Extracting prog: 1m24.049667971s Minimizing prog: 12m40.275054244s Simplifying prog options: 0s Extracting C: 27.199766235s Simplifying C: 4m35.172129589s 1 programs, timeouts [15s 6m0s] extracting reproducer from 1 programs single: executing 1 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program crashed: possible deadlock in input_event single: successfully extracted reproducer found reproducer with 10 syscalls minimizing guilty program testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r1 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x5452, &(0x7f0000000000)=""/113) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(0xffffffffffffffff, 0x8, 0xffffffffffffffff) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r1 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x2200c851, 0x0, 0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, 0x0, 0x0, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(0x0, 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, 0x0) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2ad8) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, 0x0, 0x0) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) fcntl$setown(r0, 0x8, 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000001080)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x74, 0x2}, @ramp}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r2 = syz_open_dev$evdev(&(0x7f00000013c0), 0x0, 0x0) ioctl$EVIOCGVERSION(r2, 0x5452, &(0x7f0000000000)=""/113) write$char_usb(r1, &(0x7f0000000040), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event simplifying C reproducer testing compiled C program (duration=22.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program did not crash testing compiled C program (duration=22.5s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event testing compiled C program (duration=22.5s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event testing compiled C program (duration=22.5s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event testing compiled C program (duration=22.5s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event testing compiled C program (duration=22.5s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event testing compiled C program (duration=22.5s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-sendto$inet6-fcntl$setown-sendto$inet6-ioctl$EVIOCSFF-syz_open_dev$evdev-syz_open_dev$evdev-ioctl$EVIOCGVERSION-write$char_usb program crashed: possible deadlock in input_event reproducing took 19m6.696627857s repro crashed as (corrupted=false): ===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.10.0-syzkaller-12562-g1722389b0d86 #0 Not tainted ----------------------------------------------------- syz-executor204/5336 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffff888028bc7318 (&f->f_owner.lock){...-}-{2:2}, at: send_sigio+0x28/0x3c0 fs/fcntl.c:816 and this task is already holding: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync_rcu fs/fcntl.c:1028 [inline] ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync fs/fcntl.c:1049 [inline] ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 which would create a new lock dependency: (&new->fa_lock){....}-{2:2} -> (&f->f_owner.lock){...-}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&dev->event_lock#2){-...}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_event drivers/input/input.c:397 [inline] input_event+0x70/0xa0 drivers/input/input.c:390 input_report_key include/linux/input.h:426 [inline] psmouse_report_standard_buttons+0x30/0x80 drivers/input/mouse/psmouse-base.c:128 psmouse_report_standard_packet drivers/input/mouse/psmouse-base.c:146 [inline] psmouse_process_byte+0x39c/0x8a0 drivers/input/mouse/psmouse-base.c:237 psmouse_handle_byte+0x44/0x570 drivers/input/mouse/psmouse-base.c:279 psmouse_receive_byte+0x243/0xe20 drivers/input/mouse/psmouse-base.c:426 ps2_interrupt+0x20b/0x5b0 drivers/input/serio/libps2.c:613 serio_interrupt+0x8f/0x150 drivers/input/serio/serio.c:998 i8042_interrupt+0x3f5/0x8a0 drivers/input/serio/i8042.c:606 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:247 [inline] call_irq_handler arch/x86/kernel/irq.c:259 [inline] __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] default_idle+0xf/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:185 [inline] do_idle+0x32c/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 start_secondary+0x220/0x2b0 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x148 to a HARDIRQ-irq-unsafe lock: (tasklist_lock){.