inconsistent lock state in ccp_raw_event

Status: upstream: reported on 2026/10/05 22:33
Reported-by: syzbot+d24b650f23e510873d95@syzkaller.appspotmail.com
First crash: 3d02h, last: 2d16h
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream inconsistent lock state in ccp_raw_event prio:low hwmon 4 C 49 9m 6h23m 0/29 upstream: reported C repro on 2026/10/08 18:15
linux-5.15 inconsistent lock state in ccp_raw_event 4 2 2d20h 2d20h 0/3 upstream: reported on 2026/10/06 03:53

Sample crash report:
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/0/0 [HC0[0]:SC1[1]:HE0:SE0] takes:
ffff88807c6d4c50 (&ccp->wait_input_report_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88807c6d4c50 (&ccp->wait_input_report_lock){+.?.}-{2:2}, at: ccp_raw_event+0x4d/0x110 drivers/hwmon/corsair-cpro.c:154
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  ccp_raw_event+0x4d/0x110 drivers/hwmon/corsair-cpro.c:154
  hid_input_report+0x3fe/0x4f0 drivers/hid/hid-core.c:2129
  uhid_dev_input2+0xb1/0x130 drivers/hid/uhid.c:611
  uhid_char_write+0x376/0xaf0 drivers/hid/uhid.c:769
  vfs_write+0x2dc/0x9a0 fs/read_write.c:582
  ksys_write+0x14d/0x260 fs/read_write.c:637
  do_syscall_x64 arch/x86/entry/common.c:46 [inline]
  do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
  entry_SYSCALL_64_after_hwframe+0x68/0xd2
irq event stamp: 1641885
hardirqs last  enabled at (1641884): [<ffffffff8a3dd682>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (1641884): [<ffffffff8a3dd682>] _raw_spin_unlock_irqrestore+0x82/0x120 kernel/locking/spinlock.c:194
hardirqs last disabled at (1641885): [<ffffffff8a3dd40b>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1641885): [<ffffffff8a3dd40b>] _raw_spin_lock_irqsave+0x8b/0x100 kernel/locking/spinlock.c:162
softirqs last  enabled at (1641872): [<ffffffff814f4aab>] __do_softirq kernel/softirq.c:630 [inline]
softirqs last  enabled at (1641872): [<ffffffff814f4aab>] invoke_softirq kernel/softirq.c:470 [inline]
softirqs last  enabled at (1641872): [<ffffffff814f4aab>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
softirqs last disabled at (1641879): [<ffffffff814f4aab>] __do_softirq kernel/softirq.c:630 [inline]
softirqs last disabled at (1641879): [<ffffffff814f4aab>] invoke_softirq kernel/softirq.c:470 [inline]
softirqs last disabled at (1641879): [<ffffffff814f4aab>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&ccp->wait_input_report_lock);
  <Interrupt>
    lock(&ccp->wait_input_report_lock);

 *** DEADLOCK ***

no locks held by swapper/0/0.

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:4041
 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4244
 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4706
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0xdf3/0x7ea0 kernel/locking/lockdep.c:5125
 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 ccp_raw_event+0x4d/0x110 drivers/hwmon/corsair-cpro.c:154
 hid_input_report+0x3fe/0x4f0 drivers/hid/hid-core.c:2129
 hid_irq_in+0x434/0x690 drivers/hid/usbhid/hid-core.c:284
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1675
 dummy_timer+0xa39/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2018
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:742
Code: 48 89 df e8 27 eb 95 f7 e9 44 ff ff ff e8 dd 02 f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 66 90 0f 00 2d e7 f1 48 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffffff8c807da8 EFLAGS: 000002c2
RAX: d0f231c65020ba00 RBX: ffffffff8a3dbae7 RCX: d0f231c65020ba00
RDX: 0000000000000001 RSI: ffffffff8a8c18a0 RDI: ffffffff8adf6de0
RBP: ffffffff8c807ec8 R08: ffff8880b8e357cb R09: 1ffff110171c6af9
R10: dffffc0000000000 R11: ffffed10171c6afa R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff8c8bc740 R15: 1ffffffff1900fc0
 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3a2/0x680 kernel/sched/idle.c:323
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 rest_init+0x2dc/0x300 init/main.c:706
 arch_call_rest_init+0xa/0xa init/main.c:865
 start_kernel+0x480/0x50d init/main.c:1113
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
usb 1-1: input irq status -75 received
----------------
Code disassembly (best guess):
   0:	48 89 df             	mov    %rbx,%rdi
   3:	e8 27 eb 95 f7       	call   0xf795eb2f
   8:	e9 44 ff ff ff       	jmp    0xffffff51
   d:	e8 dd 02 f6 ff       	call   0xfff602ef
  12:	00 00                	add    %al,(%rax)
  14:	cc                   	int3
  15:	cc                   	int3
  16:	00 00                	add    %al,(%rax)
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	00 00                	add    %al,(%rax)
  1c:	cc                   	int3
  1d:	cc                   	int3
  1e:	00 66 90             	add    %ah,-0x70(%rsi)
  21:	0f 00 2d e7 f1 48 00 	verw   0x48f1e7(%rip)        # 0x48f20f
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	0f 1f 40 00          	nopl   0x0(%rax)
  2f:	41 57                	push   %r15
  31:	41 56                	push   %r14
  33:	53                   	push   %rbx
  34:	49 be 00 00 00 00 00 	movabs $0xdffffc0000000000,%r14
  3b:	fc ff df
  3e:	65                   	gs
  3f:	48                   	rex.W

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/05 22:37 linux-6.1.y a500ba24937a af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan inconsistent lock state in ccp_raw_event
2026/10/05 22:34 linux-6.1.y a500ba24937a af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan inconsistent lock state in ccp_raw_event
2026/10/05 22:32 linux-6.1.y a500ba24937a af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan inconsistent lock state in ccp_raw_event
2026/10/05 22:32 linux-6.1.y a500ba24937a af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan inconsistent lock state in ccp_raw_event
2026/10/06 08:19 linux-6.1.y a500ba24937a f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in ccp_raw_event
* Struck through repros no longer work on HEAD.