./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2040332715 <...> [ 97.390007][ T928] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.131' (ED25519) to the list of known hosts. execve("./syz-executor2040332715", ["./syz-executor2040332715"], 0x7ffeb4ba5d40 /* 10 vars */) = 0 brk(NULL) = 0x555577002000 brk(0x555577002d00) = 0x555577002d00 arch_prctl(ARCH_SET_FS, 0x555577002380) = 0 set_tid_address(0x555577002650) = 5063 set_robust_list(0x555577002660, 24) = 0 rseq(0x555577002ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2040332715", 4096) = 28 getrandom("\x3c\xb4\x7b\xbb\x2b\xf8\x8f\x54", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555577002d00 brk(0x555577023d00) = 0x555577023d00 brk(0x555577024000) = 0x555577024000 mprotect(0x7f0f30f05000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5064 attached , child_tidptr=0x555577002650) = 5064 [pid 5064] set_robust_list(0x555577002660, 24) = 0 [pid 5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5064] setpgid(0, 0) = 0 [pid 5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5064] write(3, "1000", 4) = 4 [pid 5064] close(3) = 0 [pid 5064] openat(AT_FDCWD, "/dev/snd/seq", O_RDONLY) = 3 [pid 5064] ioctl(3, SNDRV_SEQ_IOCTL_CREATE_QUEUE, 0x20000180) = 0 [ 98.582715][ T28] audit: type=1400 audit(1710456989.311:87): avc: denied { execmem } for pid=5063 comm="syz-executor204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5064] openat(AT_FDCWD, "/dev/dsp1", O_RDONLY) = 4 [pid 5064] ppoll([{fd=4, events=0}], 1, NULL, NULL, 0 [pid 5063] kill(-5064, SIGKILL [pid 5064] <... ppoll resumed> ) = ? [pid 5063] <... kill resumed>) = 0 [pid 5063] kill(5064, SIGKILL) = 0 [ 103.635207][ T5064] [ 103.637567][ T5064] ======================================================== [ 103.644757][ T5064] WARNING: possible irq lock inversion dependency detected [ 103.651947][ T5064] 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted [ 103.658625][ T5064] -------------------------------------------------------- [ 103.665825][ T5064] syz-executor204/5064 just changed the state of lock: [ 103.672682][ T5064] ffff8880298c4148 (&timer->lock){+.+.}-{2:2}, at: snd_timer_close_locked+0x65/0xbd0 [ 103.682225][ T5064] but this lock was taken by another, SOFTIRQ-safe lock in the past: [ 103.690294][ T5064] (&group->lock#2){..-.}-{2:2} [ 103.690332][ T5064] [ 103.690332][ T5064] [ 103.690332][ T5064] and interrupts could create inverse lock ordering between them. [ 103.690332][ T5064] [ 103.709483][ T5064] [ 103.709483][ T5064] other info that might help us debug this: [ 103.717547][ T5064] Possible interrupt unsafe locking scenario: [ 103.717547][ T5064] [ 103.725867][ T5064] CPU0 CPU1 [ 103.731240][ T5064] ---- ---- [ 103.736606][ T5064] lock(&timer->lock); [ 103.740782][ T5064] local_irq_disable(); [ 103.747642][ T5064] lock(&group->lock#2); [ 103.754513][ T5064] lock(&timer->lock); [ 103.761200][ T5064] [ 103.764659][ T5064] lock(&group->lock#2); [ 103.769185][ T5064] [ 103.769185][ T5064] *** DEADLOCK *** [ 103.769185][ T5064] [ 103.777331][ T5064] 3 locks held by syz-executor204/5064: [ 103.782884][ T5064] #0: ffffffff8f1d7228 (register_mutex#3){+.