+.?}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Chain exists of: &dev->event_lock#2 --> &new->fa_lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock#2); lock(&new->fa_lock); lock(&dev->event_lock#2); *** DEADLOCK *** 8 locks held by syz-executor204/5336: #0: ffff88802601a110 (&evdev->mutex){+.+.}-{3:3}, at: evdev_write+0x1ff/0x750 drivers/input/evdev.c:504 #1: ffff88801cfde230 (&dev->event_lock#2){-...}-{2:2}, at: input_inject_event+0xa4/0x370 drivers/input/input.c:423 #2: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #2: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: input_inject_event+0xca/0x370 drivers/input/input.c:425 #3: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #3: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: input_pass_values+0x8b/0x8e0 drivers/input/input.c:118 #4: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #4: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #4: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: evdev_events+0x86/0x390 drivers/input/evdev.c:298 #5: ffff88801acdf028 (&client->buffer_lock){....}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #5: ffff88801acdf028 (&client->buffer_lock){....}-{2:2}, at: evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: kill_fasync fs/fcntl.c:1048 [inline] #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: kill_fasync+0x6d/0x4f0 fs/fcntl.c:1042 #7: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync_rcu fs/fcntl.c:1028 [inline] #7: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync fs/fcntl.c:1049 [inline] #7: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&dev->event_lock#2){-...}-{2:2} { IN-HARDIRQ-W at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_event drivers/input/input.c:397 [inline] input_event+0x70/0xa0 drivers/input/input.c:390 input_report_key include/linux/input.h:426 [inline] psmouse_report_standard_buttons+0x30/0x80 drivers/input/mouse/psmouse-base.c:128 psmouse_report_standard_packet drivers/input/mouse/psmouse-base.c:146 [inline] psmouse_process_byte+0x39c/0x8a0 drivers/input/mouse/psmouse-base.c:237 psmouse_handle_byte+0x44/0x570 drivers/input/mouse/psmouse-base.c:279 psmouse_receive_byte+0x243/0xe20 drivers/input/mouse/psmouse-base.c:426 ps2_interrupt+0x20b/0x5b0 drivers/input/serio/libps2.c:613 serio_interrupt+0x8f/0x150 drivers/input/serio/serio.c:998 i8042_interrupt+0x3f5/0x8a0 drivers/input/serio/i8042.c:606 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:247 [inline] call_irq_handler arch/x86/kernel/irq.c:259 [inline] __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] default_idle+0xf/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:185 [inline] do_idle+0x32c/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 start_secondary+0x220/0x2b0 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x148 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_inject_event+0xa4/0x370 drivers/input/input.c:423 __led_set_brightness drivers/leds/led-core.c:52 [inline] led_set_brightness_nopm drivers/leds/led-core.c:323 [inline] led_set_brightness_nosleep drivers/leds/led-core.c:354 [inline] led_set_brightness+0x211/0x290 drivers/leds/led-core.c:316 kbd_led_trigger_activate+0xcb/0x110 drivers/tty/vt/keyboard.c:1036 led_trigger_set+0x59a/0xc60 drivers/leds/led-triggers.c:212 led_match_default_trigger drivers/leds/led-triggers.c:269 [inline] led_match_default_trigger drivers/leds/led-triggers.c:263 [inline] led_trigger_set_default drivers/leds/led-triggers.c:287 [inline] led_trigger_set_default+0x1bd/0x2a0 drivers/leds/led-triggers.c:276 led_classdev_register_ext+0x78c/0x9e0 drivers/leds/led-class.c:555 led_classdev_register include/linux/leds.h:273 [inline] input_leds_connect+0x54a/0x8e0 drivers/input/input-leds.c:145 input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:1027 input_register_device+0xa8e/0x1140 drivers/input/input.c:2473 atkbd_connect+0x5e2/0xa20 drivers/input/keyboard/atkbd.c:1342 serio_connect_driver drivers/input/serio/serio.c:44 [inline] serio_driver_probe+0x74/0xa0 drivers/input/serio/serio.c:775 call_driver_probe drivers/base/dd.c:578 [inline] really_probe+0x23e/0xa90 drivers/base/dd.c:657 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829 __driver_attach+0x283/0x580 drivers/base/dd.c:1215 bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:368 serio_attach_driver drivers/input/serio/serio.c:804 [inline] serio_handle_event+0x2bb/0xa90 drivers/input/serio/serio.c:224 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] __key.7+0x0/0x40 -> (&client->buffer_lock){....