./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4181375926 <...> Warning: Permanently added '10.128.0.178' (ED25519) to the list of known hosts. execve("./syz-executor4181375926", ["./syz-executor4181375926"], 0x7ffe4eb40ee0 /* 10 vars */) = 0 brk(NULL) = 0x5555712ab000 brk(0x5555712abd00) = 0x5555712abd00 arch_prctl(ARCH_SET_FS, 0x5555712ab380) = 0 set_tid_address(0x5555712ab650) = 5071 set_robust_list(0x5555712ab660, 24) = 0 rseq(0x5555712abca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4181375926", 4096) = 28 getrandom("\xba\x9c\x68\x3c\x06\xa4\x9e\xa1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555712abd00 brk(0x5555712ccd00) = 0x5555712ccd00 brk(0x5555712cd000) = 0x5555712cd000 mprotect(0x7f872d4f5000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/snd/seq", O_WRONLY|O_EXCL|O_NOCTTY|O_NOFOLLOW|O_NOATIME|FASYNC) = 3 ioctl(3, SNDRV_SEQ_IOCTL_CREATE_QUEUE, 0x200001c0) = 0 openat(AT_FDCWD, "/dev/audio", O_WRONLY|O_TRUNC|O_NOATIME) = 4 write(4, "\x00\x00\x00\x00\x83\xfd\x00\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 64956) = 64956 exit_group(0) = ? [ 85.584098][ T5071] [ 85.586460][ T5071] ================================ [ 85.591559][ T5071] WARNING: inconsistent lock state [ 85.596678][ T5071] 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted [ 85.603348][ T5071] -------------------------------- [ 85.608455][ T5071] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 85.615298][ T5071] syz-executor418/5071 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 85.622061][ T5071] ffff888029362148 (&timer->lock){+.?.}-{2:2}, at: snd_timer_close_locked+0x53/0x8d0 [ 85.631609][ T5071] {IN-SOFTIRQ-W} state was registered at: [ 85.637315][ T5071] lock_acquire+0x1e4/0x530 [ 85.641908][ T5071] _raw_spin_lock_irqsave+0xd5/0x120 [ 85.647292][ T5071] snd_timer_notify+0x103/0x3d0 [ 85.652241][ T5071] snd_pcm_drain_done+0x2b8/0x3e0 [ 85.657357][ T5071] snd_pcm_update_state+0x31b/0x410 [ 85.662649][ T5071] snd_pcm_update_hw_ptr0+0x1066/0x1a70 [ 85.668287][ T5071] snd_pcm_period_elapsed_under_stream_lock+0xeb/0x210 [ 85.675235][ T5071] snd_pcm_period_elapsed+0x2c/0x50 [ 85.680534][ T5071] dummy_hrtimer_callback+0x7f/0x180 [ 85.685909][ T5071] __hrtimer_run_queues+0x597/0xd00 [ 85.691198][ T5071] hrtimer_run_softirq+0x19a/0x2c0 [ 85.696401][ T5071] __do_softirq+0x2be/0x943 [ 85.700986][ T5071] __irq_exit_rcu+0xf2/0x1c0 [ 85.705661][ T5071] irq_exit_rcu+0x9/0x30 [ 85.709989][ T5071] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 85.715715][ T5071] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.721783][ T5071] acpi_safe_halt+0x21/0x30 [ 85.726369][ T5071] acpi_idle_enter+0xe4/0x140 [ 85.731124][ T5071] cpuidle_enter_state+0x11a/0x490 [ 85.736317][ T5071] cpuidle_enter+0x5d/0xa0 [ 85.740814][ T5071] do_idle+0x375/0x5d0 [ 85.744972][ T5071] cpu_startup_entry+0x42/0x60 [ 85.749824][ T5071] __pfx_ap_starting+0x0/0x10 [ 85.754635][ T5071] common_startup_64+0x13e/0x147 [ 85.759686][ T5071] irq event stamp: 5951 [ 85.763831][ T5071] hardirqs last enabled at (5951): [] _raw_spin_unlock_irq+0x23/0x50 [ 85.773568][ T5071] hardirqs last disabled at (5950): [] _raw_spin_lock_irq+0xad/0x120 [ 85.783216][ T5071] softirqs last enabled at (5924): [] __irq_exit_rcu+0xf2/0x1c0 [ 85.792641][ T5071] softirqs last disabled at (5913): [] __irq_exit_rcu+0xf2/0x1c0 [ 85.801951][ T5071] [ 85.801951][ T5071] other info that might help us debug this: [ 85.810007][ T5071] Possible unsafe locking scenario: [ 85.810007][ T5071] [ 85.817448][ T5071] CPU0 [ 85.820718][ T5071] ---- [ 85.823986][ T5071] lock(&timer->lock); [ 85.828144][ T5071] [ 85.831589][ T5071] lock(&timer->lock); [ 85.835920][ T5071] [ 85.835920][ T5071] *** DEADLOCK *** [ 85.835920][ T5071] [ 85.844052][ T5071] 3 locks held by syz-executor418/5071: [ 85.849675][ T5071] #0: ffffffff8f2e2ae8 (register_mutex#3){+.+.}-{3:3}, at: seq_free_client+0x27/0x180 [ 85.859350][ T5071] #1: ffff88802bf8dd78 (&q->timer_mutex){+.+.}-{3:3}, at: snd_seq_queue_client_leave+0x54/0x2b0 [ 85.869908][ T5071] #2: ffffffff8f2d3f68 (register_mutex){+.+.