
   fsnotify_add_event include/linux/fsnotify_backend.h:734 [inline]
   inotify_handle_inode_event+0x3ea/0x5f0 fs/notify/inotify/inotify_fsnotify.c:126
   inotify_ignored_and_remove_idr+0x29/0x70 fs/notify/inotify/inotify_user.c:526
   fsnotify_destroy_marks+0x155/0x330 fs/notify/mark.c:952
   fsnotify_inoderemove include/linux/fsnotify.h:334 [inline]
   dentry_unlink_inode+0x2c2/0x3f0 fs/dcache.c:462
   d_delete_notify include/linux/fsnotify.h:400 [inline]
   vfs_rmdir+0x262/0x520 fs/namei.c:4483
   do_rmdir+0x2ac/0x630 fs/namei.c:4525
   __do_sys_rmdir fs/namei.c:4544 [inline]
   __se_sys_rmdir fs/namei.c:4542 [inline]
   __x64_sys_rmdir+0x47/0x50 fs/namei.c:4542
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f


the dependencies between the lock to be acquired
 and SOFTIRQ-irq-unsafe lock:
-> (tasklist_lock){.+.+}-{3:3} {
   HARDIRQ-ON-R at:
                    lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                    __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                    _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
                    __do_wait+0xde/0x740 kernel/exit.c:1665
                    do_wait+0x1f8/0x520 kernel/exit.c:1709
                    kernel_wait+0xab/0x170 kernel/exit.c:1885
                    call_usermodehelper_exec_sync kernel/umh.c:136 [inline]
                    call_usermodehelper_exec_work+0xbe/0x230 kernel/umh.c:163
                    process_one_work kernel/workqueue.c:3238 [inline]
                    process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
                    worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
                    kthread+0x70e/0x8a0 kernel/kthread.c:464
                    ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
                    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   SOFTIRQ-ON-R at:
                    lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                    __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                    _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
                    __do_wait+0xde/0x740 kernel/exit.c:1665
                    do_wait+0x1f8/0x520 kernel/exit.c:1709
                    kernel_wait+0xab/0x170 kernel/exit.c:1885
                    call_usermodehelper_exec_sync kernel/umh.c:136 [inline]
                    call_usermodehelper_exec_work+0xbe/0x230 kernel/umh.c:163
                    process_one_work kernel/workqueue.c:3238 [inline]
                    process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
                    worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
                    kthread+0x70e/0x8a0 kernel/kthread.c:464
                    ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
                    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   INITIAL USE at:
                   lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                   __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline]
                   _raw_write_lock_irq+0xa2/0xf0 kernel/locking/spinlock.c:326
                   copy_process+0x21d5/0x3b80 kernel/fork.c:2315
                   kernel_clone+0x224/0x7f0 kernel/fork.c:2599
                   user_mode_thread+0xdd/0x140 kernel/fork.c:2677
                   rest_init+0x23/0x300 init/main.c:710
                   start_kernel+0x47d/0x500 init/main.c:1102
                   x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:307
                   x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:288
                   common_startup_64+0x13e/0x147
   INITIAL READ USE at:
                        lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
                        __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
                        _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
                        __do_wait+0xde/0x740 kernel/exit.c:1665
                        do_wait+0x1f8/0x520 kernel/exit.c:1709
                        kernel_wait+0xab/0x170 kernel/exit.c:1885
                        call_usermodehelper_exec_sync kernel/umh.c:136 [inline]
                        call_usermodehelper_exec_work+0xbe/0x230 kernel/umh.c:163
                        process_one_work kernel/workqueue.c:3238 [inline]
                        process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
                        worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
                        kthread+0x70e/0x8a0 kernel/kthread.c:464
                        ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
                        ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 }
 ... key      at: [<ffffffff8de0c058>] tasklist_lock+0x18/0x40
 ... acquired at:
   lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
   __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
   _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
   send_sigio+0x101/0x370 fs/fcntl.c:921
   dnotify_handle_event+0x169/0x440 fs/notify/dnotify/dnotify.c:113
   fsnotify_handle_event fs/notify/fsnotify.c:376 [inline]
   send_to_group fs/notify/fsnotify.c:424 [inline]
   fsnotify+0x1814/0x1a80 fs/notify/fsnotify.c:641
   fsnotify_name include/linux/fsnotify.h:55 [inline]
   fsnotify_dirent include/linux/fsnotify.h:61 [inline]
   fsnotify_mkdir include/linux/fsnotify.h:429 [inline]
   vfs_mkdir+0x477/0x510 fs/namei.c:4383
   do_mkdirat+0x247/0x590 fs/namei.c:4408
   __do_sys_mkdirat fs/namei.c:4425 [inline]
   __se_sys_mkdirat fs/namei.c:4423 [inline]
   __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4423
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f


