./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3876332450
<...>
Warning: Permanently added '10.128.1.19' (ED25519) to the list of known hosts.
execve("./syz-executor3876332450", ["./syz-executor3876332450"], 0x7ffc5120cc60 /* 10 vars */) = 0
brk(NULL) = 0x55559503a000
brk(0x55559503ad00) = 0x55559503ad00
arch_prctl(ARCH_SET_FS, 0x55559503a380) = 0
set_tid_address(0x55559503a650) = 5842
set_robust_list(0x55559503a660, 24) = 0
rseq(0x55559503aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3876332450", 4096) = 28
getrandom("\x17\xdc\x24\x79\x7e\xd5\x65\xa8", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55559503ad00
brk(0x55559505bd00) = 0x55559505bd00
brk(0x55559505c000) = 0x55559505c000
mprotect(0x7fad7e68c000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5843 attached
, child_tidptr=0x55559503a650) = 5843
[pid 5843] set_robust_list(0x55559503a660, 24) = 0
[pid 5843] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5843] setpgid(0, 0) = 0
[pid 5843] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5843] write(3, "1000", 4) = 4
[pid 5843] close(3) = 0
executing program
[pid 5843] write(1, "executing program\n", 18) = 18
[pid 5843] openat(AT_FDCWD, "/dev/uinput", O_RDONLY) = 3
[pid 5843] ioctl(3, UI_DEV_SETUP, 0x200000000180) = 0
[pid 5843] ioctl(3, UI_SET_FFBIT, 0x51) = 0
[pid 5843] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
[pid 5843] openat(AT_FDCWD, "/dev/input/event4", O_RDONLY) = 4
[ 91.036079][ T5843] input: syz1 as /devices/virtual/input/input5
[ 91.058305][ T5843]
[ 91.060693][ T5843] ======================================================
[ 91.067723][ T5843] WARNING: possible circular locking dependency detected
[ 91.074794][ T5843] 6.16.0-rc7-syzkaller #0 Not tainted
[ 91.080186][ T5843] ------------------------------------------------------
[ 91.087220][ T5843] syz-executor387/5843 is trying to acquire lock:
[ 91.093629][ T5843] ffff888146f0e070 (&newdev->mutex){+.+.}-{4:4}, at: uinput_request_submit+0x188/0x6f0
[ 91.103327][ T5843]
[ 91.103327][ T5843] but task is already holding lock:
[ 91.110701][ T5843] ffff888146f0f0b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x398/0xae0
[ 91.119518][ T5843]
[ 91.119518][ T5843] which lock already depends on the new lock.
[ 91.119518][ T5843]
[ 91.129943][ T5843]
[ 91.129943][ T5843] the existing dependency chain (in reverse order) is:
[ 91.138960][ T5843]
[ 91.138960][ T5843] -> #3 (&ff->mutex){+.+.}-{4:4}:
[ 91.146194][ T5843] lock_acquire+0x120/0x360
[ 91.151239][ T5843] __mutex_lock+0x182/0xe80
[ 91.156287][ T5843] input_ff_flush+0x5e/0x140
[ 91.161412][ T5843] input_flush_device+0xa6/0xd0
[ 91.166809][ T5843] evdev_release+0xe1/0x800
[ 91.171842][ T5843] __fput+0x44c/0xa70
[ 91.176363][ T5843] fput_close_sync+0x119/0x200
[ 91.181661][ T5843] __x64_sys_close+0x7f/0x110
[ 91.186870][ T5843] do_syscall_64+0xfa/0x3b0
[ 91.191908][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.198340][ T5843]
[ 91.198340][ T5843] -> #2 (&dev->mutex#2){+.+.}-{4:4}:
[ 91.205838][ T5843] lock_acquire+0x120/0x360
[ 91.210872][ T5843] __mutex_lock+0x182/0xe80
[ 91.215910][ T5843] input_register_handle+0x18f/0x4c0
[ 91.221731][ T5843] kbd_connect+0xc3/0x140
[ 91.226595][ T5843] input_register_device+0xcee/0x10b0
[ 91.232503][ T5843] acpi_button_add+0x6b1/0xb50
[ 91.237801][ T5843] acpi_device_probe+0xa5/0x2d0