}-{2:2} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] __key.1+0x0/0x40 ... acquired at: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&new->fa_lock){....}-{2:2} { INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1028 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] __key.0+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1028 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (tasklist_lock){.+.?}-{2:2} { HARDIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 IN-SOFTIRQ-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x3a/0x70 kernel/locking/spinlock.c:228 send_sigurg+0xb0/0xc30 fs/fcntl.c:871 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 tcp_v6_rcv+0x3143/0x4120 net/ipv6/tcp_ipv6.c:1912 ip6_protocol_deliver_rcu+0x188/0x1530 net/ipv6/ip6_input.c:438 ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0xa1/0xd0 net/ipv6/ip6_input.c:492 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0x265/0x680 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5660 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5774 process_backlog+0x443/0x15f0 net/core/dev.c:6107 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0xa92/0x1010 net/core/dev.c:6962 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 do_softirq kernel/softirq.c:455 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:442 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f SOFTIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 copy_process+0x4420/0x8de0 kernel/fork.c:2500 kernel_clone+0xfd/0x980 kernel/fork.c:2781 user_mode_thread+0xb4/0xf0 kernel/fork.c:2859 rest_init+0x23/0x2b0 init/main.c:712 start_kernel+0x3df/0x4c0 init/main.c:1103 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] tasklist_lock+0x18/0x40 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 send_sigurg+0xb0/0xc30 fs/fcntl.c:871 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x14c/0x400 net/core/sock.c:3004 release_sock+0x5a/0x220 net/core/sock.c:3558 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&f->f_owner.lock){...-}-{2:2} { IN-SOFTIRQ-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236 send_sigurg+0x22/0xc30 fs/fcntl.c:855 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 tcp_v6_rcv+0x3143/0x4120 net/ipv6/tcp_ipv6.c:1912 ip6_protocol_deliver_rcu+0x188/0x1530 net/ipv6/ip6_input.c:438 ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0xa1/0xd0 net/ipv6/ip6_input.c:492 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0x265/0x680 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5660 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5774 process_backlog+0x443/0x15f0 net/core/dev.c:6107 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0xa92/0x1010 net/core/dev.c:6962 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 do_softirq kernel/softirq.c:455 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:442 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 f_modown+0x2a/0x380 fs/fcntl.c:93 __f_setown fs/fcntl.c:112 [inline] f_setown+0xd4/0x2a0 fs/fcntl.c:140 do_fcntl+0x11f7/0x1380 fs/fcntl.c:412 __do_sys_fcntl fs/fcntl.c:492 [inline] __se_sys_fcntl fs/fcntl.c:477 [inline] __x64_sys_fcntl+0x174/0x200 fs/fcntl.c:477 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigurg+0x22/0xc30 fs/fcntl.c:855 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x14c/0x400 net/core/sock.c:3004 release_sock+0x5a/0x220 net/core/sock.c:3558 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] __key.2+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x28/0x3c0 fs/fcntl.c:816 kill_fasync_rcu fs/fcntl.c:1035 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x1f6/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f stack backtrace: CPU: 1 UID: 0 PID: 5336 Comm: syz-executor204 Not tainted 6.10.0-syzkaller-12562-g1722389b0d86 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_bad_irq_dependency kernel/locking/lockdep.c:2625 [inline] check_irq_usage+0xe3c/0x1490 kernel/locking/lockdep.c:2864 check_prev_add kernel/locking/lockdep.c:3137 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x2503/0x3cb0 