./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1824234316 <...> Warning: Permanently added '10.128.1.111' (ED25519) to the list of known hosts. execve("./syz-executor1824234316", ["./syz-executor1824234316"], 0x7ffd8cd21a00 /* 10 vars */) = 0 brk(NULL) = 0x55556b3c3000 brk(0x55556b3c3d00) = 0x55556b3c3d00 arch_prctl(ARCH_SET_FS, 0x55556b3c3380) = 0 set_tid_address(0x55556b3c3650) = 5056 set_robust_list(0x55556b3c3660, 24) = 0 rseq(0x55556b3c3ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1824234316", 4096) = 28 getrandom("\xb8\x56\x6d\xc0\x0b\xbb\x57\xd3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556b3c3d00 brk(0x55556b3e4d00) = 0x55556b3e4d00 brk(0x55556b3e5000) = 0x55556b3e5000 mprotect(0x7fea92b65000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/sequencer2", O_RDWR|O_CREAT|O_SYNC|O_NOATIME, 000) = 3 write(3, "\x81\x05\x00\x00\x00\x00\x00\x00", 8) = 8 exit_group(0) = ? [ 55.648718][ T5056] [ 55.651093][ T5056] ================================ [ 55.656193][ T5056] WARNING: inconsistent lock state [ 55.661289][ T5056] 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted [ 55.667966][ T5056] -------------------------------- [ 55.673067][ T5056] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [ 55.679898][ T5056] syz-executor182/5056 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 55.686649][ T5056] ffff8880296a5148 (&timer->lock){?...}-{2:2}, at: snd_timer_close_locked+0x53/0x8d0 [ 55.696145][ T5056] {IN-HARDIRQ-W} state was registered at: [ 55.701857][ T5056] lock_acquire+0x1e4/0x530 [ 55.706437][ T5056] _raw_spin_lock+0x2e/0x40 [ 55.711066][ T5056] snd_hrtimer_callback+0x54/0x370 [ 55.716250][ T5056] __hrtimer_run_queues+0x595/0xd00 [ 55.721616][ T5056] hrtimer_interrupt+0x396/0x990 [ 55.726634][ T5056] __sysvec_apic_timer_interrupt+0x107/0x3a0 [ 55.732691][ T5056] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 55.738427][ T5056] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 55.744501][ T5056] _raw_spin_unlock_irqrestore+0xd8/0x140 [ 55.750327][ T5056] folio_batch_move_lru+0x5bf/0x6e0 [ 55.755617][ T5056] lru_add_drain_cpu+0x10e/0x8c0 [ 55.760810][ T5056] lru_add_drain+0x123/0x3e0 [ 55.765486][ T5056] exit_mmap+0x28d/0xd40 [ 55.769820][ T5056] __mmput+0x115/0x3c0 [ 55.773961][ T5056] exit_mm+0x220/0x310 [ 55.778107][ T5056] do_exit+0x99e/0x27e0 [ 55.782426][ T5056] do_group_exit+0x207/0x2c0 [ 55.787094][ T5056] __x64_sys_exit_group+0x3f/0x40 [ 55.792194][ T5056] do_syscall_64+0xfb/0x240 [ 55.796769][ T5056] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 55.802824][ T5056] irq event stamp: 6199 [ 55.806975][ T5056] hardirqs last enabled at (6199): [] _raw_spin_unlock_irq+0x23/0x50 [ 55.816707][ T5056] hardirqs last disabled at (6198): [] _raw_spin_lock_irq+0xad/0x120 [ 55.826352][ T5056] softirqs last enabled at (3644): [] __irq_exit_rcu+0xf2/0x1c0 [ 55.835717][ T5056] softirqs last disabled at (3637): [] __irq_exit_rcu+0xf2/0x1c0 [ 55.844990][ T5056] [ 55.844990][ T5056] other info that might help us debug this: [ 55.853034][ T5056] Possible unsafe locking scenario: [ 55.853034][ T5056] [ 55.860468][ T5056] CPU0 [ 55.863732][ T5056] ---- [ 55.866996][ T5056] lock(&timer->lock); [ 55.871140][ T5056] [ 55.874585][ T5056] lock(&timer->lock); [ 55.878903][ T5056] [ 55.878903][ T5056] *** DEADLOCK *** [ 55.878903][ T5056] [ 55.887062][ T5056] 3 locks held by syz-executor182/5056: [ 55.892589][ T5056] #0: ffffffff8f2d3228 (register_mutex#4){+.+.}-{3:3}, at: odev_release+0x4e/0x80 [ 55.901899][ T5056] #1: ffff88802da72978 (&q->timer_mutex){+.+.