+.}-{3:3}, at: seq_free_client+0x1a/0x170 [ 103.792594][ T5064] #1: ffff88802e94d978 (&q->timer_mutex){+.+.}-{3:3}, at: queue_delete+0x21/0xa0 [ 103.801870][ T5064] #2: ffffffff8f1bc708 (register_mutex){+.+.}-{3:3}, at: snd_timer_close+0x7e/0xf0 [ 103.811301][ T5064] [ 103.811301][ T5064] the shortest dependencies between 2nd lock and 1st lock: [ 103.820705][ T5064] -> (&group->lock#2){..-.}-{2:2} { [ 103.826027][ T5064] IN-SOFTIRQ-W at: [ 103.830151][ T5064] lock_acquire+0x1b1/0x540 [ 103.836516][ T5064] _raw_spin_lock_irqsave+0x3a/0x60 [ 103.843590][ T5064] _snd_pcm_stream_lock_irqsave+0xa0/0xd0 [ 103.851177][ T5064] snd_pcm_period_elapsed+0x20/0x50 [ 103.858229][ T5064] loopback_jiffies_timer_function+0x1c8/0x240 [ 103.866235][ T5064] call_timer_fn+0x1a0/0x5b0 [ 103.872693][ T5064] __run_timers+0x74b/0xab0 [ 103.879051][ T5064] run_timer_base+0x111/0x190 [ 103.885586][ T5064] run_timer_softirq+0x1a/0x40 [ 103.892214][ T5064] __do_softirq+0x218/0x8de [ 103.898598][ T5064] irq_exit_rcu+0xb9/0x120 [ 103.904862][ T5064] sysvec_apic_timer_interrupt+0x95/0xb0 [ 103.912346][ T5064] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 103.920188][ T5064] acpi_safe_halt+0x1a/0x20 [ 103.926529][ T5064] acpi_idle_enter+0xc5/0x160 [ 103.933056][ T5064] cpuidle_enter_state+0x85/0x510 [ 103.939938][ T5064] cpuidle_enter+0x4e/0xa0 [ 103.946208][ T5064] do_idle+0x313/0x3f0 [ 103.952117][ T5064] cpu_startup_entry+0x4f/0x60 [ 103.958737][ T5064] start_secondary+0x220/0x2b0 [ 103.965375][ T5064] common_startup_64+0x13e/0x148 [ 103.972180][ T5064] INITIAL USE at: [ 103.976172][ T5064] lock_acquire+0x1b1/0x540 [ 103.982435][ T5064] _raw_spin_lock_irq+0x36/0x50 [ 103.989042][ T5064] snd_pcm_stream_lock_irq+0x92/0xb0 [ 103.996104][ T5064] snd_pcm_oss_poll+0x2f6/0xb80 [ 104.002721][ T5064] do_sys_poll+0x539/0xde0 [ 104.008886][ T5064] __x64_sys_ppoll+0x25a/0x2d0 [ 104.015404][ T5064] do_syscall_64+0xd2/0x260 [ 104.021675][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.029337][ T5064] } [ 104.031924][ T5064] ... key at: [] __key.5+0x0/0x40 [ 104.039169][ T5064] ... acquired at: [ 104.043066][ T5064] _raw_spin_lock_irqsave+0x3a/0x60 [ 104.048462][ T5064] snd_timer_notify+0x111/0x3e0 [ 104.053515][ T5064] snd_pcm_post_start+0x272/0x350 [ 104.058745][ T5064] snd_pcm_action_single+0x10a/0x150 [ 104.064226][ T5064] snd_pcm_action+0x70/0x90 [ 104.068936][ T5064] snd_pcm_action_lock_irq+0xa1/0x1a0 [ 104.074499][ T5064] snd_pcm_kernel_ioctl+0x10f/0x2d0 [ 104.079892][ T5064] snd_pcm_oss_set_trigger.isra.0+0x35f/0x6b0 [ 104.086173][ T5064] snd_pcm_oss_poll+0x9a0/0xb80 [ 104.091217][ T5064] do_sys_poll+0x539/0xde0 [ 104.095840][ T5064] __x64_sys_ppoll+0x25a/0x2d0 [ 104.100794][ T5064] do_syscall_64+0xd2/0x260 [ 104.105495][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.111591][ T5064] [ 104.113917][ T5064] -> (&timer->lock){+.+.