kernel/locking/lockdep.c:5142 lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x28/0x3c0 fs/fcntl.c:816 kill_fasync_rcu fs/fcntl.c:1035 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x1f6/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feaa6de3079 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feaa6d7b228 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007feaa6e6a3f8 RCX: 00007feaa6de3079 RDX: 0000000000002ad8 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007feaa6e6a3f0 R08: 00007feaa6d7b6c0 R09: 00007feaa6d7b6c0 R10: 00007feaa6d7b6c0 R11: 0000000000000246 R12: 00007feaa6e3702c R13: 0100000000000000 R14: 00000000d0d0c2ac R15: 00007ffffdf9fbe8 final repro crashed as (corrupted=false): ===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.10.0-syzkaller-12562-g1722389b0d86 #0 Not tainted ----------------------------------------------------- syz-executor204/5336 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffff888028bc7318 (&f->f_owner.lock){...-}-{2:2}, at: send_sigio+0x28/0x3c0 fs/fcntl.c:816 and this task is already holding: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync_rcu fs/fcntl.c:1028 [inline] ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync fs/fcntl.c:1049 [inline] ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 which would create a new lock dependency: (&new->fa_lock){....}-{2:2} -> (&f->f_owner.lock){...-}-{2:2} but this new dependency connects a HARDIRQ-irq-safe lock: (&dev->event_lock#2){-...}-{2:2} ... which became HARDIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_event drivers/input/input.c:397 [inline] input_event+0x70/0xa0 drivers/input/input.c:390 input_report_key include/linux/input.h:426 [inline] psmouse_report_standard_buttons+0x30/0x80 drivers/input/mouse/psmouse-base.c:128 psmouse_report_standard_packet drivers/input/mouse/psmouse-base.c:146 [inline] psmouse_process_byte+0x39c/0x8a0 drivers/input/mouse/psmouse-base.c:237 psmouse_handle_byte+0x44/0x570 drivers/input/mouse/psmouse-base.c:279 psmouse_receive_byte+0x243/0xe20 drivers/input/mouse/psmouse-base.c:426 ps2_interrupt+0x20b/0x5b0 drivers/input/serio/libps2.c:613 serio_interrupt+0x8f/0x150 drivers/input/serio/serio.c:998 i8042_interrupt+0x3f5/0x8a0 drivers/input/serio/i8042.c:606 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:247 [inline] call_irq_handler arch/x86/kernel/irq.c:259 [inline] __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] default_idle+0xf/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:185 [inline] do_idle+0x32c/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 start_secondary+0x220/0x2b0 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x148 to a HARDIRQ-irq-unsafe lock: (tasklist_lock){.+.?}-{2:2} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Chain exists of: &dev->event_lock#2 --> &new->fa_lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock#2); lock(&new->fa_lock); lock(&dev->event_lock#2); *** DEADLOCK *** 8 locks held by syz-executor204/5336: #0: ffff88802601a110 (&evdev->mutex){+.+.}-{3:3}, at: evdev_write+0x1ff/0x750 drivers/input/evdev.c:504 #1: ffff88801cfde230 (&dev->event_lock#2){-...}-{2:2}, at: input_inject_event+0xa4/0x370 drivers/input/input.c:423 #2: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #2: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: input_inject_event+0xca/0x370 drivers/input/input.c:425 #3: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #3: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: input_pass_values+0x8b/0x8e0 drivers/input/input.c:118 #4: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #4: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #4: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: evdev_events+0x86/0x390 drivers/input/evdev.c:298 #5: ffff88801acdf028 (&client->buffer_lock){....}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #5: ffff88801acdf028 (&client->buffer_lock){....}-{2:2}, at: evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: kill_fasync fs/fcntl.c:1048 [inline] #6: ffffffff8ddb5220 (rcu_read_lock){....}-{1:2}, at: kill_fasync+0x6d/0x4f0 fs/fcntl.c:1042 #7: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync_rcu fs/fcntl.c:1028 [inline] #7: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync fs/fcntl.c:1049 [inline] #7: ffff88802ce51018 (&new->fa_lock){....}-{2:2}, at: kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 the dependencies between HARDIRQ-irq-safe lock and the holding lock: -> (&dev->event_lock#2){-...}-{2:2} { IN-HARDIRQ-W at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_event drivers/input/input.c:397 [inline] input_event+0x70/0xa0 drivers/input/input.c:390 input_report_key include/linux/input.h:426 [inline] psmouse_report_standard_buttons+0x30/0x80 drivers/input/mouse/psmouse-base.c:128 psmouse_report_standard_packet drivers/input/mouse/psmouse-base.c:146 [inline] psmouse_process_byte+0x39c/0x8a0 drivers/input/mouse/psmouse-base.c:237 psmouse_handle_byte+0x44/0x570 drivers/input/mouse/psmouse-base.c:279 psmouse_receive_byte+0x243/0xe20 drivers/input/mouse/psmouse-base.c:426 ps2_interrupt+0x20b/0x5b0 drivers/input/serio/libps2.c:613 serio_interrupt+0x8f/0x150 drivers/input/serio/serio.c:998 i8042_interrupt+0x3f5/0x8a0 drivers/input/serio/i8042.c:606 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:247 [inline] call_irq_handler arch/x86/kernel/irq.c:259 [inline] __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] default_idle+0xf/0x20 arch/x86/kernel/process.c:742 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:185 [inline] do_idle+0x32c/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 start_secondary+0x220/0x2b0 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x148 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_inject_event+0xa4/0x370 drivers/input/input.c:423 __led_set_brightness drivers/leds/led-core.c:52 [inline] led_set_brightness_nopm drivers/leds/led-core.c:323 [inline] led_set_brightness_nosleep drivers/leds/led-core.c:354 [inline] led_set_brightness+0x211/0x290 drivers/leds/led-core.c:316 kbd_led_trigger_activate+0xcb/0x110 drivers/tty/vt/keyboard.c:1036 led_trigger_set+0x59a/0xc60 drivers/leds/led-triggers.c:212 led_match_default_trigger drivers/leds/led-triggers.c:269 [inline] led_match_default_trigger drivers/leds/led-triggers.c:263 [inline] led_trigger_set_default drivers/leds/led-triggers.c:287 [inline] led_trigger_set_default+0x1bd/0x2a0 drivers/leds/led-triggers.c:276 led_classdev_register_ext+0x78c/0x9e0 drivers/leds/led-class.c:555 led_classdev_register include/linux/leds.h:273 [inline] input_leds_connect+0x54a/0x8e0 drivers/input/input-leds.c:145 input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:1027 input_register_device+0xa8e/0x1140 drivers/input/input.c:2473 atkbd_connect+0x5e2/0xa20 drivers/input/keyboard/atkbd.c:1342 serio_connect_driver drivers/input/serio/serio.c:44 [inline] serio_driver_probe+0x74/0xa0 drivers/input/serio/serio.c:775 call_driver_probe drivers/base/dd.c:578 [inline] really_probe+0x23e/0xa90 drivers/base/dd.c:657 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829 __driver_attach+0x283/0x580 drivers/base/dd.c:1215 bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:368 serio_attach_driver drivers/input/serio/serio.c:804 [inline] serio_handle_event+0x2bb/0xa90 drivers/input/serio/serio.c:224 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] __key.7+0x0/0x40 -> (&client->buffer_lock){....}-{2:2} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] __key.1+0x0/0x40 ... acquired at: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&new->fa_lock){....}-{2:2} { INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1028 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] __key.0+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1028 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x138/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f the dependencies between the lock to be acquired and HARDIRQ-irq-unsafe lock: -> (tasklist_lock){.+.?}-{2:2} { HARDIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 IN-SOFTIRQ-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x3a/0x70 kernel/locking/spinlock.c:228 send_sigurg+0xb0/0xc30 fs/fcntl.c:871 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 tcp_v6_rcv+0x3143/0x4120 net/ipv6/tcp_ipv6.c:1912 ip6_protocol_deliver_rcu+0x188/0x1530 net/ipv6/ip6_input.c:438 ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0xa1/0xd0 net/ipv6/ip6_input.c:492 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0x265/0x680 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5660 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5774 process_backlog+0x443/0x15f0 net/core/dev.c:6107 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0xa92/0x1010 net/core/dev.c:6962 