syzbot
possible deadlock in snd_seq_deliver_event
Status:
upstream: reported on 2026/08/03 09:53
Reported-by: syzbot+dcf425e9f7c7b0caba3d@syzkaller.appspotmail.com
First crash: 3h07m, last: 3h07m
Sample crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/0:3/5822 is trying to acquire lock:
ffff88802cf69930 (&grp->list_lock){.+.+}-{2:2}, at: __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
ffff88802cf69930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
ffff88802cf69930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854
but task is already holding lock:
ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&grp->list_lock);
lock(&grp->list_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kworker/0:3/5822:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#1: ffffc9000486fd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc9000486fd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#2: ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
#2: ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
#2: ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854
stack backtrace:
CPU: 0 PID: 5822 Comm: kworker/0:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events snd_rawmidi_input_event_work
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain kernel/locking/lockdep.c:3856 [inline]
__lock_acquire+0x6809/0x7d80 kernel/locking/lockdep.c:5137
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
__raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
_raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
__deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x201/0x2f0 sound/core/seq/seq_clientmgr.c:2546
queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]
snd_seq_control_queue+0x886/0x1060 sound/core/seq/seq_queue.c:721
__snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:656 [inline]
snd_seq_deliver_single_event+0x5a3/0xbc0 sound/core/seq/seq_clientmgr.c:719
snd_seq_deliver_event+0x270/0x970 sound/core/seq/seq_clientmgr.c:856
snd_seq_kernel_client_dispatch+0x201/0x2f0 sound/core/seq/seq_clientmgr.c:2546
send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
snd_seq_oss_timer_start+0x337/0x570 sound/core/seq/oss/seq_oss_timer.c:161
send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
snd_seq_oss_midi_input+0x34d/0x9b0 sound/core/seq/oss/seq_oss_midi.c:544
__snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:656 [inline]
snd_seq_deliver_single_event+0x5a3/0xbc0 sound/core/seq/seq_clientmgr.c:719
__deliver_to_subscribers sound/core/seq/seq_clientmgr.c:774 [inline]
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
snd_seq_deliver_event+0x502/0x970 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x201/0x2f0 sound/core/seq/seq_clientmgr.c:2546
snd_midi_input_event+0x2b2/0x3f0 sound/core/seq/seq_midi.c:93
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
* Struck through repros no longer work on HEAD.