./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4098302874 <...> Warning: Permanently added '10.128.1.143' (ED25519) to the list of known hosts. execve("./syz-executor4098302874", ["./syz-executor4098302874"], 0x7fffc9cccdf0 /* 10 vars */) = 0 brk(NULL) = 0x555556c74000 brk(0x555556c74d00) = 0x555556c74d00 arch_prctl(ARCH_SET_FS, 0x555556c74380) = 0 set_tid_address(0x555556c74650) = 5086 set_robust_list(0x555556c74660, 24) = 0 rseq(0x555556c74ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4098302874", 4096) = 28 getrandom("\x52\x0d\xee\x83\x39\xca\x84\x4b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556c74d00 brk(0x555556c95d00) = 0x555556c95d00 brk(0x555556c96000) = 0x555556c96000 mprotect(0x7fb8006ee000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 chmod("/dev/raw-gadget", 0666) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c74650) = 5087 ./strace-static-x86_64: Process 5087 attached [pid 5087] set_robust_list(0x555556c74660, 24) = 0 [pid 5087] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5087] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5087] setsid() = 1 [pid 5087] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5087] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5087] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5087] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5087] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5087] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5087] unshare(CLONE_NEWNS) = 0 [pid 5087] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5087] unshare(CLONE_NEWIPC) = 0 [pid 5087] unshare(CLONE_NEWCGROUP) = 0 [pid 5087] unshare(CLONE_NEWUTS) = 0 [pid 5087] unshare(CLONE_SYSVSEM) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "16777216", 8) = 8 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "536870912", 9) = 9 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "1024", 4) = 4 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "8192", 4) = 4 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "1024", 4) = 4 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "1024", 4) = 4 [pid 5087] close(3) = 0 [pid 5087] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5087] close(3) = 0 [pid 5087] getpid() = 1 [pid 5087] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<mutex){+.+.}-{3:3}, at: uinput_request_submit+0x19c/0x740 [ 75.246082][ T5087] [ 75.246082][ T5087] but task is already holding lock: [ 75.253511][ T5087] ffff888022fe00b0 (&ff->mutex){+.+.}-{3:3}, at: input_ff_upload+0x3e4/0xb00 [ 75.262313][ T5087] [ 75.262313][ T5087] which lock already depends on the new lock. [ 75.262313][ T5087] [ 75.272715][ T5087] [ 75.272715][ T5087] the existing dependency chain (in reverse order) is: [ 75.281726][ T5087] [ 75.281726][ T5087] -> #3 (&ff->mutex){+.+.}-{3:3}: [ 75.288949][ T5087] lock_acquire+0x1ed/0x550 [ 75.293979][ T5087] __mutex_lock+0x136/0xd70 [ 75.299015][ T5087] input_ff_flush+0x5e/0x140 [ 75.304132][ T5087] input_flush_device+0x9c/0xc0 [ 75.309514][ T5087] evdev_release+0xf9/0x7d0 [ 75.314549][ T5087] __fput+0x429/0x8a0 [ 75.319057][ T5087] __x64_sys_close+0x7f/0x110 [ 75.324258][ T5087] do_syscall_64+0xf5/0x240 [ 75.329301][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.335720][ T5087] [ 75.335720][ T5087] -> #2 (&dev->mutex#2){+.