stack backtrace:
CPU: 1 UID: 0 PID: 17563 Comm: syz.0.3046 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_bad_irq_dependency kernel/locking/lockdep.c:2619 [inline]
 check_irq_usage kernel/locking/lockdep.c:2860 [inline]
 check_prev_add kernel/locking/lockdep.c:3172 [inline]
 check_prevs_add kernel/locking/lockdep.c:3287 [inline]
 validate_chain+0x1f05/0x2140 kernel/locking/lockdep.c:3911
 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240
 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
 _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
 send_sigio+0x101/0x370 fs/fcntl.c:921
 dnotify_handle_event+0x169/0x440 fs/notify/dnotify/dnotify.c:113
 fsnotify_handle_event fs/notify/fsnotify.c:376 [inline]
 send_to_group fs/notify/fsnotify.c:424 [inline]
 fsnotify+0x1814/0x1a80 fs/notify/fsnotify.c:641
 fsnotify_name include/linux/fsnotify.h:55 [inline]
 fsnotify_dirent include/linux/fsnotify.h:61 [inline]
 fsnotify_mkdir include/linux/fsnotify.h:429 [inline]
 vfs_mkdir+0x477/0x510 fs/namei.c:4383
 do_mkdirat+0x247/0x590 fs/namei.c:4408
 __do_sys_mkdirat fs/namei.c:4425 [inline]
 __se_sys_mkdirat fs/namei.c:4423 [inline]
 __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4423
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa92d18ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa92e057038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fa92d3b5fa0 RCX: 00007fa92d18ebe9
RDX: 0000000000000000 RSI: 0000200000002040 RDI: ffffffffffffff9c
RBP: 00007fa92d211e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa92d3b6038 R14: 00007fa92d3b5fa0 R15: 00007ffd3be9f158
 </TASK>

Crashes (1354):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/16 01:26 upstream 038d61fd6422 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in evdev_pass_values
2025/08/13 16:52 upstream 8742b2d8935f 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/13 01:40 upstream 8742b2d8935f 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/13 01:40 upstream 8742b2d8935f 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/12 23:50 upstream 8742b2d8935f c06e8995 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/12 10:04 upstream 53e760d89498 c06e8995 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/11 22:29 upstream 8f5ae30d69d7 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/11 16:44 upstream 8f5ae30d69d7 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/11 06:11 upstream 8f5ae30d69d7 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/10 11:03 upstream 2b38afce25c4 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/10 09:30 upstream 2b38afce25c4 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/10 09:02 upstream 561c80369df0 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/10 01:04 upstream 561c80369df0 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/09 20:29 upstream 0227b49b5027 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/09 06:39 upstream 0227b49b5027 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/09 00:45 upstream 37816488247d 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/08 13:37 upstream 37816488247d 987b750d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/08 07:41 upstream bec077162bd0 6a893178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in evdev_pass_values
2025/08/08 05:43 upstream bec077162bd0 6a893178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/08 00:10 upstream 6e64f4580381 6a893178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/07 11:18 upstream 6e64f4580381 04cffc22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/07 07:06 upstream 6e64f4580381 4bd24a3e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/08/07 03:53 upstream cca7a0aae895 4bd24a3e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/06 19:26 upstream 479058002c32 4bd24a3e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/07/28 17:44 upstream 038d61fd6422 c4a95487 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in evdev_pass_values
2025/07/28 10:44 upstream 038d61fd6422 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in evdev_pass_values
2025/07/27 15:47 upstream ec2df4364666 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/07/25 22:05 upstream 327579671a9b fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in evdev_pass_values
2025/07/25 07:21 upstream 2942242dde89 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/07/24 16:09 upstream 25fae0b93d1d fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/07/24 12:24 upstream 25fae0b93d1d 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/07/24 05:00 upstream 01a412d06bc5 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/07/24 02:27 upstream 01a412d06bc5 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in evdev_pass_values
2025/07/23 19:48 upstream 01a412d06bc5 e1dd4f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in evdev_pass_values
2025/07/23 05:20 upstream 89be9a83ccf1 e1dd4f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in evdev_pass_values
2025/08/13 18:51 upstream 91325f31afc1 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/08/13 12:14 upstream 8742b2d8935f 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/08/10 19:18 upstream 8f5ae30d69d7 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/08/10 16:19 upstream 561c80369df0 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/08/10 05:27 upstream 561c80369df0 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/08/09 23:12 upstream c30a13538d9f 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/08/04 05:50 upstream 352af6a011d5 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/30 23:00 upstream e8d780dcd957 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/30 08:27 upstream 4b290aae788e f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/28 01:45 upstream 038d61fd6422 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/28 01:42 upstream 038d61fd6422 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/26 22:58 upstream 302f88ff3584 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/25 14:07 upstream 2942242dde89 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/25 06:14 upstream 2942242dde89 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/23 21:39 upstream 01a412d06bc5 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2025/07/23 03:52 upstream 89be9a83ccf1 85deaf45 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 possible deadlock in evdev_pass_values
2024/08/16 14:52 upstream d7a5aa4b3c00 e1c76ab2 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in evdev_pass_values
2025/07/14 17:11 upstream 347e9f5043c8 d8fc7335 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 possible deadlock in evdev_pass_values
2023/04/19 19:50 upstream 789b4a41c247 a219f34e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2023/04/16 17:07 upstream 3e7bb4f24617 ec410564 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce possible deadlock in evdev_pass_values
2025/08/12 13:00 linux-next 2674d1eadaa2 c06e8995 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in evdev_pass_values
2025/08/09 16:19 linux-next b1549501188c 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in evdev_pass_values
* Struck through repros no longer work on HEAD.