[ 91.243187][ T5843] really_probe+0x26a/0x9a0
[ 91.248217][ T5843] __driver_probe_device+0x18c/0x2f0
[ 91.254049][ T5843] driver_probe_device+0x4f/0x430
[ 91.259626][ T5843] __driver_attach+0x452/0x700
[ 91.264934][ T5843] bus_for_each_dev+0x230/0x2b0
[ 91.270319][ T5843] bus_add_driver+0x345/0x640
[ 91.275533][ T5843] driver_register+0x23a/0x320
[ 91.280825][ T5843] do_one_initcall+0x233/0x820
[ 91.286127][ T5843] do_initcall_level+0x137/0x1f0
[ 91.291617][ T5843] do_initcalls+0x69/0xd0
[ 91.296480][ T5843] kernel_init_freeable+0x3d9/0x570
[ 91.302214][ T5843] kernel_init+0x1d/0x1d0
[ 91.307081][ T5843] ret_from_fork+0x3fc/0x770
[ 91.312198][ T5843] ret_from_fork_asm+0x1a/0x30
[ 91.317504][ T5843]
[ 91.317504][ T5843] -> #1 (input_mutex){+.+.}-{4:4}:
[ 91.324824][ T5843] lock_acquire+0x120/0x360
[ 91.329856][ T5843] __mutex_lock+0x182/0xe80
[ 91.334890][ T5843] input_register_device+0xa74/0x10b0
[ 91.340801][ T5843] uinput_create_device+0x422/0x670
[ 91.346529][ T5843] uinput_ioctl_handler+0x3f0/0x1570
[ 91.352348][ T5843] __se_sys_ioctl+0xf9/0x170
[ 91.357480][ T5843] do_syscall_64+0xfa/0x3b0
[ 91.362516][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.368941][ T5843]
[ 91.368941][ T5843] -> #0 (&newdev->mutex){+.+.}-{4:4}:
[ 91.376538][ T5843] validate_chain+0xb9b/0x2140
[ 91.381838][ T5843] __lock_acquire+0xab9/0xd20
[ 91.387048][ T5843] lock_acquire+0x120/0x360
[ 91.392077][ T5843] __mutex_lock+0x182/0xe80
[ 91.397113][ T5843] uinput_request_submit+0x188/0x6f0
[ 91.402936][ T5843] uinput_dev_upload_effect+0x150/0x1e0
[ 91.409016][ T5843] input_ff_upload+0x5fc/0xae0
[ 91.414316][ T5843] evdev_ioctl_handler+0x1644/0x1f10
[ 91.420130][ T5843] __se_sys_ioctl+0xf9/0x170
[ 91.425268][ T5843] do_syscall_64+0xfa/0x3b0
[ 91.430310][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.436730][ T5843]
[ 91.436730][ T5843] other info that might help us debug this:
[ 91.436730][ T5843]
[ 91.447002][ T5843] Chain exists of:
[ 91.447002][ T5843] &newdev->mutex --> &dev->mutex#2 --> &ff->mutex
[ 91.447002][ T5843]
[ 91.459385][ T5843] Possible unsafe locking scenario:
[ 91.459385][ T5843]
[ 91.466865][ T5843] CPU0 CPU1
[ 91.472256][ T5843] ---- ----
[ 91.477642][ T5843] lock(&ff->mutex);
[ 91.481652][ T5843] lock(&dev->mutex#2);
[ 91.488459][ T5843] lock(&ff->mutex);
[ 91.495003][ T5843] lock(&newdev->mutex);
[ 91.499356][ T5843]
[ 91.499356][ T5843] *** DEADLOCK ***
[ 91.499356][ T5843]
[ 91.507524][ T5843] 2 locks held by syz-executor387/5843:
[ 91.513095][ T5843] #0: ffff88814acf0118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl_handler+0x121/0x1f10
[ 91.523099][ T5843] #1: ffff888146f0f0b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x398/0xae0
[ 91.532371][ T5843]
[ 91.532371][ T5843] stack backtrace:
[ 91.538286][ T5843] CPU: 0 UID: 0 PID: 5843 Comm: syz-executor387 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)
[ 91.538307][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 91.538324][ T5843] Call Trace:
[ 91.538337][ T5843]
[ 91.538345][ T5843] dump_stack_lvl+0x189/0x250
[ 91.538368][ T5843] ? __pfx_dump_stack_lvl+0x10/0x10
[ 91.538387][ T5843] ? __pfx__printk+0x10/0x10
[ 91.538409][ T5843] ? print_lock_name+0xde/0x100
[ 91.538431][ T5843] print_circular_bug+0x2ee/0x310
[ 91.538453][ T5843] check_noncircular+0x134/0x160
[ 91.538476][ T5843] validate_chain+0xb9b/0x2140