}-{2:2} { [ 104.118988][ T5064] HARDIRQ-ON-W at: [ 104.122978][ T5064] lock_acquire+0x1b1/0x540 [ 104.129161][ T5064] _raw_spin_lock+0x2e/0x40 [ 104.135328][ T5064] snd_timer_close_locked+0x65/0xbd0 [ 104.142283][ T5064] snd_timer_close+0x8b/0xf0 [ 104.148535][ T5064] snd_seq_timer_close+0xa4/0x100 [ 104.155224][ T5064] queue_delete+0x49/0xa0 [ 104.161232][ T5064] snd_seq_queue_client_leave+0x37/0x1a0 [ 104.168550][ T5064] seq_free_client1.part.0+0x10a/0x260 [ 104.175683][ T5064] seq_free_client+0x74/0x170 [ 104.182030][ T5064] snd_seq_release+0x50/0xe0 [ 104.188290][ T5064] __fput+0x270/0xb80 [ 104.193951][ T5064] task_work_run+0x14e/0x250 [ 104.200242][ T5064] do_exit+0xa7d/0x2be0 [ 104.206112][ T5064] do_group_exit+0xd3/0x2a0 [ 104.212297][ T5064] get_signal+0x2390/0x2760 [ 104.218475][ T5064] arch_do_signal_or_restart+0x90/0x7e0 [ 104.225697][ T5064] syscall_exit_to_user_mode+0x14a/0x2a0 [ 104.233008][ T5064] do_syscall_64+0xe2/0x260 [ 104.239207][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.246786][ T5064] SOFTIRQ-ON-W at: [ 104.250782][ T5064] lock_acquire+0x1b1/0x540 [ 104.256967][ T5064] _raw_spin_lock+0x2e/0x40 [ 104.263146][ T5064] snd_timer_close_locked+0x65/0xbd0 [ 104.270104][ T5064] snd_timer_close+0x8b/0xf0 [ 104.276378][ T5064] snd_seq_timer_close+0xa4/0x100 [ 104.283076][ T5064] queue_delete+0x49/0xa0 [ 104.289096][ T5064] snd_seq_queue_client_leave+0x37/0x1a0 [ 104.296412][ T5064] seq_free_client1.part.0+0x10a/0x260 [ 104.303543][ T5064] seq_free_client+0x74/0x170 [ 104.309901][ T5064] snd_seq_release+0x50/0xe0 [ 104.316168][ T5064] __fput+0x270/0xb80 [ 104.321828][ T5064] task_work_run+0x14e/0x250 [ 104.328106][ T5064] do_exit+0xa7d/0x2be0 [ 104.333943][ T5064] do_group_exit+0xd3/0x2a0 [ 104.340125][ T5064] get_signal+0x2390/0x2760 [ 104.346303][ T5064] arch_do_signal_or_restart+0x90/0x7e0 [ 104.353524][ T5064] syscall_exit_to_user_mode+0x14a/0x2a0 [ 104.360841][ T5064] do_syscall_64+0xe2/0x260 [ 104.367025][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.374605][ T5064] INITIAL USE at: [ 104.378534][ T5064] lock_acquire+0x1b1/0x540 [ 104.384636][ T5064] _raw_spin_lock_irqsave+0x3a/0x60 [ 104.391421][ T5064] snd_timer_notify+0x111/0x3e0 [ 104.397886][ T5064] snd_pcm_post_start+0x272/0x350 [ 104.404513][ T5064] snd_pcm_action_single+0x10a/0x150 [ 104.411385][ T5064] snd_pcm_action+0x70/0x90 [ 104.417483][ T5064] snd_pcm_action_lock_irq+0xa1/0x1a0 [ 104.424436][ T5064] snd_pcm_kernel_ioctl+0x10f/0x2d0 [ 104.431220][ T5064] snd_pcm_oss_set_trigger.isra.0+0x35f/0x6b0 [ 104.438884][ T5064] snd_pcm_oss_poll+0x9a0/0xb80 [ 104.445329][ T5064] do_sys_poll+0x539/0xde0 [ 104.451332][ T5064] __x64_sys_ppoll+0x25a/0x2d0 [ 104.457683][ T5064] do_syscall_64+0xd2/0x260 [ 104.463805][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.471315][ T5064] } [ 104.473823][ T5064] ... key at: [] __key.6+0x0/0x40 [ 104.480960][ T5064] ... acquired at: [ 104.484766][ T5064] __lock_acquire+0x979/0x3b30 [ 104.489737][ T5064] lock_acquire+0x1b1/0x540 [ 104.494468][ T5064] _raw_spin_lock+0x2e/0x40 [ 104.499171][ T5064] snd_timer_close_locked+0x65/0xbd0 [ 104.504648][ T5064] snd_timer_close+0x8b/0xf0 [ 104.509430][ T5064] snd_seq_timer_close+0xa4/0x100 [ 104.514649][ T5064] queue_delete+0x49/0xa0 [ 104.519181][ T5064] snd_seq_queue_client_leave+0x37/0x1a0 [ 104.525031][ T5064] seq_free_client1.part.0+0x10a/0x260 [ 104.530702][ T5064] seq_free_client+0x74/0x170 [ 104.535574][ T5064] snd_seq_release+0x50/0xe0 [ 104.540369][ T5064] __fput+0x270/0xb80 [ 104.544557][ T5064] task_work_run+0x14e/0x250 [ 104.549357][ T5064] do_exit+0xa7d/0x2be0 [ 104.553715][ T5064] do_group_exit+0xd3/0x2a0 [ 104.558420][ T5064] get_signal+0x2390/0x2760 [ 104.563559][ T5064] arch_do_signal_or_restart+0x90/0x7e0 [ 104.569304][ T5064] syscall_exit_to_user_mode+0x14a/0x2a0 [ 104.575141][ T5064] do_syscall_64+0xe2/0x260 [ 104.579859][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.585957][ T5064] [ 104.588301][ T5064] [ 104.588301][ T5064] stack backtrace: [ 104.594197][ T5064] CPU: 0 PID: 5064 Comm: syz-executor204 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 [ 104.604280][ T5064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 104.614353][ T5064] Call Trace: [ 104.617646][ T5064] [ 104.620590][ T5064] dump_stack_lvl+0x116/0x1f0 [ 104.625321][ T5064] print_irq_inversion_bug.part.0+0x3e9/0x5a0 [ 104.631427][ T5064] ? __pfx_print_irq_inversion_bug.part.0+0x10/0x10 [ 104.638065][ T5064] ? __pfx_usage_skip+0x10/0x10 [ 104.642943][ T5064] ? __pfx_usage_match+0x10/0x10 [ 104.647908][ T5064] mark_lock+0x574/0xc60 [ 104.652189][ T5064] ? __pfx_mark_lock+0x10/0x10 [ 104.656980][ T5064] ? register_lock_class+0xb1/0x1230 [ 104.662298][ T5064] ? lockdep_unlock+0x11a/0x290 [ 104.667199][ T5064] __lock_acquire+0x979/0x3b30 [ 104.672004][ T5064] ? lock_acquire+0x1b1/0x540 [ 104.676717][ T5064] ? __pfx___lock_acquire+0x10/0x10 [ 104.681950][ T5064] ? __mutex_trylock_common+0xea/0x250 [ 104.687447][ T5064] lock_acquire+0x1b1/0x540 [ 104.691984][ T5064] ? snd_timer_close_locked+0x65/0xbd0 [ 104.697464][ T5064] ? __pfx_lock_acquire+0x10/0x10 [ 104.702519][ T5064] ? __mutex_lock+0x1a6/0x9c0 [ 104.707227][ T5064] ? __pfx___lock_acquire+0x10/0x10 [ 104.712482][ T5064] ? __pfx___mutex_trylock_common+0x10/0x10 [ 104.718417][ T5064] ? snd_timer_close+0x7e/0xf0 [ 104.723210][ T5064] ? __pfx_mark_lock+0x10/0x10 [ 104.728028][ T5064] ? __pfx_snd_seq_release+0x10/0x10 [ 104.733342][ T5064] _raw_spin_lock+0x2e/0x40 [ 104.737870][ T5064] ? snd_timer_close_locked+0x65/0xbd0 [ 104.743367][ T5064] snd_timer_close_locked+0x65/0xbd0 [ 104.748675][ T5064] ? __pfx_snd_seq_release+0x10/0x10 [ 104.753986][ T5064] snd_timer_close+0x8b/0xf0 [ 104.758595][ T5064] ? __pfx_snd_timer_close+0x10/0x10 [ 104.763899][ T5064] ? _raw_spin_unlock_irq+0x23/0x50 [ 104.769122][ T5064] ? lockdep_hardirqs_on+0x7c/0x110 [ 104.774376][ T5064] snd_seq_timer_close+0xa4/0x100 [ 104.779436][ T5064] queue_delete+0x49/0xa0 [ 104.783819][ T5064] snd_seq_queue_client_leave+0x37/0x1a0 [ 104.789509][ T5064] ? __pfx_snd_seq_release+0x10/0x10 [ 104.794840][ T5064] seq_free_client1.part.0+0x10a/0x260 [ 104.800344][ T5064] seq_free_client+0x74/0x170 [ 104.805049][ T5064] snd_seq_release+0x50/0xe0 [ 104.809665][ T5064] __fput+0x270/0xb80 [ 104.813768][ T5064] task_work_run+0x14e/0x250 [ 104.818395][ T5064] ? __pfx_task_work_run+0x10/0x10 [ 104.823541][ T5064] ? do_raw_spin_unlock+0x172/0x230 [ 104.828757][ T5064] do_exit+0xa7d/0x2be0 [ 104.832944][ T5064] ? get_signal+0x92d/0x2760 [ 104.837564][ T5064] ? __pfx_do_exit+0x10/0x10 [ 104.842186][ T5064] ? do_raw_spin_lock+0x12d/0x2c0 [ 104.847233][ T5064] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 104.852639][ T5064] do_group_exit+0xd3/0x2a0 [ 104.857192][ T5064] get_signal+0x2390/0x2760 [ 104.861736][ T5064] ? __pfx_get_signal+0x10/0x10 [ 104.866627][ T5064] ? find_held_lock+0x2d/0x110 [ 104.871439][ T5064] arch_do_signal_or_restart+0x90/0x7e0 [ 104.877024][ T5064] ? __pfx_lock_release+0x10/0x10 [ 104.882097][ T5064] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 104.888299][ T5064] ? lockdep_hardirqs_on+0x7c/0x110 [ 104.893539][ T5064] syscall_exit_to_user_mode+0x14a/0x2a0 [ 104.899209][ T5064] do_syscall_64+0xe2/0x260 [ 104.903770][ T5064] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 104.909700][ T5064] RIP: 0033:0x7f0f30e92ab9 [ 104.914131][ T5064] Code: Unable to access opcode bytes at 0x7f0f30e92a8f. [ 104.921166][ T5064] RSP: 002b:00007ffd29ead298 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 104.929596][ T5064] RAX: fffffffffffffdfe RBX: 0000000000000000 RCX: 00007f0f30e92ab9 [pid 5064] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5064, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted kill ...>) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555577002650) = 5066 ./strace-static-x86_64: Process 5066 attached [pid 5066] set_robust_list(0x555577002660, 24) = 0 [pid 5066] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5066] setpgid(0, 0) = 0 [pid 5066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "1000", 4) = 4 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/dev/snd/seq", O_RDONLY) = 3 [pid 5066] ioctl(3, SNDRV_SEQ_IOCTL_CREATE_QUEUE, 0x20000180) = 0 [pid 5066] openat(AT_FDCWD, "/dev/dsp1", O_RDONLY) = 4 [ 104.937606][ T5064] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000020000180 [ 104.945620][ T5064] RBP: 00007f0f30f055f0 R08: 0000000000000000 R09: 0000000000000006 [ 104.953620][ T5064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 104.961601][ T5064] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 [ 104.969594][ T5064] [pid 5066] ppoll([{fd=4, events=0}], 1, NULL, NULL, 0 [pid 5063] kill(-5066, SIGKILL) = 0 [pid 5066] <... ppoll resumed> ) = ? [pid 5063] kill(5066, SIGKILL) = 0 [pid 5066] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5066, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=3 /* 0.03 s */} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555577002650) = 5069 ./strace-static-x86_64: Process 5069 attached [pid 5069] set_robust_list(0x555577002660, 24) = 0 [pid 5069] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5069] setpgid(0, 0) = 0 [pid 5069] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5069] write(3, "1000", 4) = 4 [pid 5069] close(3) = 0 [pid 5069] openat(AT_FDCWD, "/dev/snd/seq", O_RDONLY) = 3 [pid 5069] ioctl(3, SNDRV_SEQ_IOCTL_CREATE_QUEUE, 0x20000180) = 0 [pid 5069] openat(AT_FDCWD, "/dev/dsp1", O_RDONLY) = 4