syzbot

======================================================
WARNING: possible circular locking dependency detected
5.15.189-syzkaller #0 Not tainted
------------------------------------------------------
syz.5.496/6372 is trying to acquire lock:
ffff0000ce85b8b0 (&ff->mutex){+.+.}-{3:3}, at: input_ff_flush+0x60/0x14c drivers/input/ff-core.c:245

but task is already holding lock:
ffff0000d1b502c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_flush_device+0x50/0xc8 drivers/input/input.c:667

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&dev->mutex#2){+.+.}-{3:3}:
       __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596
       __mutex_lock kernel/locking/mutex.c:729 [inline]
       mutex_lock_interruptible_nested+0xac/0x11c kernel/locking/mutex.c:765
       input_register_handle+0x74/0x2ec drivers/input/input.c:2588
       kbd_connect+0xbc/0x134 drivers/tty/vt/keyboard.c:1577
       input_attach_handler drivers/input/input.c:1046 [inline]
       input_register_device+0xae0/0xe34 drivers/input/input.c:2429
       acpi_button_add+0x554/0x8a0 drivers/acpi/button.c:579
       acpi_device_probe+0xa8/0x2bc drivers/acpi/bus.c:1013
       call_driver_probe drivers/base/dd.c:-1 [inline]
       really_probe+0x26c/0xaec drivers/base/dd.c:595
       __driver_probe_device+0x180/0x314 drivers/base/dd.c:755
       driver_probe_device+0x78/0x34c drivers/base/dd.c:785
       __driver_attach+0x3cc/0x5c0 drivers/base/dd.c:1164
       bus_for_each_dev+0x144/0x1c4 drivers/base/bus.c:303
       driver_attach+0x4c/0x5c drivers/base/dd.c:1181
       bus_add_driver+0x2d8/0x558 drivers/base/bus.c:620
       driver_register+0x200/0x374 drivers/base/driver.c:240
       acpi_bus_register_driver+0xd8/0x114 drivers/acpi/bus.c:963
       acpi_button_register_driver drivers/acpi/button.c:669 [inline]
       acpi_button_driver_init+0xd0/0x10c drivers/acpi/button.c:678
       do_one_initcall+0x228/0x8b0 init/main.c:1302
       do_initcall_level+0x154/0x214 init/main.c:1375
       do_initcalls+0x58/0xac init/main.c:1391
       do_basic_setup+0x8c/0xa0 init/main.c:1410
       kernel_init_freeable+0x404/0x5fc init/main.c:1615
       kernel_init+0x24/0x1d0 init/main.c:1506
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855

-> #2 (input_mutex){+.+.}-{3:3}:
       __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596
       __mutex_lock kernel/locking/mutex.c:729 [inline]
       mutex_lock_interruptible_nested+0xac/0x11c kernel/locking/mutex.c:765
       input_register_device+0x900/0xe34 drivers/input/input.c:2422
       uinput_create_device+0x350/0x518 drivers/input/misc/uinput.c:364
       uinput_ioctl_handler+0x3c4/0x10bc drivers/input/misc/uinput.c:884
       uinput_ioctl+0x38/0x4c drivers/input/misc/uinput.c:1055
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:874 [inline]
       __se_sys_ioctl fs/ioctl.c:860 [inline]
       __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
       do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
       el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
       el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #1 (&newdev->mutex){+.+.}-{3:3}:
       __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596
       __mutex_lock kernel/locking/mutex.c:729 [inline]
       mutex_lock_interruptible_nested+0xac/0x11c kernel/locking/mutex.c:765
       uinput_request_send drivers/input/misc/uinput.c:150 [inline]
       uinput_request_submit+0x180/0x618 drivers/input/misc/uinput.c:181
       uinput_dev_upload_effect+0x130/0x1c0 drivers/input/misc/uinput.c:256
       input_ff_upload+0x454/0x78c drivers/input/ff-core.c:155
       evdev_do_ioctl drivers/input/evdev.c:1183 [inline]
       evdev_ioctl_handler+0x1fec/0x2be0 drivers/input/evdev.c:1272
       evdev_ioctl+0x38/0x4c drivers/input/evdev.c:1281
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:874 [inline]
       __se_sys_ioctl fs/ioctl.c:860 [inline]
       __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
       do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
       el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
       el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #0 (&ff->mutex){+.+.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3053 [inline]
       check_prevs_add kernel/locking/lockdep.c:3172 [inline]
       validate_chain kernel/locking/lockdep.c:3788 [inline]
       __lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012
       lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
       __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596
       __mutex_lock kernel/locking/mutex.c:729 [inline]
       mutex_lock_nested+0xac/0x11c kernel/locking/mutex.c:743
       input_ff_flush+0x60/0x14c drivers/input/ff-core.c:245
       uinput_dev_flush+0x30/0x4c drivers/input/misc/uinput.c:282
       input_flush_device+0x9c/0xc8 drivers/input/input.c:672
       evdev_release+0xc8/0x608 drivers/input/evdev.c:444
       __fput+0x1c0/0x7f8 fs/file_table.c:311
       ____fput+0x20/0x30 fs/file_table.c:339
       task_work_run+0x12c/0x1e0 kernel/task_work.c:188
       tracehook_notify_resume include/linux/tracehook.h:189 [inline]
       do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949
       prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
       exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
       el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609
       el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

other info that might help us debug this:

Chain exists of:
  &ff->mutex --> input_mutex --> &dev->mutex#2

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&dev->mutex#2);
                               lock(input_mutex);
                               lock(&dev->mutex#2);
  lock(&ff->mutex);

 *** DEADLOCK ***

2 locks held by syz.5.496/6372:
 #0: ffff0000eb5bc110 (&evdev->mutex){+.+.}-{3:3}, at: evdev_release+0x70/0x608 drivers/input/evdev.c:441
 #1: ffff0000d1b502c0 (&dev->mutex#2){+.+.}-{3:3}, at: input_flush_device+0x50/0xc8 drivers/input/input.c:667

stack backtrace:
CPU: 0 PID: 6372 Comm: syz.5.496 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
 dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2011
 check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2133
 check_prev_add kernel/locking/lockdep.c:3053 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain kernel/locking/lockdep.c:3788 [inline]
 __lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012
 lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
 __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0xac/0x11c kernel/locking/mutex.c:743
 input_ff_flush+0x60/0x14c drivers/input/ff-core.c:245
 uinput_dev_flush+0x30/0x4c drivers/input/misc/uinput.c:282
 input_flush_device+0x9c/0xc8 drivers/input/input.c:672
 evdev_release+0xc8/0x608 drivers/input/evdev.c:444
 __fput+0x1c0/0x7f8 fs/file_table.c:311
 ____fput+0x20/0x30 fs/file_table.c:339
 task_work_run+0x12c/0x1e0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609
 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584