======================================================== WARNING: possible irq lock inversion dependency detected 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Not tainted -------------------------------------------------------- syz.2.2542/14329 just changed the state of lock: ffff88805f8cb230 (&dev->event_lock#2){..-.}-{2:2}, at: input_inject_event+0xa4/0x370 drivers/input/input.c:423 but this lock took another, SOFTIRQ-READ-unsafe lock in the past: (tasklist_lock){.+.+}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &dev->event_lock#2 --> &client->buffer_lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock#2); lock(&client->buffer_lock); lock(&dev->event_lock#2); *** DEADLOCK *** 3 locks held by syz.2.2542/14329: #0: ffff8880656600a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_cqring_do_overflow_flush io_uring/io_uring.c:673 [inline] #0: ffff8880656600a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_cqring_wait+0x1336/0x16f0 io_uring/io_uring.c:2620 #1: ffffc90000007cb0 (drivers/tty/vt/keyboard.c:274){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x610 kernel/time/timer.c:1791 #2: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #2: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ddb7800 (rcu_read_lock){....}-{1:2}, at: input_handler_for_each_handle+0x3e/0x250 drivers/input/input.c:2673 the shortest dependencies between 2nd lock and 1st lock: -> (tasklist_lock){.+.+}-{2:2} { HARDIRQ-ON-R at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1648 do_wait+0x219/0x570 kernel/exit.c:1692 kernel_wait+0xa0/0x160 kernel/exit.c:1868 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 SOFTIRQ-ON-R at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1648 do_wait+0x219/0x570 kernel/exit.c:1692 kernel_wait+0xa0/0x160 kernel/exit.c:1868 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INITIAL USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 copy_process+0x472a/0x6ee0 kernel/fork.c:2500 kernel_clone+0xfd/0x960 kernel/fork.c:2784 user_mode_thread+0xb4/0xf0 kernel/fork.c:2862 rest_init+0x23/0x2b0 init/main.c:712 start_kernel+0x3e4/0x4d0 init/main.c:1105 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 INITIAL READ USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x105/0x890 kernel/exit.c:1648 do_wait+0x219/0x570 kernel/exit.c:1692 kernel_wait+0xa0/0x160 kernel/exit.c:1868 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xf1/0x170 kernel/umh.c:164 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] tasklist_lock+0x18/0x40 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 send_sigio+0xb8/0x3e0 fs/fcntl.c:924 kill_fasync_rcu fs/fcntl.c:1136 [inline] kill_fasync fs/fcntl.c:1151 [inline] kill_fasync+0x21a/0x520 fs/fcntl.c:1144 lease_break_callback+0x23/0x30 fs/locks.c:558 __break_lease+0x67c/0x17d0 fs/locks.c:1592 break_lease include/linux/filelock.h:436 [inline] vfs_truncate+0x32e/0x4e0 fs/open.c:105 do_sys_truncate fs/open.c:134 [inline] __do_compat_sys_truncate fs/open.c:152 [inline] __se_compat_sys_truncate fs/open.c:150 [inline] __ia32_compat_sys_truncate+0x173/0x1e0 fs/open.c:150 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> (&f_owner->lock){....