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 do_softirq kernel/softirq.c:455 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:442 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f SOFTIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 copy_process+0x4420/0x8de0 kernel/fork.c:2500 kernel_clone+0xfd/0x980 kernel/fork.c:2781 user_mode_thread+0xb4/0xf0 kernel/fork.c:2859 rest_init+0x23/0x2b0 init/main.c:712 start_kernel+0x3df/0x4c0 init/main.c:1103 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1591 do_wait+0x219/0x570 kernel/exit.c:1635 kernel_wait+0xa0/0x160 kernel/exit.c:1811 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] tasklist_lock+0x18/0x40 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 send_sigurg+0xb0/0xc30 fs/fcntl.c:871 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x14c/0x400 net/core/sock.c:3004 release_sock+0x5a/0x220 net/core/sock.c:3558 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&f->f_owner.lock){...-}-{2:2} { IN-SOFTIRQ-R at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236 send_sigurg+0x22/0xc30 fs/fcntl.c:855 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 tcp_v6_rcv+0x3143/0x4120 net/ipv6/tcp_ipv6.c:1912 ip6_protocol_deliver_rcu+0x188/0x1530 net/ipv6/ip6_input.c:438 ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0xa1/0xd0 net/ipv6/ip6_input.c:492 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0x265/0x680 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5660 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5774 process_backlog+0x443/0x15f0 net/core/dev.c:6107 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0xa92/0x1010 net/core/dev.c:6962 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 do_softirq kernel/softirq.c:455 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:442 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 f_modown+0x2a/0x380 fs/fcntl.c:93 __f_setown fs/fcntl.c:112 [inline] f_setown+0xd4/0x2a0 fs/fcntl.c:140 do_fcntl+0x11f7/0x1380 fs/fcntl.c:412 __do_sys_fcntl fs/fcntl.c:492 [inline] __se_sys_fcntl fs/fcntl.c:477 [inline] __x64_sys_fcntl+0x174/0x200 fs/fcntl.c:477 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigurg+0x22/0xc30 fs/fcntl.c:855 sk_send_sigurg+0x7a/0x370 net/core/sock.c:3432 tcp_check_urg net/ipv4/tcp_input.c:5826 [inline] tcp_urg+0x343/0xb80 net/ipv4/tcp_input.c:5867 tcp_rcv_established+0x8a6/0x21c0 net/ipv4/tcp_input.c:6222 tcp_v6_do_rcv+0x83c/0x16e0 net/ipv6/tcp_ipv6.c:1640 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x14c/0x400 net/core/sock.c:3004 release_sock+0x5a/0x220 net/core/sock.c:3558 sk_stream_wait_memory+0x65e/0x10e0 net/core/stream.c:145 tcp_sendmsg_locked+0xa7c/0x3550 net/ipv4/tcp.c:1312 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1354 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:661 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x371/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] __key.2+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x28/0x3c0 fs/fcntl.c:816 kill_fasync_rcu fs/fcntl.c:1035 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x1f6/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f stack backtrace: CPU: 1 UID: 0 PID: 5336 Comm: syz-executor204 Not tainted 6.10.0-syzkaller-12562-g1722389b0d86 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_bad_irq_dependency kernel/locking/lockdep.c:2625 [inline] check_irq_usage+0xe3c/0x1490 kernel/locking/lockdep.c:2864 check_prev_add kernel/locking/lockdep.c:3137 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x2503/0x3cb0 kernel/locking/lockdep.c:5142 lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x28/0x3c0 fs/fcntl.c:816 kill_fasync_rcu fs/fcntl.c:1035 [inline] kill_fasync fs/fcntl.c:1049 [inline] kill_fasync+0x1f6/0x4f0 fs/fcntl.c:1042 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x450/0x750 drivers/input/evdev.c:521 vfs_write+0x29a/0x1140 fs/read_write.c:588 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feaa6de3079 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feaa6d7b228 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007feaa6e6a3f8 RCX: 00007feaa6de3079 RDX: 0000000000002ad8 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007feaa6e6a3f0 R08: 00007feaa6d7b6c0 R09: 00007feaa6d7b6c0 R10: 00007feaa6d7b6c0 R11: 0000000000000246 R12: 00007feaa6e3702c R13: 0100000000000000 R14: 00000000d0d0c2ac R15: 00007ffffdf9fbe8