+.}-{3:3}: [ 75.343218][ T5087] lock_acquire+0x1ed/0x550 [ 75.348257][ T5087] __mutex_lock+0x136/0xd70 [ 75.353292][ T5087] input_register_handle+0x6d/0x3b0 [ 75.359022][ T5087] kbd_connect+0xbf/0x130 [ 75.363879][ T5087] input_register_device+0xcfa/0x1090 [ 75.369786][ T5087] acpi_button_add+0x6c6/0xb90 [ 75.375074][ T5087] acpi_device_probe+0xa5/0x2b0 [ 75.380449][ T5087] really_probe+0x2b8/0xad0 [ 75.386003][ T5087] __driver_probe_device+0x1a2/0x390 [ 75.391825][ T5087] driver_probe_device+0x50/0x430 [ 75.397380][ T5087] __driver_attach+0x45f/0x710 [ 75.402675][ T5087] bus_for_each_dev+0x239/0x2b0 [ 75.408090][ T5087] bus_add_driver+0x347/0x620 [ 75.413401][ T5087] driver_register+0x23a/0x320 [ 75.418712][ T5087] do_one_initcall+0x248/0x880 [ 75.424034][ T5087] do_initcall_level+0x157/0x210 [ 75.429605][ T5087] do_initcalls+0x3f/0x80 [ 75.434471][ T5087] kernel_init_freeable+0x435/0x5d0 [ 75.440199][ T5087] kernel_init+0x1d/0x2b0 [ 75.445086][ T5087] ret_from_fork+0x4b/0x80 [ 75.450097][ T5087] ret_from_fork_asm+0x1a/0x30 [ 75.455390][ T5087] [ 75.455390][ T5087] -> #1 (input_mutex){+.+.}-{3:3}: [ 75.462699][ T5087] lock_acquire+0x1ed/0x550 [ 75.467731][ T5087] __mutex_lock+0x136/0xd70 [ 75.472769][ T5087] input_register_device+0xae5/0x1090 [ 75.478674][ T5087] uinput_create_device+0x40e/0x630 [ 75.484397][ T5087] uinput_ioctl_handler+0x48b/0x1770 [ 75.490210][ T5087] __se_sys_ioctl+0xfc/0x170 [ 75.495328][ T5087] do_syscall_64+0xf5/0x240 [ 75.500380][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.506798][ T5087] [ 75.506798][ T5087] -> #0 (&newdev->mutex){+.+.}-{3:3}: [ 75.514372][ T5087] validate_chain+0x18cb/0x58e0 [ 75.519754][ T5087] __lock_acquire+0x1346/0x1fd0 [ 75.525128][ T5087] lock_acquire+0x1ed/0x550 [ 75.530154][ T5087] __mutex_lock+0x136/0xd70 [ 75.535266][ T5087] uinput_request_submit+0x19c/0x740 [ 75.541078][ T5087] uinput_dev_upload_effect+0x199/0x240 [ 75.547151][ T5087] input_ff_upload+0x5df/0xb00 [ 75.552442][ T5087] evdev_ioctl_handler+0x17d0/0x21b0 [ 75.558251][ T5087] __se_sys_ioctl+0xfc/0x170 [ 75.563371][ T5087] do_syscall_64+0xf5/0x240 [ 75.568504][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.574925][ T5087] [ 75.574925][ T5087] other info that might help us debug this: [ 75.574925][ T5087] [ 75.585252][ T5087] Chain exists of: [ 75.585252][ T5087] &newdev->mutex --> &dev->mutex#2 --> &ff->mutex [ 75.585252][ T5087] [ 75.597642][ T5087] Possible unsafe locking scenario: [ 75.597642][ T5087] [ 75.605092][ T5087] CPU0 CPU1 [ 75.610471][ T5087] ---- ---- [ 75.615832][ T5087] lock(&ff->mutex); [ 75.619819][ T5087] lock(&dev->mutex#2); [ 75.626591][ T5087] lock(&ff->mutex); [ 75.633134][ T5087] lock(&newdev->mutex); [ 75.637469][ T5087] [ 75.637469][ T5087] *** DEADLOCK *** [ 75.637469][ T5087] [ 75.645609][ T5087] 2 locks held by syz-executor409/5087: [ 75.651153][ T5087] #0: ffff88801f9c0110 (&evdev->mutex){+.+.}-{3:3}, at: evdev_ioctl_handler+0x125/0x21b0 [ 75.661091][ T5087] #1: ffff888022fe00b0 (&ff->mutex){+.+.