}-{2:2} { INITIAL USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 __f_setown+0x67/0x3c0 fs/fcntl.c:137 f_setown+0x122/0x290 fs/fcntl.c:184 do_fcntl+0xf44/0x1510 fs/fcntl.c:510 do_compat_fcntl64+0x35f/0x6b0 fs/fcntl.c:790 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e INITIAL READ USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock_irq include/linux/rwlock_api_smp.h:169 [inline] _raw_read_lock_irq+0x67/0x80 kernel/locking/spinlock.c:244 f_getown_ex fs/fcntl.c:271 [inline] do_fcntl+0x45b/0x1510 fs/fcntl.c:513 do_compat_fcntl64+0x35f/0x6b0 fs/fcntl.c:790 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e } ... key at: [] __key.1+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x31/0x3e0 fs/fcntl.c:910 kill_fasync_rcu fs/fcntl.c:1136 [inline] kill_fasync fs/fcntl.c:1151 [inline] kill_fasync+0x21a/0x520 fs/fcntl.c:1144 lease_break_callback+0x23/0x30 fs/locks.c:558 __break_lease+0x67c/0x17d0 fs/locks.c:1592 break_lease include/linux/filelock.h:436 [inline] vfs_truncate+0x32e/0x4e0 fs/open.c:105 do_sys_truncate fs/open.c:134 [inline] __do_compat_sys_truncate fs/open.c:152 [inline] __se_compat_sys_truncate fs/open.c:150 [inline] __ia32_compat_sys_truncate+0x173/0x1e0 fs/open.c:150 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> (&new->fa_lock){....}-{2:2} { INITIAL USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 fasync_remove_entry+0xb9/0x1e0 fs/fcntl.c:1004 fasync_helper+0xaf/0xd0 fs/fcntl.c:1107 sock_fasync+0x92/0x140 net/socket.c:1451 __fput+0x958/0xb60 fs/file_table.c:428 task_work_run+0x14e/0x250 kernel/task_work.c:228 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 __do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e INITIAL READ USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1127 [inline] kill_fasync fs/fcntl.c:1151 [inline] kill_fasync+0x138/0x520 fs/fcntl.c:1144 lease_break_callback+0x23/0x30 fs/locks.c:558 __break_lease+0x67c/0x17d0 fs/locks.c:1592 break_lease include/linux/filelock.h:436 [inline] vfs_truncate+0x32e/0x4e0 fs/open.c:105 do_sys_truncate fs/open.c:134 [inline] __do_compat_sys_truncate fs/open.c:152 [inline] __se_compat_sys_truncate fs/open.c:150 [inline] __ia32_compat_sys_truncate+0x173/0x1e0 fs/open.c:150 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e } ... key at: [] __key.0+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1127 [inline] kill_fasync fs/fcntl.c:1151 [inline] kill_fasync+0x138/0x520 fs/fcntl.c:1144 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x619/0x9b0 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x44f/0x750 drivers/input/evdev.c:528 vfs_write+0x28e/0x1140 fs/read_write.c:681 ksys_write+0x1fa/0x260 fs/read_write.c:736 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> (&client->buffer_lock){....}-{2:2} { INITIAL USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] evdev_fetch_next_event drivers/input/evdev.c:543 [inline] evdev_read+0x439/0xde0 drivers/input/evdev.c:584 do_loop_readv_writev fs/read_write.c:854 [inline] do_loop_readv_writev fs/read_write.c:842 [inline] vfs_readv+0x6bf/0x890 fs/read_write.c:1027 do_readv+0x289/0x370 fs/read_write.c:1087 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e } ... key at: [] __key.1+0x0/0x40 ... acquired at: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] evdev_pass_values+0x10e/0x9b0 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x777/0x8e0 drivers/input/input.c:126 input_event_dispose drivers/input/input.c:341 [inline] input_handle_event+0xf0b/0x14d0 drivers/input/input.c:369 input_inject_event+0x1bb/0x370 drivers/input/input.c:428 evdev_write+0x44f/0x750 drivers/input/evdev.c:528 vfs_write+0x28e/0x1140 fs/read_write.c:681 ksys_write+0x1fa/0x260 fs/read_write.c:736 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> (&dev->event_lock#2){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_inject_event+0xa4/0x370 drivers/input/input.c:423 kd_sound_helper+0x20f/0x280 drivers/tty/vt/keyboard.c:261 input_handler_for_each_handle+0xd4/0x250 drivers/input/input.c:2676 