./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1624026311 <...> Warning: Permanently added '10.128.1.77' (ED25519) to the list of known hosts. execve("./syz-executor1624026311", ["./syz-executor1624026311"], 0x7ffd123f7c10 /* 10 vars */) = 0 brk(NULL) = 0x555562012000 brk(0x555562012d00) = 0x555562012d00 arch_prctl(ARCH_SET_FS, 0x555562012380) = 0 set_tid_address(0x555562012650) = 5056 set_robust_list(0x555562012660, 24) = 0 rseq(0x555562012ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1624026311", 4096) = 28 getrandom("\x4b\x57\xde\x29\x6e\x4d\xce\x29", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555562012d00 brk(0x555562033d00) = 0x555562033d00 brk(0x555562034000) = 0x555562034000 mprotect(0x7fb96d2e1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/sequencer", O_RDWR|O_EXCL) = 3 openat(AT_FDCWD, "/dev/audio", O_RDWR|O_CREAT|O_NONBLOCK|O_SYNC|O_LARGEFILE, 000) = 4 write(4, "\xd1\xd6\x69\xc1\x0a\xb1\x0d\xe4\xd9\xf6\x67\xfc\x4a\x29\x9c\x79\x4e\x7d\x7f\x10\xe7\xbc\xd8\x21\xa5\x8b\x56\x32\x57\x99\x80\x27\x50\x0b\x36\xcc\x01\x3c\x52\x49\x3a\x88\x66\xd3\xe9\xc6\x47\xab\x77\x64\x72\x97\x02\x3c\xfc\xb4\x4f\x10\x93\x9f\x19\xab\xcb\x89\x8f\xa8\x9f\xf0\x6d\xc0\xbb\xd7\x4b\x64\x97\x82\x76\x05\x55\x66\xdb\x53\x46\x45\x7c\x5c\x66\xf2\x86\x06\xda\xd3\x7b\x63\x53\xa8", 96) = 96 exit_group(0) = ? [ 55.043498][ T5056] [ 55.045849][ T5056] ================================ [ 55.050931][ T5056] WARNING: inconsistent lock state [ 55.056009][ T5056] 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted [ 55.062653][ T5056] -------------------------------- [ 55.067730][ T5056] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 55.074551][ T5056] syz-executor162/5056 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 55.081721][ T5056] ffff888029a35148 (&timer->lock){+.?.}-{2:2}, at: snd_timer_close_locked+0x53/0x8d0 [ 55.091194][ T5056] {IN-SOFTIRQ-W} state was registered at: [ 55.096881][ T5056] lock_acquire+0x1e4/0x530 [ 55.101451][ T5056] _raw_spin_lock_irqsave+0xd5/0x120 [ 55.106808][ T5056] snd_timer_notify+0x103/0x3d0 [ 55.111723][ T5056] snd_pcm_drain_done+0x2b8/0x3e0 [ 55.116832][ T5056] snd_pcm_update_state+0x31b/0x410 [ 55.122115][ T5056] snd_pcm_update_hw_ptr0+0x1066/0x1a70 [ 55.127723][ T5056] snd_pcm_period_elapsed_under_stream_lock+0xeb/0x210 [ 55.134629][ T5056] snd_pcm_period_elapsed+0x2c/0x50 [ 55.139890][ T5056] dummy_hrtimer_callback+0x7f/0x180 [ 55.145240][ T5056] __hrtimer_run_queues+0x595/0xd00 [ 55.150503][ T5056] hrtimer_run_softirq+0x19a/0x2c0 [ 55.155678][ T5056] __do_softirq+0x2bc/0x943 [ 55.160242][ T5056] __irq_exit_rcu+0xf2/0x1c0 [ 55.164893][ T5056] irq_exit_rcu+0x9/0x30 [ 55.169197][ T5056] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 55.174910][ T5056] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 55.180969][ T5056] acpi_safe_halt+0x21/0x30 [ 55.185536][ T5056] acpi_idle_enter+0xe4/0x140 [ 55.190273][ T5056] cpuidle_enter_state+0x118/0x490 [ 55.195445][ T5056] cpuidle_enter+0x5d/0xa0 [ 55.199921][ T5056] do_idle+0x375/0x5d0 [ 55.204053][ T5056] cpu_startup_entry+0x42/0x60 [ 55.208875][ T5056] rest_init+0x2e0/0x300 [ 55.213182][ T5056] arch_call_rest_init+0xe/0x10 [ 55.218099][ T5056] start_kernel+0x47a/0x500 [ 55.222670][ T5056] x86_64_start_reservations+0x2a/0x30 [ 55.228193][ T5056] x86_64_start_kernel+0x99/0xa0 [ 55.233192][ T5056] common_startup_64+0x13e/0x147 [ 55.238194][ T5056] irq event stamp: 5823 [ 55.242319][ T5056] hardirqs last enabled at (5823): [] _raw_spin_unlock_irq+0x23/0x50 [ 55.252012][ T5056] hardirqs last disabled at (5822): [] _raw_spin_lock_irq+0xad/0x120 [ 55.261618][ T5056] softirqs last enabled at (4228): [] __irq_exit_rcu+0xf2/0x1c0 [ 55.270876][ T5056] softirqs last disabled at (4207): [] __irq_exit_rcu+0xf2/0x1c0 [ 55.280176][ T5056] [ 55.280176][ T5056] other info that might help us debug this: [ 55.288208][ T5056] Possible unsafe locking scenario: [ 55.288208][ T5056] [ 55.295628][ T5056] CPU0 [ 55.298883][ T5056] ---- [ 55.302136][ T5056] lock(&timer->lock); [ 55.306267][ T5056] [ 55.309698][ T5056] lock(&timer->lock); [ 55.314005][ T5056] [ 55.314005][ T5056] *** DEADLOCK *** [ 55.314005][ T5056] [ 55.322122][ T5056] 3 locks held by syz-executor162/5056: [ 55.327638][ T5056] #0: ffffffff8f2d3228 (register_mutex#4){+.