program: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x52}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x72, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000000c0)={0x50, 0x52, 0x0, {0x4, 0xe}, {0xb, 0x7}, @rumble={0x3, 0x6a}}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000300)={0x50, 0xffff, 0x0, {0x0, 0x68bd}, {}, @cond=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000100)={0x57, 0x74, 0x3, {0x0, 0x4}, {0x8, 0x7ff}, @period={0x58, 0x9, 0x9, 0x0, 0x100, {0x4, 0x2, 0x7ff, 0x3}, 0x4, &(0x7f0000000040)=[0x9, 0x95, 0xfff, 0xb]}}) ioctl$UI_DEV_CREATE(r0, 0x5501) [ 75.005064][ T5311] Bluetooth: hci0: command tx timeout [ 75.072523][ T5326] input: syz0 as /devices/virtual/input/input5 [ 75.093226][ T5326] [ 75.094298][ T5326] ====================================================== [ 75.097087][ T5326] WARNING: possible circular locking dependency detected [ 75.099827][ T5326] 6.15.0-rc1-syzkaller-00288-ge618ee89561b #0 Not tainted [ 75.102463][ T5326] ------------------------------------------------------ [ 75.105111][ T5326] syz.0.0/5326 is trying to acquire lock: [ 75.107287][ T5326] ffff888012985870 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_submit+0x188/0x750 [ 75.111386][ T5326] [ 75.111386][ T5326] but task is already holding lock: [ 75.114243][ T5326] ffff888034f158b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x3f3/0xb30 [ 75.117666][ T5326] [ 75.117666][ T5326] which lock already depends on the new lock. [ 75.117666][ T5326] [ 75.121655][ T5326] [ 75.121655][ T5326] the existing dependency chain (in reverse order) is: [ 75.125113][ T5326] [ 75.125113][ T5326] -> #3 (&ff->mutex){+.+.}-{4:4}: [ 75.128016][ T5326] lock_acquire+0x116/0x2f0 [ 75.130306][ T5326] __mutex_lock+0x1a5/0x10c0 [ 75.132474][ T5326] input_ff_flush+0x5e/0x150 [ 75.134517][ T5326] input_flush_device+0xb2/0xe0 [ 75.136699][ T5326] evdev_release+0xf6/0x7d0 [ 75.138859][ T5326] __fput+0x3e9/0x9f0 [ 75.140671][ T5326] fput_close_sync+0x1ef/0x270 [ 75.142652][ T5326] __x64_sys_close+0x7f/0x110 [ 75.144594][ T5326] do_syscall_64+0xf3/0x230 [ 75.146605][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.149421][ T5326] [ 75.149421][ T5326] -> #2 (&dev->mutex#2){+.+.}-{4:4}: [ 75.152277][ T5326] lock_acquire+0x116/0x2f0 [ 75.154244][ T5326] __mutex_lock+0x1a5/0x10c0 [ 75.156310][ T5326] input_register_handle+0x1a5/0x500 [ 75.158738][ T5326] kbd_connect+0xbf/0x130 [ 75.160622][ T5326] input_register_device+0xce2/0x10c0 [ 75.162818][ T5326] acpi_button_add+0x6c6/0xb90 [ 75.164790][ T5326] acpi_device_probe+0xa5/0x2b0 [ 75.167077][ T5326] really_probe+0x2b9/0xad0 [ 75.169339][ T5326] __driver_probe_device+0x1a2/0x390 [ 75.171739][ T5326] driver_probe_device+0x50/0x430 [ 75.173954][ T5326] __driver_attach+0x45f/0x710 [ 75.176058][ T5326] bus_for_each_dev+0x23e/0x2b0 [ 75.178134][ T5326] bus_add_driver+0x346/0x670 [ 75.180138][ T5326] driver_register+0x23a/0x320 [ 75.182138][ T5326] do_one_initcall+0x24a/0x940 [ 75.184153][ T5326] do_initcall_level+0x157/0x210 [ 75.186180][ T5326] do_initcalls+0x71/0xd0 [ 75.188265][ T5326] kernel_init_freeable+0x432/0x5d0 [ 75.190518][ T5326] kernel_init+0x1d/0x2b0 [ 75.192454][ T5326] ret_from_fork+0x4b/0x80 [ 75.194325][ T5326] ret_from_fork_asm+0x1a/0x30 [ 75.196303][ T5326] [ 75.196303][ T5326] -> #1 (input_mutex){+.+.}-{4:4}: [ 75.199290][ T5326] lock_acquire+0x116/0x2f0 [ 75.201179][ T5326] __mutex_lock+0x1a5/0x10c0 [ 75.203099][ T5326] input_register_device+0xa8f/0x10c0 [ 75.205299][ T5326] uinput_create_device+0x40e/0x630 [ 75.207502][ T5326] uinput_ioctl_handler+0x496/0x17f0 [ 75.209727][ T5326] __se_sys_ioctl+0xf1/0x160 [ 75.211641][ T5326] do_syscall_64+0xf3/0x230 [ 75.213598][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.216108][ T5326] [ 75.216108][ T5326] -> #0 (&newdev->mutex){+.+.