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers+0x6e8/0x930 kernel/time/timer.c:2419 __run_timer_base kernel/time/timer.c:2430 [inline] __run_timer_base kernel/time/timer.c:2423 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2439 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1037 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 get_current arch/x86/include/asm/current.h:49 [inline] finish_task_switch.isra.0+0x220/0xcc0 kernel/sched/core.c:5189 context_switch kernel/sched/core.c:5318 [inline] __schedule+0xefd/0x5750 kernel/sched/core.c:6675 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6854 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] io_cq_unlock_post+0x9c/0x190 io_uring/io_uring.c:608 __io_cqring_overflow_flush+0x49a/0x660 io_uring/io_uring.c:662 io_cqring_do_overflow_flush io_uring/io_uring.c:674 [inline] io_cqring_wait+0x1340/0x16f0 io_uring/io_uring.c:2620 __do_sys_io_uring_enter+0x44c/0x1170 io_uring/io_uring.c:3387 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e INITIAL USE at: lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_inject_event+0xa4/0x370 drivers/input/input.c:423 __led_set_brightness drivers/leds/led-core.c:52 [inline] led_set_brightness_nopm drivers/leds/led-core.c:323 [inline] led_set_brightness_nosleep drivers/leds/led-core.c:354 [inline] led_set_brightness+0x211/0x290 drivers/leds/led-core.c:316 kbd_led_trigger_activate+0xcb/0x110 drivers/tty/vt/keyboard.c:1036 led_trigger_set+0x59a/0xc60 drivers/leds/led-triggers.c:212 led_match_default_trigger drivers/leds/led-triggers.c:269 [inline] led_match_default_trigger drivers/leds/led-triggers.c:263 [inline] led_trigger_set_default drivers/leds/led-triggers.c:287 [inline] led_trigger_set_default+0x1bd/0x2a0 drivers/leds/led-triggers.c:276 led_classdev_register_ext+0x675/0x940 drivers/leds/led-class.c:555 led_classdev_register include/linux/leds.h:273 [inline] input_leds_connect+0x552/0x8e0 drivers/input/input-leds.c:145 input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:1027 input_register_device+0xa14/0x10e0 drivers/input/input.c:2470 atkbd_connect+0x5e2/0xa20 drivers/input/keyboard/atkbd.c:1340 serio_connect_driver drivers/input/serio/serio.c:44 [inline] serio_driver_probe+0x74/0xa0 drivers/input/serio/serio.c:775 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x23e/0xa90 drivers/base/dd.c:658 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:800 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830 __driver_attach+0x283/0x580 drivers/base/dd.c:1216 bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:370 serio_attach_driver drivers/input/serio/serio.c:804 [inline] serio_handle_event+0x2bb/0xa90 drivers/input/serio/serio.c:224 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] __key.7+0x0/0x40 ... acquired at: mark_usage kernel/locking/lockdep.c:4614 [inline] __lock_acquire+0x11e1/0x3ce0 kernel/locking/lockdep.c:5156 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_inject_event+0xa4/0x370 drivers/input/input.c:423 kd_sound_helper+0x20f/0x280 drivers/tty/vt/keyboard.c:261 input_handler_for_each_handle+0xd4/0x250 drivers/input/input.c:2676 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers+0x6e8/0x930 kernel/time/timer.c:2419 __run_timer_base kernel/time/timer.c:2430 [inline] __run_timer_base kernel/time/timer.c:2423 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2439 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1037 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 get_current arch/x86/include/asm/current.h:49 [inline] finish_task_switch.isra.0+0x220/0xcc0 kernel/sched/core.c:5189 