Extracting prog: 1m14.297532483s
Minimizing prog: 8m50.82783776s
Simplifying prog options: 0s
Extracting C: 1m6.703578379s
Simplifying C: 9m37.872482112s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program crashed: possible deadlock in uinput_request_submit
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0)
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(0x0, 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program did not crash
testing program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=31.388929438s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
simplifying C reproducer
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in input_ff_flush
a never seen crash title: possible deadlock in input_ff_flush, ignore
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing compiled C program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
program crashed: possible deadlock in uinput_request_submit
testing program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program crashed: possible deadlock in uinput_request_submit
validation run: crashed=true
testing program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program crashed: possible deadlock in uinput_request_submit
validation run: crashed=true
testing program (duration=31.388929438s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF
detailed listing:
executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x4, 0x0, 0x9}, 'syz1\x00', 0x3c})
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51)
ioctl$UI_DEV_CREATE(r0, 0x5501)
r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000500)={0x50, 0xffff, 0xd, {0x2, 0xdac}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x5, 0x610b, 0x8, 0x2cf2}, {0x2, 0x2, 0x5, 0xfff9, 0x6, 0x3b7e}]})
program crashed: possible deadlock in uinput_request_submit
validation run: crashed=true
reproducing took 23m26.081796326s
repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/6086 is trying to acquire lock:
ffff888025065870 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_send drivers/input/misc/uinput.c:151 [inline]
ffff888025065870 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
but task is already holding lock:
ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1d7/0xc60 drivers/input/ff-core.c:122
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&ff->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
class_mutex_constructor include/linux/mutex.h:253 [inline]
input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0xd1/0x160 drivers/input/input.c:628
evdev_release+0x344/0x420 drivers/input/evdev.c:435
__fput+0x3ff/0xb40 fs/file_table.c:468
fput_close_sync+0x118/0x250 fs/file_table.c:573
__do_sys_close fs/open.c:1573 [inline]
__se_sys_close fs/open.c:1558 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1558
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&dev->mutex#2){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
input_register_handle+0xca/0x630 drivers/input/input.c:2619
kbd_connect+0xce/0x180 drivers/tty/vt/keyboard.c:1559
input_attach_handler.isra.0+0x177/0x1e0 drivers/input/input.c:994
input_register_device.cold+0x139/0x375 drivers/input/input.c:2378
acpi_button_add+0x548/0xb50 drivers/acpi/button.c:621
acpi_device_probe+0xc9/0x370 drivers/acpi/bus.c:1076
call_driver_probe drivers/base/dd.c:583 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:661
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:803
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833
__driver_attach+0x217/0x5c0 drivers/base/dd.c:1227
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715
driver_register+0x1e2/0x360 drivers/base/driver.c:249
__acpi_bus_register_driver+0xdf/0x130 drivers/acpi/bus.c:1027
acpi_button_register_driver drivers/acpi/button.c:753 [inline]
acpi_button_driver_init+0xe4/0x100 drivers/acpi/button.c:762
do_one_initcall+0x11d/0x690 init/main.c:1378
do_initcall_level init/main.c:1440 [inline]
do_initcalls init/main.c:1456 [inline]
do_basic_setup init/main.c:1475 [inline]
kernel_init_freeable+0x6e5/0x790 init/main.c:1688
kernel_init+0x1f/0x1e0 init/main.c:1578
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
-> #1 (input_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
input_register_device.cold+0x5b/0x375 drivers/input/input.c:2374
uinput_create_device drivers/input/misc/uinput.c:365 [inline]
uinput_ioctl_handler.isra.0+0x8d8/0x1d10 drivers/input/misc/uinput.c:919
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&newdev->mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x578/0xc60 drivers/input/ff-core.c:148
evdev_do_ioctl+0x1228/0x1b60 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&newdev->mutex --> &dev->mutex#2 --> &ff->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ff->mutex);
lock(&dev->mutex#2);
lock(&ff->mutex);
lock(&newdev->mutex);
*** DEADLOCK ***
2 locks held by syz.0.17/6086:
#0: ffff88802bc2b118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl_handler drivers/input/evdev.c:1261 [inline]
#0: ffff88802bc2b118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl+0x7f/0x1a0 drivers/input/evdev.c:1279
#1: ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#1: ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1d7/0xc60 drivers/input/ff-core.c:122
stack backtrace:
CPU: 2 UID: 0 PID: 6086 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x578/0xc60 drivers/input/ff-core.c:148
evdev_do_ioctl+0x1228/0x1b60 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f850cd9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdf5de0798 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f850d015fa0 RCX: 00007f850cd9aeb9
RDX: 0000200000000500 RSI: 0000000040304580 RDI: 0000000000000004
RBP: 00007f850ce08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f850d015fac R14: 00007f850d015fa0 R15: 00007f850d015fa0
final repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/6086 is trying to acquire lock:
ffff888025065870 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_send drivers/input/misc/uinput.c:151 [inline]
ffff888025065870 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
but task is already holding lock:
ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1d7/0xc60 drivers/input/ff-core.c:122
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&ff->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
class_mutex_constructor include/linux/mutex.h:253 [inline]
input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0xd1/0x160 drivers/input/input.c:628
evdev_release+0x344/0x420 drivers/input/evdev.c:435
__fput+0x3ff/0xb40 fs/file_table.c:468
fput_close_sync+0x118/0x250 fs/file_table.c:573
__do_sys_close fs/open.c:1573 [inline]
__se_sys_close fs/open.c:1558 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1558
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&dev->mutex#2){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
input_register_handle+0xca/0x630 drivers/input/input.c:2619
kbd_connect+0xce/0x180 drivers/tty/vt/keyboard.c:1559
input_attach_handler.isra.0+0x177/0x1e0 drivers/input/input.c:994
input_register_device.cold+0x139/0x375 drivers/input/input.c:2378
acpi_button_add+0x548/0xb50 drivers/acpi/button.c:621
acpi_device_probe+0xc9/0x370 drivers/acpi/bus.c:1076
call_driver_probe drivers/base/dd.c:583 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:661
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:803
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833
__driver_attach+0x217/0x5c0 drivers/base/dd.c:1227
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715
driver_register+0x1e2/0x360 drivers/base/driver.c:249
__acpi_bus_register_driver+0xdf/0x130 drivers/acpi/bus.c:1027
acpi_button_register_driver drivers/acpi/button.c:753 [inline]
acpi_button_driver_init+0xe4/0x100 drivers/acpi/button.c:762
do_one_initcall+0x11d/0x690 init/main.c:1378
do_initcall_level init/main.c:1440 [inline]
do_initcalls init/main.c:1456 [inline]
do_basic_setup init/main.c:1475 [inline]
kernel_init_freeable+0x6e5/0x790 init/main.c:1688
kernel_init+0x1f/0x1e0 init/main.c:1578
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
-> #1 (input_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
input_register_device.cold+0x5b/0x375 drivers/input/input.c:2374
uinput_create_device drivers/input/misc/uinput.c:365 [inline]
uinput_ioctl_handler.isra.0+0x8d8/0x1d10 drivers/input/misc/uinput.c:919
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&newdev->mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x578/0xc60 drivers/input/ff-core.c:148
evdev_do_ioctl+0x1228/0x1b60 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&newdev->mutex --> &dev->mutex#2 --> &ff->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ff->mutex);
lock(&dev->mutex#2);
lock(&ff->mutex);
lock(&newdev->mutex);
*** DEADLOCK ***
2 locks held by syz.0.17/6086:
#0: ffff88802bc2b118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl_handler drivers/input/evdev.c:1261 [inline]
#0: ffff88802bc2b118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl+0x7f/0x1a0 drivers/input/evdev.c:1279
#1: ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#1: ffff8880250648b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1d7/0xc60 drivers/input/ff-core.c:122
stack backtrace:
CPU: 2 UID: 0 PID: 6086 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:614 [inline]
__mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x578/0xc60 drivers/input/ff-core.c:148
evdev_do_ioctl+0x1228/0x1b60 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f850cd9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdf5de0798 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f850d015fa0 RCX: 00007f850cd9aeb9
RDX: 0000200000000500 RSI: 0000000040304580 RDI: 0000000000000004
RBP: 00007f850ce08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f850d015fac R14: 00007f850d015fa0 R15: 00007f850d015fa0