possible deadlock in snd_seq_deliver_event

Status: upstream: reported on 2026/07/25 05:57
Reported-by: syzbot+e4261fc52d6431f1e410@syzkaller.appspotmail.com
First crash: 10d, last: 5d10h
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in snd_seq_deliver_event 4 syz, C 6 3193d 3203d 4/29 fixed on 2018/01/23 12:04
linux-5.15 possible deadlock in snd_seq_deliver_event 4 1 4d19h 4d19h 0/3 upstream: reported on 2026/07/31 01:39
android-49 possible deadlock in snd_seq_deliver_event 4 syz, C 1 3193d 2669d 0/3 public: reported C repro on 2019/04/14 08:51
linux-6.6 possible deadlock in snd_seq_deliver_event 4 2 1d06h 1d11h 0/2 upstream: reported on 2026/08/03 09:53
upstream possible deadlock in snd_seq_deliver_event (2) sound prio:high 4 85 7h49m 5d19h 0/29 upstream: reported on 2026/07/30 01:59

Sample crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/1:7/4382 is trying to acquire lock:
ffff0000d4dcc930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff0000d4dcc930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

but task is already holding lock:
ffff0000ddc6a130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff0000ddc6a130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&grp->list_lock);
  lock(&grp->list_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by kworker/1:7/4382:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800020ed7c40 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ddc6a130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
 #2: ffff0000ddc6a130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

stack backtrace:
CPU: 1 PID: 4382 Comm: kworker/1:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: events snd_rawmidi_input_event_work
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 __lock_acquire+0x15d0/0x6634 kernel/locking/lockdep.c:-1
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
 _raw_read_lock+0x64/0x80 kernel/locking/spinlock.c:228
 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
 snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854
 snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
 queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
 snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]
 snd_seq_control_queue+0x6c0/0xe54 sound/core/seq/seq_queue.c:721
 event_input_timer+0x34/0x48 sound/core/seq/seq_system.c:103
 snd_seq_deliver_single_event+0x318/0x780 sound/core/seq/seq_clientmgr.c:663
 snd_seq_deliver_event+0x1b4/0x5d0 sound/core/seq/seq_clientmgr.c:865
 snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
 send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
 snd_seq_oss_timer_start+0x234/0x420 sound/core/seq/oss/seq_oss_timer.c:161
 send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
 snd_seq_oss_midi_input+0x298/0x7b4 sound/core/seq/oss/seq_oss_midi.c:544
 snd_seq_oss_event_input+0x108/0x1f0 sound/core/seq/oss/seq_oss_event.c:429
 snd_seq_deliver_single_event+0x318/0x780 sound/core/seq/seq_clientmgr.c:663
 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:720 [inline]
 snd_seq_deliver_event+0x2dc/0x5d0 sound/core/seq/seq_clientmgr.c:854
 snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
 snd_midi_input_event+0x234/0x37c sound/core/seq/seq_midi.c:92
 snd_rawmidi_input_event_work+0x68/0x84 sound/core/rawmidi.c:129
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/30 11:24 linux-6.1.y 1016ca6176ee 2377cd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in snd_seq_deliver_event
2026/07/25 05:56 linux-6.1.y dc5c83b7f5f8 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in snd_seq_deliver_event
* Struck through repros no longer work on HEAD.