context_switch kernel/sched/core.c:5318 [inline] __schedule+0xefd/0x5750 kernel/sched/core.c:6675 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6854 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] io_cq_unlock_post+0x9c/0x190 io_uring/io_uring.c:608 __io_cqring_overflow_flush+0x49a/0x660 io_uring/io_uring.c:662 io_cqring_do_overflow_flush io_uring/io_uring.c:674 [inline] io_cqring_wait+0x1340/0x16f0 io_uring/io_uring.c:2620 __do_sys_io_uring_enter+0x44c/0x1170 io_uring/io_uring.c:3387 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e stack backtrace: CPU: 0 UID: 0 PID: 14329 Comm: syz.2.2542 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_irq_inversion_bug.part.0+0x3ee/0x5a0 kernel/locking/lockdep.c:4121 print_irq_inversion_bug kernel/locking/lockdep.c:4072 [inline] check_usage_forwards kernel/locking/lockdep.c:4154 [inline] mark_lock_irq kernel/locking/lockdep.c:4290 [inline] mark_lock+0x574/0xc60 kernel/locking/lockdep.c:4725 mark_usage kernel/locking/lockdep.c:4614 [inline] __lock_acquire+0x11e1/0x3ce0 kernel/locking/lockdep.c:5156 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 input_inject_event+0xa4/0x370 drivers/input/input.c:423 kd_sound_helper+0x20f/0x280 drivers/tty/vt/keyboard.c:261 input_handler_for_each_handle+0xd4/0x250 drivers/input/input.c:2676 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers+0x6e8/0x930 kernel/time/timer.c:2419 __run_timer_base kernel/time/timer.c:2430 [inline] __run_timer_base kernel/time/timer.c:2423 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2439 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1037 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:finish_task_switch.isra.0+0x220/0xcc0 kernel/sched/core.c:5189 Code: a9 0a 00 00 44 8b 0d f7 a1 c0 0e 45 85 c9 0f 85 c0 01 00 00 48 89 df e8 ae f8 ff ff e8 b9 fc 37 00 fb 65 48 8b 1d 20 79 a7 7e <48> 8d bb f8 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 RSP: 0018:ffffc90007f1f8a0 EFLAGS: 00000202 RAX: 0000000000f17b37 RBX: ffff88800091c880 RCX: 1ffffffff2d40221 RDX: 0000000000000000 RSI: ffffffff8b4cc8e0 RDI: ffffffff8bb123a0 RBP: ffffc90007f1f8e8 R08: 0000000000000001 R09: fffffbfff2d315ad R10: ffffffff9698ad6f R11: 0000000000000000 R12: ffff88802b43fca0 R13: ffffffff8da957c0 R14: ffff888029a54280 R15: ffff88802b43ee80 context_switch kernel/sched/core.c:5318 [inline] __schedule+0xefd/0x5750 kernel/sched/core.c:6675 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6854 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] io_cq_unlock_post+0x9c/0x190 io_uring/io_uring.c:608 __io_cqring_overflow_flush+0x49a/0x660 io_uring/io_uring.c:662 io_cqring_do_overflow_flush io_uring/io_uring.c:674 [inline] io_cqring_wait+0x1340/0x16f0 io_uring/io_uring.c:2620 __do_sys_io_uring_enter+0x44c/0x1170 io_uring/io_uring.c:3387 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f81579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f556456c EFLAGS: 00000296 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000400000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: a9 0a 00 00 44 test $0x4400000a,%eax 5: 8b 0d f7 a1 c0 0e mov 0xec0a1f7(%rip),%ecx # 0xec0a202 b: 45 85 c9 test %r9d,%r9d e: 0f 85 c0 01 00 00 jne 0x1d4 14: 48 89 df mov %rbx,%rdi 17: e8 ae f8 ff ff call 0xfffff8ca 1c: e8 b9 fc 37 00 call 0x37fcda 21: fb sti 22: 65 48 8b 1d 20 79 a7 mov %gs:0x7ea77920(%rip),%rbx # 0x7ea7794a 29: 7e * 2a: 48 8d bb f8 15 00 00 lea 0x15f8(%rbx),%rdi <-- trapping instruction 31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 38: fc ff df 3b: 48 89 fa mov %rdi,%rdx 3e: 48 rex.W 3f: c1 .byte 0xc1