}-{4:4}: [ 75.219139][ T5326] validate_chain+0xa69/0x24e0 [ 75.221211][ T5326] __lock_acquire+0xad5/0xd80 [ 75.223232][ T5326] lock_acquire+0x116/0x2f0 [ 75.225245][ T5326] __mutex_lock+0x1a5/0x10c0 [ 75.227294][ T5326] uinput_request_submit+0x188/0x750 [ 75.229590][ T5326] uinput_dev_upload_effect+0x19b/0x240 [ 75.232021][ T5326] input_ff_upload+0x5fb/0xb30 [ 75.234028][ T5326] evdev_ioctl_handler+0x17f2/0x2240 [ 75.236296][ T5326] __se_sys_ioctl+0xf1/0x160 [ 75.238435][ T5326] do_syscall_64+0xf3/0x230 [ 75.240254][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.242805][ T5326] [ 75.242805][ T5326] other info that might help us debug this: [ 75.242805][ T5326] [ 75.247031][ T5326] Chain exists of: [ 75.247031][ T5326] &newdev->mutex --> &dev->mutex#2 --> &ff->mutex [ 75.247031][ T5326] [ 75.251768][ T5326] Possible unsafe locking scenario: [ 75.251768][ T5326] [ 75.254476][ T5326] CPU0 CPU1 [ 75.256506][ T5326] ---- ---- [ 75.258718][ T5326] lock(&ff->mutex); [ 75.260229][ T5326] lock(&dev->mutex#2); [ 75.262820][ T5326] lock(&ff->mutex); [ 75.265365][ T5326] lock(&newdev->mutex); [ 75.267099][ T5326] [ 75.267099][ T5326] *** DEADLOCK *** [ 75.267099][ T5326] [ 75.270309][ T5326] 2 locks held by syz.0.0/5326: [ 75.272208][ T5326] #0: ffff88804409a118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl_handler+0x124/0x2240 [ 75.275953][ T5326] #1: ffff888034f158b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x3f3/0xb30 [ 75.279481][ T5326] [ 75.279481][ T5326] stack backtrace: [ 75.281804][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted 6.15.0-rc1-syzkaller-00288-ge618ee89561b #0 PREEMPT(full) [ 75.281821][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.281829][ T5326] Call Trace: [ 75.281837][ T5326] [ 75.281843][ T5326] dump_stack_lvl+0x241/0x360 [ 75.281873][ T5326] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.281890][ T5326] ? __pfx__printk+0x10/0x10 [ 75.281905][ T5326] ? print_lock+0x171/0x1a0 [ 75.281919][ T5326] print_circular_bug+0x2e1/0x300 [ 75.281934][ T5326] check_noncircular+0x142/0x160 [ 75.281950][ T5326] validate_chain+0xa69/0x24e0 [ 75.281966][ T5326] ? __pfx_hlock_conflict+0x10/0x10 [ 75.281983][ T5326] __lock_acquire+0xad5/0xd80 [ 75.281996][ T5326] lock_acquire+0x116/0x2f0 [ 75.282007][ T5326] ? uinput_request_submit+0x188/0x750 [ 75.282025][ T5326] __mutex_lock+0x1a5/0x10c0 [ 75.282040][ T5326] ? uinput_request_submit+0x188/0x750 [ 75.282055][ T5326] ? __lock_acquire+0xad5/0xd80 [ 75.282067][ T5326] ? uinput_request_submit+0x188/0x750 [ 75.282081][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 75.282097][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 75.282108][ T5326] ? uinput_request_alloc_id+0x3c8/0x3f0 [ 75.282123][ T5326] uinput_request_submit+0x188/0x750 [ 75.282139][ T5326] ? __pfx_uinput_request_submit+0x10/0x10 [ 75.282154][ T5326] ? rcu_is_watching+0x15/0xb0 [ 75.282167][ T5326] ? trace_contention_end+0x3c/0x120 [ 75.282182][ T5326] ? __mutex_lock+0x380/0x10c0 [ 75.282197][ T5326] uinput_dev_upload_effect+0x19b/0x240 [ 75.282212][ T5326] ? __pfx_uinput_dev_upload_effect+0x10/0x10 [ 75.282233][ T5326] input_ff_upload+0x5fb/0xb30 [ 75.282249][ T5326] evdev_ioctl_handler+0x17f2/0x2240 [ 75.282264][ T5326] ? __pfx_evdev_ioctl_handler+0x10/0x10 [ 75.282280][ T5326] ? __lock_acquire+0xad5/0xd80 [ 75.282295][ T5326] ? __fget_files+0x2a/0x420 [ 75.282305][ T5326] ? __fget_files+0x2a/0x420 [ 75.282316][ T5326] ? __fget_files+0x2a/0x420 [ 75.282326][ T5326] ? __pfx_evdev_ioctl+0x10/0x10 [ 75.282337][ T5326] __se_sys_ioctl+0xf1/0x160 [ 75.282350][ T5326] do_syscall_64+0xf3/0x230 [ 75.282365][ T5326] ? clear_bhb_loop+0x45/0xa0 [ 75.282378][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.282390][ T5326] RIP: 0033:0x7ff97bb8d169 [ 75.282403][ T5326] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.282413][ T5326] RSP: 002b:00007ff97c95b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 75.282426][ T5326] RAX: ffffffffffffffda RBX: 00007ff97bda5fa0 RCX: 00007ff97bb8d169 [ 75.282435][ T5326] RDX: 0000200000000300 RSI: 0000000040304580 RDI: 0000000000000005 [ 75.282443][ T5326] RBP: 00007ff97bc0e990 R08: 0000000000000000 R09: 0000000000000000 [ 75.282449][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.282456][ T5326] R13: 0000000000000000 R14: 00007ff97bda5fa0 R15: 00007ffd51aa53c8 [ 75.282467][ T5326] [ 75.469714][ T5328] uinput: write device info first [ 76.365366][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.367902][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 77.083973][ T5311] Bluetooth: hci0: command tx timeout [ 79.164417][ T5311] Bluetooth: hci0: command tx timeout [ 81.243839][ T5311] Bluetooth: hci0: command tx timeout