}-{3:3}, at: input_ff_upload+0x3e4/0xb00 [ 75.670339][ T5087] [ 75.670339][ T5087] stack backtrace: [ 75.676229][ T5087] CPU: 0 PID: 5087 Comm: syz-executor409 Not tainted 6.9.0-rc6-syzkaller-00227-g3d25a941ea50 #0 [ 75.686652][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 75.696713][ T5087] Call Trace: [ 75.699997][ T5087] [ 75.702933][ T5087] dump_stack_lvl+0x241/0x360 [ 75.707719][ T5087] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.712952][ T5087] ? print_circular_bug+0x130/0x1a0 [ 75.718253][ T5087] check_noncircular+0x36a/0x4a0 [ 75.723212][ T5087] ? __pfx_check_noncircular+0x10/0x10 [ 75.728716][ T5087] ? lockdep_lock+0x123/0x2b0 [ 75.733411][ T5087] ? stack_trace_save+0x118/0x1d0 [ 75.738537][ T5087] ? __pfx_stack_trace_save+0x10/0x10 [ 75.743922][ T5087] ? _find_first_zero_bit+0xd4/0x100 [ 75.749229][ T5087] validate_chain+0x18cb/0x58e0 [ 75.754108][ T5087] ? validate_chain+0x15a2/0x58e0 [ 75.759162][ T5087] ? __pfx_validate_chain+0x10/0x10 [ 75.764402][ T5087] ? __pfx_validate_chain+0x10/0x10 [ 75.769639][ T5087] ? stack_trace_save+0x118/0x1d0 [ 75.774689][ T5087] ? __pfx_stack_trace_save+0x10/0x10 [ 75.780075][ T5087] ? mark_lock+0x9a/0x350 [ 75.784415][ T5087] __lock_acquire+0x1346/0x1fd0 [ 75.789284][ T5087] lock_acquire+0x1ed/0x550 [ 75.793798][ T5087] ? uinput_request_submit+0x19c/0x740 [ 75.799268][ T5087] ? __pfx_lock_acquire+0x10/0x10 [ 75.804296][ T5087] ? __pfx___might_resched+0x10/0x10 [ 75.809685][ T5087] __mutex_lock+0x136/0xd70 [ 75.814192][ T5087] ? uinput_request_submit+0x19c/0x740 [ 75.819684][ T5087] ? uinput_request_alloc_id+0x3c5/0x3f0 [ 75.825341][ T5087] ? do_raw_spin_lock+0x14f/0x370 [ 75.830378][ T5087] ? __pfx_lock_release+0x10/0x10 [ 75.835406][ T5087] ? uinput_request_submit+0x19c/0x740 [ 75.840875][ T5087] ? __pfx___mutex_lock+0x10/0x10 [ 75.845911][ T5087] ? _raw_spin_unlock+0x28/0x50 [ 75.850779][ T5087] ? uinput_request_alloc_id+0x3c5/0x3f0 [ 75.856420][ T5087] uinput_request_submit+0x19c/0x740 [ 75.861718][ T5087] ? __pfx_uinput_request_submit+0x10/0x10 [ 75.867532][ T5087] ? __pfx___mutex_trylock_common+0x10/0x10 [ 75.873440][ T5087] ? rcu_is_watching+0x15/0xb0 [ 75.878215][ T5087] uinput_dev_upload_effect+0x199/0x240 [ 75.883770][ T5087] ? __pfx_uinput_dev_upload_effect+0x10/0x10 [ 75.889856][ T5087] input_ff_upload+0x5df/0xb00 [ 75.894641][ T5087] evdev_ioctl_handler+0x17d0/0x21b0 [ 75.900729][ T5087] ? tomoyo_path_number_perm+0x208/0x880 [ 75.906377][ T5087] ? __pfx_evdev_ioctl_handler+0x10/0x10 [ 75.912048][ T5087] ? __pfx_ptrace_notify+0x10/0x10 [ 75.917167][ T5087] ? bpf_lsm_file_ioctl+0x9/0x10 [ 75.922119][ T5087] ? security_file_ioctl+0x87/0xb0 [ 75.927240][ T5087] ? __pfx_evdev_ioctl+0x10/0x10 [ 75.932181][ T5087] __se_sys_ioctl+0xfc/0x170 [ 75.936808][ T5087] do_syscall_64+0xf5/0x240 [ 75.941342][ T5087] ? clear_bhb_loop+0x35/0x90 [ 75.946027][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.951953][ T5087] RIP: 0033:0x7fb80067b629 [ 75.956484][ T5087] Code: 48 83 c4 28 c3 e8 27 18 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 75.976113][ T5087] RSP: 002b:00007ffe3da98dd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 75.984537][ T5087] RAX: ffffffffffffffda RBX: 00007fb8006c4085 RCX: 00007fb80067b629 [ 75.992600][ T5087] RDX: 0000000020000300 RSI: 0000000040304580 RDI: 0000000000000004 [ 76.000579][ T5087] RBP: 00007ffe3da98df0 R08: 00007ffe3da98e50 R09: 00007ffe3da98e50 [ 76.008583][ T5087] R10: 000000000000001f R11: 0000000000000246 R12: 00007fb8006ee5f0 [ 76.016559][ T5087] R13: 00007ffe3da98fd8 R14: 0000000000000001 R15: 0000000000000001 [ 76.024544][ T5087]