}-{3:3}, at: snd_seq_queue_delete+0x5b/0xf0 [ 55.911822][ T5056] #2: ffffffff8f2c1a68 (register_mutex){+.+.}-{3:3}, at: snd_timer_close+0xa3/0x130 [ 55.921302][ T5056] [ 55.921302][ T5056] stack backtrace: [ 55.927174][ T5056] CPU: 1 PID: 5056 Comm: syz-executor182 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 [ 55.937219][ T5056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 55.947263][ T5056] Call Trace: [ 55.950536][ T5056] [ 55.953458][ T5056] dump_stack_lvl+0x241/0x360 [ 55.958762][ T5056] ? __pfx_dump_stack_lvl+0x10/0x10 [ 55.963949][ T5056] ? print_usage_bug+0x61a/0x8a0 [ 55.968875][ T5056] ? is_bpf_text_address+0x28d/0x2b0 [ 55.974152][ T5056] valid_state+0x13a/0x1c0 [ 55.978573][ T5056] mark_lock_irq+0xbb/0xc20 [ 55.983063][ T5056] ? arch_stack_walk+0x16d/0x1b0 [ 55.987994][ T5056] ? __pfx_mark_lock_irq+0x10/0x10 [ 55.993093][ T5056] ? stack_trace_save+0x118/0x1d0 [ 55.998110][ T5056] ? __pfx_stack_trace_save+0x10/0x10 [ 56.003477][ T5056] ? lockdep_lock+0x123/0x2b0 [ 56.008151][ T5056] ? save_trace+0x5a/0xb40 [ 56.012555][ T5056] ? __lock_acquire+0x1346/0x1fd0 [ 56.017569][ T5056] mark_lock+0x223/0x350 [ 56.021801][ T5056] __lock_acquire+0x112d/0x1fd0 [ 56.026663][ T5056] lock_acquire+0x1e4/0x530 [ 56.031152][ T5056] ? snd_timer_close_locked+0x53/0x8d0 [ 56.036605][ T5056] ? __pfx___mutex_trylock_common+0x10/0x10 [ 56.042491][ T5056] ? __pfx_lock_acquire+0x10/0x10 [ 56.047504][ T5056] ? rcu_is_watching+0x15/0xb0 [ 56.052254][ T5056] ? trace_contention_end+0x3c/0x100 [ 56.057528][ T5056] ? __mutex_lock+0x2ef/0xd70 [ 56.062197][ T5056] ? snd_timer_close+0xa3/0x130 [ 56.067039][ T5056] _raw_spin_lock+0x2e/0x40 [ 56.071540][ T5056] ? snd_timer_close_locked+0x53/0x8d0 [ 56.076991][ T5056] snd_timer_close_locked+0x53/0x8d0 [ 56.082275][ T5056] snd_timer_close+0xae/0x130 [ 56.086944][ T5056] ? __pfx_snd_timer_close+0x10/0x10 [ 56.092318][ T5056] ? _raw_spin_unlock_irq+0x23/0x50 [ 56.097509][ T5056] ? lockdep_hardirqs_on+0x99/0x150 [ 56.102701][ T5056] snd_seq_timer_close+0xa9/0xe0 [ 56.107630][ T5056] snd_seq_queue_delete+0x8f/0xf0 [ 56.112649][ T5056] snd_seq_oss_release+0x1d3/0x310 [ 56.117753][ T5056] ? __pfx_snd_seq_oss_release+0x10/0x10 [ 56.123465][ T5056] ? __asan_memset+0x23/0x50 [ 56.128053][ T5056] ? evm_file_release+0x140/0x1d0 [ 56.133063][ T5056] ? __pfx_odev_release+0x10/0x10 [ 56.138075][ T5056] odev_release+0x56/0x80 [ 56.142394][ T5056] __fput+0x429/0x8a0 [ 56.146378][ T5056] task_work_run+0x24f/0x310 [ 56.150963][ T5056] ? __pfx_task_work_run+0x10/0x10 [ 56.156064][ T5056] ? switch_task_namespaces+0xe1/0x110 [ 56.161769][ T5056] do_exit+0xa1b/0x27e0 [ 56.165921][ T5056] ? __pfx_do_exit+0x10/0x10 [ 56.170499][ T5056] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 56.176472][ T5056] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 56.182787][ T5056] ? _raw_spin_unlock_irq+0x23/0x50 [ 56.187975][ T5056] ? lockdep_hardirqs_on+0x99/0x150 [ 56.193167][ T5056] do_group_exit+0x207/0x2c0 [ 56.197752][ T5056] __x64_sys_exit_group+0x3f/0x40 [ 56.202772][ T5056] do_syscall_64+0xfb/0x240 [ 56.207264][ T5056] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 56.213146][ T5056] RIP: 0033:0x7fea92af0c39 [ 56.217548][ T5056] Code: Unable to access opcode bytes at 0x7fea92af0c0f. [ 56.224548][ T5056] RSP: 002b:00007ffc0f80eab8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 56.233038][ T5056] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fea92af0c39 [ 56.241093][ T5056] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 +++ exited with 0 +++ [ 56.249051][ T5056] RBP: