Warning: Permanently added '10.128.0.3' (ED25519) to the list of known hosts. [ 44.806504][ T4025] input: syz1 as /devices/virtual/input/input2 executing program executing program executing program executing program [ 44.816003][ T4031] input: syz1 as /devices/virtual/input/input3 [ 44.819328][ T4029] input: syz1 as /devices/virtual/input/input4 [ 44.820360][ T4032] input: syz1 as /devices/virtual/input/input5 executing program [ 44.834307][ T4033] input: syz1 as /devices/virtual/input/input6 executing program [ 44.856464][ T4037] input: syz1 as /devices/virtual/input/input7 executing program [ 44.918354][ T4038] input: syz1 as /devices/virtual/input/input8 [ 44.960715][ T4037] [ 44.961370][ T4037] ====================================================== [ 44.963336][ T4037] WARNING: possible circular locking dependency detected [ 44.965152][ T4037] 5.15.183-syzkaller #0 Not tainted [ 44.966567][ T4037] ------------------------------------------------------ [ 44.968503][ T4037] syz-executor216/4037 is trying to acquire lock: [ 44.970348][ T4037] ffff0000de099070 (&newdev->mutex){+.+.}-{3:3}, at: uinput_request_submit+0x180/0x618 [ 44.973195][ T4037] [ 44.973195][ T4037] but task is already holding lock: [ 44.975170][ T4037] ffff0000de0998b0 (&ff->mutex){+.+.}-{3:3}, at: input_ff_upload+0x2d4/0x78c [ 44.977620][ T4037] [ 44.977620][ T4037] which lock already depends on the new lock. [ 44.977620][ T4037] [ 44.980426][ T4037] [ 44.980426][ T4037] the existing dependency chain (in reverse order) is: [ 44.982889][ T4037] [ 44.982889][ T4037] -> #3 (&ff->mutex){+.+.}-{3:3}: [ 44.984843][ T4037] __mutex_lock_common+0x194/0x1edc [ 44.986383][ T4037] mutex_lock_nested+0xac/0x11c [ 44.987943][ T4037] input_ff_flush+0x60/0x14c [ 44.989354][ T4037] uinput_dev_flush+0x30/0x4c [ 44.990848][ T4037] input_flush_device+0x9c/0xc8 [ 44.992449][ T4037] evdev_release+0xc8/0x608 [ 44.993867][ T4037] __fput+0x1c0/0x7f8 [ 44.995134][ T4037] ____fput+0x20/0x30 [ 44.996352][ T4037] task_work_run+0x12c/0x1e0 [ 44.997732][ T4037] do_notify_resume+0x24b4/0x3128 [ 44.999300][ T4037] el0_svc+0xf0/0x1e0 [ 45.000527][ T4037] el0t_64_sync_handler+0xcc/0xe4 [ 45.002062][ T4037] el0t_64_sync+0x1a0/0x1a4 [ 45.003422][ T4037] [ 45.003422][ T4037] -> #2 (&dev->mutex#2){+.+.}-{3:3}: [ 45.005498][ T4037] __mutex_lock_common+0x194/0x1edc [ 45.007103][ T4037] mutex_lock_interruptible_nested+0xac/0x11c [ 45.008972][ T4037] input_register_handle+0x74/0x2ec [ 45.010548][ T4037] kbd_connect+0xbc/0x134 [ 45.011878][ T4037] input_register_device+0xae0/0xe34 [ 45.013461][ T4037] acpi_button_add+0x554/0x8a0 [ 45.014986][ T4037] acpi_device_probe+0xa8/0x2bc [ 45.016462][ T4037] really_probe+0x26c/0xaec [ 45.017785][ T4037] __driver_probe_device+0x180/0x314 [ 45.019343][ T4037] driver_probe_device+0x78/0x34c [ 45.020865][ T4037] __driver_attach+0x3cc/0x5c0 [ 45.022305][ T4037] bus_for_each_dev+0x144/0x1c4 [ 45.023726][ T4037] driver_attach+0x4c/0x5c [ 45.025098][ T4037] bus_add_driver+0x2d8/0x558 [ 45.026482][ T4037] driver_register+0x200/0x374 [ 45.027908][ T4037] acpi_bus_register_driver+0xd8/0x114 [ 45.029487][ T4037] acpi_button_driver_init+0xd0/0x10c [ 45.031100][ T4037] do_one_initcall+0x228/0x8b0 [ 45.032529][ T4037] do_initcall_level+0x154/0x214 [ 45.033978][ T4037] do_initcalls+0x58/0xac [ 45.035330][ T4037] do_basic_setup+0x8c/0xa0 [ 45.036699][ T4037] kernel_init_freeable+0x404/0x5fc [ 45.038247][ T4037] kernel_init+0x24/0x1d0 [ 45.039614][ T4037] ret_from_fork+0x10/0x20 [ 45.040933][ T4037] [ 45.040933][ T4037] -> #1 (input_mutex){+.+.}-{3:3}: [ 45.042940][ T4037] __mutex_lock_common+0x194/0x1edc [ 45.044468][ T4037] mutex_lock_interruptible_nested+0xac/0x11c [ 45.046253][ T4037] input_register_device+0x900/0xe34 [ 45.047857][ T4037] uinput_create_device+0x350/0x518 [ 45.049399][ T4037] uinput_ioctl_handler+0x3c4/0x10bc [ 45.051002][ T4037] uinput_ioctl+0x38/0x4c [ 45.052285][ T4037] __arm64_sys_ioctl+0x14c/0x1c8 [ 45.053833][ T4037] invoke_syscall+0x98/0x2b8 [ 45.055256][ T4037] el0_svc_common+0x138/0x258 [ 45.056625][ T4037] do_el0_svc+0x58/0x14c [ 45.057967][ T4037] el0_svc+0x78/0x1e0 [ 45.059191][ T4037] el0t_64_sync_handler+0xcc/0xe4 [ 45.060664][ T4037] el0t_64_sync+0x1a0/0x1a4 [ 45.062067][ T4037] [ 45.062067][ T4037] -> #0 (&newdev->mutex){+.