[ 91.538497][ T5843] ? stack_trace_save+0x9c/0xe0
[ 91.538519][ T5843] ? __pfx_stack_trace_save+0x10/0x10
[ 91.538539][ T5843] ? __pfx_hlock_conflict+0x10/0x10
[ 91.538562][ T5843] __lock_acquire+0xab9/0xd20
[ 91.538579][ T5843] ? uinput_request_submit+0x188/0x6f0
[ 91.538600][ T5843] lock_acquire+0x120/0x360
[ 91.538614][ T5843] ? uinput_request_submit+0x188/0x6f0
[ 91.538640][ T5843] __mutex_lock+0x182/0xe80
[ 91.538658][ T5843] ? uinput_request_submit+0x188/0x6f0
[ 91.538679][ T5843] ? __lock_acquire+0xab9/0xd20
[ 91.538696][ T5843] ? uinput_request_submit+0x188/0x6f0
[ 91.538717][ T5843] ? __pfx___mutex_lock+0x10/0x10
[ 91.538738][ T5843] ? do_raw_spin_unlock+0x122/0x240
[ 91.538761][ T5843] ? _raw_spin_unlock+0x28/0x50
[ 91.538798][ T5843] ? uinput_request_alloc_id+0x3cf/0x400
[ 91.538820][ T5843] uinput_request_submit+0x188/0x6f0
[ 91.538841][ T5843] ? __mutex_trylock_common+0x153/0x260
[ 91.538863][ T5843] ? __pfx_uinput_request_submit+0x10/0x10
[ 91.538885][ T5843] ? rcu_is_watching+0x15/0xb0
[ 91.538903][ T5843] ? trace_contention_end+0x39/0x120
[ 91.538929][ T5843] ? __mutex_lock+0x330/0xe80
[ 91.538950][ T5843] uinput_dev_upload_effect+0x150/0x1e0
[ 91.538972][ T5843] ? __pfx_uinput_dev_upload_effect+0x10/0x10
[ 91.539002][ T5843] input_ff_upload+0x5fc/0xae0
[ 91.539025][ T5843] evdev_ioctl_handler+0x1644/0x1f10
[ 91.539045][ T5843] ? __pfx_tomoyo_path_number_perm+0x10/0x10
[ 91.539063][ T5843] ? __pfx_evdev_ioctl_handler+0x10/0x10
[ 91.539079][ T5843] ? __pfx_smack_log+0x10/0x10
[ 91.539102][ T5843] ? smk_access+0x14c/0x4e0
[ 91.539127][ T5843] ? smk_tskacc+0x2fc/0x370
[ 91.539152][ T5843] ? smack_file_ioctl+0x24a/0x340
[ 91.539173][ T5843] ? __pfx_smack_file_ioctl+0x10/0x10
[ 91.539191][ T5843] ? __pfx_ptrace_notify+0x10/0x10
[ 91.539211][ T5843] ? bpf_lsm_file_ioctl+0x9/0x20
[ 91.539230][ T5843] ? __pfx_evdev_ioctl+0x10/0x10
[ 91.539245][ T5843] __se_sys_ioctl+0xf9/0x170
[ 91.539271][ T5843] do_syscall_64+0xfa/0x3b0
[ 91.539290][ T5843] ? lockdep_hardirqs_on+0x9c/0x150
[ 91.539307][ T5843] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.539323][ T5843] ? clear_bhb_loop+0x60/0xb0
[ 91.539341][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.539358][ T5843] RIP: 0033:0x7fad7e619979
[ 91.539378][ T5843] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 91.539396][ T5843] RSP: 002b:00007ffecc22e2c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 91.539413][ T5843] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fad7e619979
[ 91.539425][ T5843] RDX: 0000200000000300 RSI: 0000000040304580 RDI: 0000000000000004
[ 91.539436][ T5843] RBP: 00007fad7e68c5f0 R08: 0000000000000006 R09: 0000000000000006
[ 91.539447][ T5843] R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001
[ 91.539456][ T5843] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[ 91.539473][ T5843]
[ 91.898032][ T24] cfg80211: failed to load regulatory.db
[pid 5843] ioctl(4, EVIOCSFF, {type=FF_RUMBLE, id=-1, direction=0, ...}
[pid 5842] kill(-5843, SIGKILL) = 0
[pid 5842] kill(5843, SIGKILL) = 0
[pid 5842] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid 5842] newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0
[pid 5842] getdents64(3, 0x55559503b6f0 /* 2 entries */, 32768) = 48
[pid 5842] getdents64(3, 0x55559503b6f0 /* 0 entries */, 32768) = 0
[pid 5842] close(3) = 0