======================================================== WARNING: possible irq lock inversion dependency detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted -------------------------------------------------------- syz-executor.0/5311 just changed the state of lock: ffff888029fab910 (&group->lock#2){..-.}-{2:2}, at: class_pcm_stream_lock_irqsave_constructor include/sound/pcm.h:669 [inline] ffff888029fab910 (&group->lock#2){..-.}-{2:2}, at: snd_pcm_period_elapsed+0x21/0x50 sound/core/pcm_lib.c:1904 but this lock took another, SOFTIRQ-unsafe lock in the past: (&timer->lock){+.+.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&timer->lock); local_irq_disable(); lock(&group->lock#2); lock(&timer->lock); lock(&group->lock#2); *** DEADLOCK *** 1 lock held by syz-executor.0/5311: #0: ffff88805aa036a0 (&sb->s_type->i_lock_key){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #0: ffff88805aa036a0 (&sb->s_type->i_lock_key){+.+.}-{2:2}, at: filemap_remove_folio+0xf3/0x2e0 mm/filemap.c:262 the shortest dependencies between 2nd lock and 1st lock: -> (&timer->lock){+.+.}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:561 [inline] snd_timer_close_locked+0x53/0x8d0 sound/core/timer.c:412 snd_timer_close+0xae/0x130 sound/core/timer.c:464 snd_seq_timer_close+0xa9/0xe0 sound/core/seq/seq_timer.c:302 queue_delete sound/core/seq/seq_queue.c:126 [inline] snd_seq_queue_delete+0x8f/0xf0 sound/core/seq/seq_queue.c:188 delete_seq_queue sound/core/seq/oss/seq_oss_init.c:371 [inline] snd_seq_oss_release+0x1d3/0x310 sound/core/seq/oss/seq_oss_init.c:416 odev_release+0x56/0x80 sound/core/seq/oss/seq_oss.c:144 __fput+0x429/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 SOFTIRQ-ON-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:561 [inline] snd_timer_close_locked+0x53/0x8d0 sound/core/timer.c:412 snd_timer_close+0xae/0x130 sound/core/timer.c:464 snd_seq_timer_close+0xa9/0xe0 sound/core/seq/seq_timer.c:302 queue_delete sound/core/seq/seq_queue.c:126 [inline] snd_seq_queue_delete+0x8f/0xf0 sound/core/seq/seq_queue.c:188 delete_seq_queue sound/core/seq/oss/seq_oss_init.c:371 [inline] snd_seq_oss_release+0x1d3/0x310 sound/core/seq/oss/seq_oss_init.c:416 odev_release+0x56/0x80 sound/core/seq/oss/seq_oss.c:144 __fput+0x429/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] class_spinlock_constructor include/linux/spinlock.h:561 [inline] snd_timer_close_locked+0x53/0x8d0 sound/core/timer.c:412 snd_timer_close+0xae/0x130 sound/core/timer.c:464 snd_seq_timer_close+0xa9/0xe0 sound/core/seq/seq_timer.c:302 queue_delete sound/core/seq/seq_queue.c:126 [inline] snd_seq_queue_delete+0x8f/0xf0 sound/core/seq/seq_queue.c:188 delete_seq_queue sound/core/seq/oss/seq_oss_init.c:371 [inline] snd_seq_oss_release+0x1d3/0x310 sound/core/seq/oss/seq_oss_init.c:416 odev_release+0x56/0x80 sound/core/seq/oss/seq_oss.c:144 __fput+0x429/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] snd_timer_new.__key+0x0/0x20 ... acquired at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_spinlock_irqsave_constructor include/linux/spinlock.h:574 [inline] snd_timer_notify+0x103/0x3d0 sound/core/timer.c:1040 snd_pcm_action sound/core/pcm_native.c:1370 [inline] snd_pcm_start+0x3fa/0x4c0 sound/core/pcm_native.c:1478 __snd_pcm_lib_xfer+0x1af3/0x1e30 sound/core/pcm_lib.c:2301 snd_pcm_oss_read3+0x3ea/0x600 sound/core/oss/pcm_oss.c:1281 snd_pcm_plug_read_transfer+0x3a1/0x470 sound/core/oss/pcm_plugin.c:663 snd_pcm_oss_read2+0x296/0x430 sound/core/oss/pcm_oss.c:1482 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1520 [inline] snd_pcm_oss_read+0x45b/0x940 sound/core/oss/pcm_oss.c:2773 do_loop_readv_writev fs/read_write.c:761 [inline] vfs_readv+0x68f/0xa50 fs/read_write.c:934 do_readv+0x1b1/0x350 fs/read_write.c:994 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 -> (&group->lock#2){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_pcm_stream_lock_irqsave_constructor include/sound/pcm.h:669 [inline] snd_pcm_period_elapsed+0x21/0x50 sound/core/pcm_lib.c:1904 dummy_hrtimer_callback+0x7f/0x180 sound/drivers/dummy.c:385 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1773 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202 spin_unlock_irq include/linux/spinlock.h:401 [inline] filemap_remove_folio+0x111/0x2e0 mm/filemap.c:265 truncate_inode_folio+0x5d/0x70 mm/truncate.c:195 shmem_undo_range+0x439/0x1da0 mm/shmem.c:1007 shmem_truncate_range mm/shmem.c:1120 [inline] shmem_evict_inode+0x29b/0xa60 mm/shmem.c:1248 evict+0x2a8/0x630 fs/inode.c:667 __dentry_kill+0x20d/0x630 fs/dcache.c:603 dput+0x19f/0x2b0 fs/dcache.c:845 __fput+0x678/0x8a0 