+.}-{3:3}: [ 45.064172][ T4037] __lock_acquire+0x2928/0x651c [ 45.065608][ T4037] lock_acquire+0x1f4/0x620 [ 45.067010][ T4037] __mutex_lock_common+0x194/0x1edc [ 45.068579][ T4037] mutex_lock_interruptible_nested+0xac/0x11c [ 45.070333][ T4037] uinput_request_submit+0x180/0x618 [ 45.071922][ T4037] uinput_dev_upload_effect+0x130/0x1c0 [ 45.073599][ T4037] input_ff_upload+0x454/0x78c [ 45.075050][ T4037] evdev_ioctl_handler+0x1fec/0x2be0 [ 45.076660][ T4037] evdev_ioctl+0x38/0x4c [ 45.077982][ T4037] __arm64_sys_ioctl+0x14c/0x1c8 [ 45.079519][ T4037] invoke_syscall+0x98/0x2b8 [ 45.080918][ T4037] el0_svc_common+0x138/0x258 [ 45.082336][ T4037] do_el0_svc+0x58/0x14c [ 45.083606][ T4037] el0_svc+0x78/0x1e0 [ 45.084836][ T4037] el0t_64_sync_handler+0xcc/0xe4 [ 45.086411][ T4037] el0t_64_sync+0x1a0/0x1a4 [ 45.087788][ T4037] [ 45.087788][ T4037] other info that might help us debug this: [ 45.087788][ T4037] [ 45.090630][ T4037] Chain exists of: [ 45.090630][ T4037] &newdev->mutex --> &dev->mutex#2 --> &ff->mutex [ 45.090630][ T4037] [ 45.093994][ T4037] Possible unsafe locking scenario: [ 45.093994][ T4037] [ 45.096005][ T4037] CPU0 CPU1 [ 45.097448][ T4037] ---- ---- [ 45.098959][ T4037] lock(&ff->mutex); [ 45.100061][ T4037] lock(&dev->mutex#2); [ 45.101881][ T4037] lock(&ff->mutex); [ 45.103649][ T4037] lock(&newdev->mutex); [ 45.104832][ T4037] [ 45.104832][ T4037] *** DEADLOCK *** [ 45.104832][ T4037] [ 45.107027][ T4037] 2 locks held by syz-executor216/4037: [ 45.108459][ T4037] #0: ffff0000c2168110 (&evdev->mutex){+.+.}-{3:3}, at: evdev_ioctl_handler+0x114/0x2be0 [ 45.111217][ T4037] #1: ffff0000de0998b0 (&ff->mutex){+.+.}-{3:3}, at: input_ff_upload+0x2d4/0x78c [ 45.113756][ T4037] [ 45.113756][ T4037] stack backtrace: [ 45.115353][ T4037] CPU: 1 PID: 4037 Comm: syz-executor216 Not tainted 5.15.183-syzkaller #0 [ 45.117694][ T4037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 45.120415][ T4037] Call trace: [ 45.121288][ T4037] dump_backtrace+0x0/0x43c [ 45.122497][ T4037] show_stack+0x2c/0x3c [ 45.123622][ T4037] __dump_stack+0x30/0x40 [ 45.124798][ T4037] dump_stack_lvl+0xf8/0x160 [ 45.126024][ T4037] dump_stack+0x1c/0x5c [ 45.127136][ T4037] print_circular_bug+0x148/0x1b0 [ 45.128481][ T4037] check_noncircular+0x240/0x2d4 [ 45.129819][ T4037] __lock_acquire+0x2928/0x651c [ 45.131105][ T4037] lock_acquire+0x1f4/0x620 [ 45.132274][ T4037] __mutex_lock_common+0x194/0x1edc [ 45.133693][ T4037] mutex_lock_interruptible_nested+0xac/0x11c [ 45.135343][ T4037] uinput_request_submit+0x180/0x618 [ 45.136793][ T4037] uinput_dev_upload_effect+0x130/0x1c0 [ 45.138257][ T4037] input_ff_upload+0x454/0x78c [ 45.139522][ T4037] evdev_ioctl_handler+0x1fec/0x2be0 [ 45.140915][ T4037] evdev_ioctl+0x38/0x4c [ 45.142055][ T4037] __arm64_sys_ioctl+0x14c/0x1c8 [ 45.143384][ T4037] invoke_syscall+0x98/0x2b8 [ 45.144587][ T4037] el0_svc_common+0x138/0x258 [ 45.145843][ T4037] do_el0_svc+0x58/0x14c [ 45.146989][ T4037] el0_svc+0x78/0x1e0 [ 45.148052][ T4037] el0t_64_sync_handler+0xcc/0xe4 [ 45.149396][ T4037] el0t_64_sync+0x1a0/0x1a4 executing program [ 45.153206][ T4039] input: syz1 as /devices/virtual/input/input9 executing program [ 45.206398][ T4041] input: syz1 as /devices/virtual/input/input10 executing program [ 49.898469][ T4045] input: syz1 as /devices/virtual/input/input11 executing program [ 49.979235][ T4046] input: syz1 as /devices/virtual/input/input12 executing program [ 50.239098][ T4047] input: syz1 as /devices/virtual/input/input13 executing program [ 50.298568][ T4048] input: syz1 as /devices/virtual/input/input14