possible deadlock in snd_seq_deliver_event

Status: upstream: reported C repro on 2026/07/31 01:39
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+f7d4003f58de3f8e24ae@syzkaller.appspotmail.com
First crash: 7d19h, last: 19h27m
Bug presence (1)
Date Name Commit Repro Result
2026/08/07 upstream (ToT) c0a27675eaf0 C [report] possible deadlock in snd_seq_deliver_event
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in snd_seq_deliver_event 4 syz, C 6 3196d 3206d 4/29 fixed on 2018/01/23 12:04
linux-6.1 possible deadlock in snd_seq_deliver_event 4 3 5h45m 13d 0/3 upstream: reported on 2026/07/25 05:57
android-49 possible deadlock in snd_seq_deliver_event 4 syz, C 1 3196d 2672d 0/3 public: reported C repro on 2019/04/14 08:51
linux-6.6 possible deadlock in snd_seq_deliver_event 4 2 4d05h 4d10h 0/2 upstream: reported on 2026/08/03 09:53
upstream possible deadlock in snd_seq_deliver_event (2) sound prio:high 4 136 42m 8d18h 0/29 upstream: reported on 2026/07/30 01:59

Sample crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/0:18/4320 is trying to acquire lock:
ffff88802af0a130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff88802af0a130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854

but task is already holding lock:
ffff88802070f930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff88802070f930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&grp->list_lock);
  lock(&grp->list_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by kworker/0:18/4320:
 #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90003defd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffff88802070f930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
 #2: ffff88802070f930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854

stack backtrace:
CPU: 0 PID: 4320 Comm: kworker/0:18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events snd_rawmidi_input_event_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 __lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
 __raw_read_lock include/linux/rwlock_api_smp.h:149 [inline]
 _raw_read_lock+0x32/0x40 kernel/locking/spinlock.c:228
 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
 snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854
 snd_seq_kernel_client_dispatch+0x1fc/0x2f0 sound/core/seq/seq_clientmgr.c:2407
 queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
 snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]
 snd_seq_control_queue+0x8ff/0x1010 sound/core/seq/seq_queue.c:721
 snd_seq_deliver_single_event+0x806/0xb30 sound/core/seq/seq_clientmgr.c:663
 snd_seq_kernel_client_dispatch+0x1fc/0x2f0 sound/core/seq/seq_clientmgr.c:2407
 send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
 snd_seq_oss_timer_start+0x2ce/0x510 sound/core/seq/oss/seq_oss_timer.c:161
 send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
 snd_seq_oss_midi_input+0x2e8/0x890 sound/core/seq/oss/seq_oss_midi.c:544
 snd_seq_deliver_single_event+0x806/0xb30 sound/core/seq/seq_clientmgr.c:663
 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:720 [inline]
 snd_seq_deliver_event+0x49d/0x8c0 sound/core/seq/seq_clientmgr.c:854
 snd_seq_kernel_client_dispatch+0x1fc/0x2f0 sound/core/seq/seq_clientmgr.c:2407
 snd_midi_input_event+0x289/0x3d0 sound/core/seq/seq_midi.c:89
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/06 08:37 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in snd_seq_deliver_event
2026/08/07 01:13 linux-5.15.y 9c7634c60784 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in snd_seq_deliver_event
2026/08/07 01:06 linux-5.15.y 9c7634c60784 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in snd_seq_deliver_event
2026/08/06 00:13 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in snd_seq_deliver_event
2026/08/06 00:10 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in snd_seq_deliver_event
2026/07/31 01:38 linux-5.15.y 6e2fd6534337 aaffb173 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in snd_seq_deliver_event
* Struck through repros no longer work on HEAD.