fs/file_table.c:430 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 INITIAL USE at: lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] snd_pcm_group_lock_irq sound/core/pcm_native.c:97 [inline] snd_pcm_stream_lock_irq sound/core/pcm_native.c:136 [inline] class_pcm_stream_lock_irq_constructor include/sound/pcm.h:666 [inline] snd_pcm_hw_params+0x201/0x1ea0 sound/core/pcm_native.c:740 snd_pcm_oss_change_params_locked+0x20d5/0x3e00 sound/core/oss/pcm_oss.c:965 snd_pcm_oss_make_ready_locked sound/core/oss/pcm_oss.c:1187 [inline] snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1515 [inline] snd_pcm_oss_read+0x24c/0x940 sound/core/oss/pcm_oss.c:2773 do_loop_readv_writev fs/read_write.c:761 [inline] vfs_readv+0x68f/0xa50 fs/read_write.c:934 do_readv+0x1b1/0x350 fs/read_write.c:994 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 } ... key at: [] snd_pcm_group_init.__key+0x0/0x20 ... acquired at: mark_lock+0x223/0x350 kernel/locking/lockdep.c:4678 __lock_acquire+0xbcd/0x1fd0 kernel/locking/lockdep.c:5091 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_pcm_stream_lock_irqsave_constructor include/sound/pcm.h:669 [inline] snd_pcm_period_elapsed+0x21/0x50 sound/core/pcm_lib.c:1904 dummy_hrtimer_callback+0x7f/0x180 sound/drivers/dummy.c:385 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1773 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202 spin_unlock_irq include/linux/spinlock.h:401 [inline] filemap_remove_folio+0x111/0x2e0 mm/filemap.c:265 truncate_inode_folio+0x5d/0x70 mm/truncate.c:195 shmem_undo_range+0x439/0x1da0 mm/shmem.c:1007 shmem_truncate_range mm/shmem.c:1120 [inline] shmem_evict_inode+0x29b/0xa60 mm/shmem.c:1248 evict+0x2a8/0x630 fs/inode.c:667 __dentry_kill+0x20d/0x630 fs/dcache.c:603 dput+0x19f/0x2b0 fs/dcache.c:845 __fput+0x678/0x8a0 fs/file_table.c:430 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 stack backtrace: CPU: 0 PID: 5311 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 mark_lock_irq+0x80c/0xc20 kernel/locking/lockdep.c:4243 mark_lock+0x223/0x350 kernel/locking/lockdep.c:4678 __lock_acquire+0xbcd/0x1fd0 kernel/locking/lockdep.c:5091 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_pcm_stream_lock_irqsave_constructor include/sound/pcm.h:669 [inline] snd_pcm_period_elapsed+0x21/0x50 sound/core/pcm_lib.c:1904 dummy_hrtimer_callback+0x7f/0x180 sound/drivers/dummy.c:385 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1773 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202 Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 da 67 fb f5 48 89 df e8 92 a7 fc f5 e8 fd cc 25 f6 fb bf 01 00 00 00 22 94 ee f5 65 8b 05 33 79 8d 74 85 c0 74 06 5b c3 cc cc cc cc RSP: 0018:ffffc90004ab7918 EFLAGS: 00000286 RAX: cdbe5ac7be0cde00 RBX: ffff88805aa03830 RCX: ffffffff81720b2a RDX: dffffc0000000000 RSI: ffffffff8baac1e0 RDI: 0000000000000001 RBP: 1ffff1100b540705 R08: ffffffff92cae517 R09: 1ffffffff2595ca2 R10: dffffc0000000000 R11: fffffbfff2595ca3 R12: 0000000000000007 R13: ffffc90004ab7a98 R14: ffffea00016935c0 R15: ffff88805aa03828 spin_unlock_irq include/linux/spinlock.h:401 [inline] filemap_remove_folio+0x111/0x2e0 mm/filemap.c:265 truncate_inode_folio+0x5d/0x70 mm/truncate.c:195 shmem_undo_range+0x439/0x1da0 mm/shmem.c:1007 shmem_truncate_range mm/shmem.c:1120 [inline] shmem_evict_inode+0x29b/0xa60 mm/shmem.c:1248 evict+0x2a8/0x630 fs/inode.c:667 __dentry_kill+0x20d/0x630 fs/dcache.c:603 dput+0x19f/0x2b0 fs/dcache.c:845 __fput+0x678/0x8a0 fs/file_table.c:430 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f785727cd5a Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 03 7f 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 63 7f 02 00 8b 44 24 RSP: 002b:00007f785808be90 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f785727cd5a RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000009600 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 00007f785808bf80 R14: 00007f785808bf40 R15: 00007f784d000000 ---------------- Code disassembly (best guess): 0: 90 nop 1: f3 0f 1e fa endbr64 5: 53 push %rbx 6: 48 89 fb mov %rdi,%rbx 9: 48 83 c7 18 add $0x18,%rdi d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi 12: e8 da 67 fb f5 call 0xf5fb67f1 17: 48 89 df mov %rbx,%rdi 1a: e8 92 a7 fc f5 call 0xf5fca7b1 1f: e8 fd cc 25 f6 call 0xf625cd21 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 22 94 ee f5 call 0xf5ee9451 <-- trapping instruction 2f: 65 8b 05 33 79 8d 74 mov %gs:0x748d7933(%rip),%eax # 0x748d7969 36: 85 c0 test %eax,%eax 38: 74 06 je 0x40 3a: 5b pop %rbx 3b: c3 ret 3c: cc int3 3d: cc int3 3e: cc int3 3f: cc int3