}-{3:3}, at: snd_timer_close+0xa3/0x130 [ 85.879408][ T5071] [ 85.879408][ T5071] stack backtrace: [ 85.885284][ T5071] CPU: 1 PID: 5071 Comm: syz-executor418 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 [ 85.895341][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 85.905394][ T5071] Call Trace: [ 85.908677][ T5071] [ 85.911599][ T5071] dump_stack_lvl+0x241/0x360 [ 85.916300][ T5071] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.921506][ T5071] ? srso_return_thunk+0x5/0x5f [ 85.926362][ T5071] ? srso_return_thunk+0x5/0x5f [ 85.931224][ T5071] ? print_usage_bug+0x61a/0x8a0 [ 85.936163][ T5071] ? is_bpf_text_address+0x28d/0x2b0 [ 85.941461][ T5071] valid_state+0x13a/0x1c0 [ 85.945881][ T5071] mark_lock_irq+0xbb/0xc20 [ 85.950396][ T5071] ? srso_return_thunk+0x5/0x5f [ 85.955249][ T5071] ? arch_stack_walk+0x16d/0x1b0 [ 85.960189][ T5071] ? __pfx_mark_lock_irq+0x10/0x10 [ 85.965305][ T5071] ? srso_return_thunk+0x5/0x5f [ 85.970158][ T5071] ? stack_trace_save+0x118/0x1d0 [ 85.975190][ T5071] ? __pfx_stack_trace_save+0x10/0x10 [ 85.980581][ T5071] ? srso_return_thunk+0x5/0x5f [ 85.985446][ T5071] ? srso_return_thunk+0x5/0x5f [ 85.990299][ T5071] ? save_trace+0x749/0xb40 [ 85.994814][ T5071] mark_lock+0x223/0x350 [ 85.999074][ T5071] __lock_acquire+0x116e/0x1fd0 [ 86.003945][ T5071] lock_acquire+0x1e4/0x530 [ 86.008450][ T5071] ? snd_timer_close_locked+0x53/0x8d0 [ 86.013934][ T5071] ? __pfx___mutex_trylock_common+0x10/0x10 [ 86.019842][ T5071] ? __pfx_lock_acquire+0x10/0x10 [ 86.024866][ T5071] ? rcu_is_watching+0x15/0xb0 [ 86.029632][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.034485][ T5071] ? trace_contention_end+0x3c/0x100 [ 86.039776][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.044629][ T5071] ? __mutex_lock+0x2ef/0xd70 [ 86.049326][ T5071] ? snd_timer_close+0xa3/0x130 [ 86.054278][ T5071] _raw_spin_lock+0x2e/0x40 [ 86.058793][ T5071] ? snd_timer_close_locked+0x53/0x8d0 [ 86.064263][ T5071] snd_timer_close_locked+0x53/0x8d0 [ 86.069570][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.074425][ T5071] ? mark_lock+0x9a/0x350 [ 86.078761][ T5071] snd_timer_close+0xae/0x130 [ 86.083448][ T5071] ? __pfx_snd_timer_close+0x10/0x10 [ 86.088748][ T5071] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.093957][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.098808][ T5071] ? lockdep_hardirqs_on+0x99/0x150 [ 86.104025][ T5071] snd_seq_timer_close+0xa9/0xe0 [ 86.108961][ T5071] snd_seq_queue_client_leave+0x7f/0x2b0 [ 86.114616][ T5071] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.119819][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.124673][ T5071] ? lockdep_hardirqs_on+0x99/0x150 [ 86.129893][ T5071] seq_free_client1+0xfe/0x2b0 [ 86.134661][ T5071] seq_free_client+0x6c/0x180 [ 86.139339][ T5071] snd_seq_release+0x48/0xc0 [ 86.143934][ T5071] ? __pfx_snd_seq_release+0x10/0x10 [ 86.149228][ T5071] __fput+0x42b/0x8a0 [ 86.153219][ T5071] task_work_run+0x251/0x310 [ 86.157824][ T5071] ? __pfx_task_work_run+0x10/0x10 [ 86.162949][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.167803][ T5071] ? switch_task_namespaces+0xe1/0x110 [ 86.173272][ T5071] do_exit+0xa1b/0x27e0 [ 86.177443][ T5071] ? __pfx_do_exit+0x10/0x10 [ 86.182038][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.186883][ T5071] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 86.192865][ T5071] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 86.199197][ T5071] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.204403][ T5071] ? srso_return_thunk+0x5/0x5f [ 86.209250][ T5071] ? lockdep_hardirqs_on+0x99/0x150 [ 86.214473][ T5071] do_group_exit+0x207/0x2c0 [ 86.219081][ T5071] __x64_sys_exit_group+0x3f/0x40 [ 86.224113][ T5071] do_syscall_64+0xfd/0x240 [ 86.228618][ T5071] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 86.234517][ T5071] RIP: 0033:0x7f872d480d79 [ 86.238922][ T5071] Code: Unable to access opcode bytes at 0x7f872d480d4f. [ 86.245942][ T5071] RSP: 002b:00007ffd0d431b48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 86.254372][ T5071] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f872d480d79 [ 86.262352][ T5071] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 86.270313][ T5071] RBP: 00007f872d4fb290 R08: ffffffffffffffb8 R09: 00007ffd0d431d68 [ 86.278280][ T5071] R10: 00007ffd0d431d68 R11: 0000000000000246 R12: 00007f872d4fb290 +++ exited with 0 +++ [ 86.286239]