+.}-{3:3}, at: odev_release+0x4e/0x80 [ 55.336939][ T5056] #1: ffff88801e1a1578 (&q->timer_mutex){+.+.}-{3:3}, at: snd_seq_queue_delete+0x5b/0xf0 [ 55.346827][ T5056] #2: ffffffff8f2c1a68 (register_mutex){+.+.}-{3:3}, at: snd_timer_close+0xa3/0x130 [ 55.356279][ T5056] [ 55.356279][ T5056] stack backtrace: [ 55.362154][ T5056] CPU: 0 PID: 5056 Comm: syz-executor162 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 [ 55.372203][ T5056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 55.382234][ T5056] Call Trace: [ 55.385494][ T5056] [ 55.388406][ T5056] dump_stack_lvl+0x241/0x360 [ 55.393059][ T5056] ? __pfx_dump_stack_lvl+0x10/0x10 [ 55.398236][ T5056] ? print_usage_bug+0x61a/0x8a0 [ 55.403151][ T5056] ? is_bpf_text_address+0x28d/0x2b0 [ 55.408415][ T5056] valid_state+0x13a/0x1c0 [ 55.412833][ T5056] mark_lock_irq+0xbb/0xc20 [ 55.417315][ T5056] ? arch_stack_walk+0x16d/0x1b0 [ 55.422228][ T5056] ? __pfx_mark_lock_irq+0x10/0x10 [ 55.427332][ T5056] ? stack_trace_save+0x118/0x1d0 [ 55.432336][ T5056] ? __pfx_stack_trace_save+0x10/0x10 [ 55.437688][ T5056] ? save_trace+0x749/0xb40 [ 55.442180][ T5056] mark_lock+0x223/0x350 [ 55.446399][ T5056] __lock_acquire+0x116e/0x1fd0 [ 55.451228][ T5056] lock_acquire+0x1e4/0x530 [ 55.455705][ T5056] ? snd_timer_close_locked+0x53/0x8d0 [ 55.461156][ T5056] ? __pfx___mutex_trylock_common+0x10/0x10 [ 55.467025][ T5056] ? __pfx_lock_acquire+0x10/0x10 [ 55.472022][ T5056] ? rcu_is_watching+0x15/0xb0 [ 55.476763][ T5056] ? trace_contention_end+0x3c/0x100 [ 55.482024][ T5056] ? __mutex_lock+0x2ef/0xd70 [ 55.486677][ T5056] ? snd_timer_close+0xa3/0x130 [ 55.491506][ T5056] _raw_spin_lock+0x2e/0x40 [ 55.495988][ T5056] ? snd_timer_close_locked+0x53/0x8d0 [ 55.501428][ T5056] snd_timer_close_locked+0x53/0x8d0 [ 55.506692][ T5056] snd_timer_close+0xae/0x130 [ 55.511349][ T5056] ? __pfx_snd_timer_close+0x10/0x10 [ 55.516614][ T5056] ? _raw_spin_unlock_irq+0x23/0x50 [ 55.521789][ T5056] ? lockdep_hardirqs_on+0x99/0x150 [ 55.526965][ T5056] snd_seq_timer_close+0xa9/0xe0 [ 55.531880][ T5056] snd_seq_queue_delete+0x8f/0xf0 [ 55.536882][ T5056] snd_seq_oss_release+0x1d3/0x310 [ 55.541971][ T5056] ? __pfx_snd_seq_oss_release+0x10/0x10 [ 55.547582][ T5056] ? __asan_memset+0x23/0x50 [ 55.552156][ T5056] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 55.558456][ T5056] ? evm_file_release+0x140/0x1d0 [ 55.563454][ T5056] ? __pfx_odev_release+0x10/0x10 [ 55.568452][ T5056] odev_release+0x56/0x80 [ 55.572759][ T5056] __fput+0x429/0x8a0 [ 55.576740][ T5056] task_work_run+0x24f/0x310 [ 55.581318][ T5056] ? __pfx_task_work_run+0x10/0x10 [ 55.586405][ T5056] ? switch_task_namespaces+0xe1/0x110 [ 55.591857][ T5056] do_exit+0xa1b/0x27e0 [ 55.596013][ T5056] ? __pfx_do_exit+0x10/0x10 [ 55.600593][ T5056] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 55.606557][ T5056] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 55.612874][ T5056] ? _raw_spin_unlock_irq+0x23/0x50 [ 55.618055][ T5056] ? lockdep_hardirqs_on+0x99/0x150 [ 55.623232][ T5056] do_group_exit+0x207/0x2c0 [ 55.627815][ T5056] __x64_sys_exit_group+0x3f/0x40 [ 55.632818][ T5056] do_syscall_64+0xfb/0x240 [ 55.637296][ T5056] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 55.643164][ T5056] RIP: 0033:0x7fb96d26ccf9 [ 55.647556][ T5056] Code: Unable to access opcode bytes at 0x7fb96d26cccf. [ 55.654559][ T5056] RSP: 002b:00007ffecd5463f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 55.662961][ T5056] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb96d26ccf9 [ 55.670923][ T5056] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 55.678877][ T5056] RBP: 00007fb96d2e7270 R08: ffffffffffffffb8 R09: 00007ffecd546618 [ 55.686835][ T5056] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb96d2e7270 +++ exited with 0 +++ [ 55.694789][ T50