===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 5.19.0-rc8-syzkaller-00102-g33ea1340bafe #0 Not tainted ----------------------------------------------------- syz-executor.3/6248 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffff88802575c6f8 (&card->ctl_files_rwlock){....}-{2:2}, at: snd_ctl_notify.part.0+0x36/0x560 sound/core/control.c:159 and this task is already holding: ffff888025727910 (&group->lock){..-.}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:374 [inline] ffff888025727910 (&group->lock){..-.}-{2:2}, at: snd_pcm_group_lock_irq sound/core/pcm_native.c:97 [inline] ffff888025727910 (&group->lock){..-.}-{2:2}, at: snd_pcm_stream_lock_irq+0x8e/0xb0 sound/core/pcm_native.c:136 which would create a new lock dependency: (&group->lock){..-.}-{2:2} -> (&card->ctl_files_rwlock){....}-{2:2} but this new dependency connects a SOFTIRQ-irq-safe lock: (&group->lock){..-.}-{2:2} ... which became SOFTIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 snd_pcm_period_elapsed+0x1d/0x50 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 get_current arch/x86/include/asm/current.h:15 [inline] finish_task_switch.isra.0+0x2b9/0xbb0 kernel/sched/core.c:5026 context_switch kernel/sched/core.c:5149 [inline] __schedule+0xa08/0x4b50 kernel/sched/core.c:6458 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6623 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x3c/0x40 kernel/locking/spinlock.c:202 spin_unlock_irq include/linux/spinlock.h:399 [inline] snd_rawmidi_write+0x471/0xb90 sound/core/rawmidi.c:1541 vfs_write+0x269/0xac0 fs/read_write.c:589 ksys_write+0x1e8/0x250 fs/read_write.c:644 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 to a SOFTIRQ-irq-unsafe lock: (tasklist_lock){.+.+}-{2:2} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 other info that might help us debug this: Chain exists of: &group->lock --> &card->ctl_files_rwlock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&group->lock); lock(&card->ctl_files_rwlock); lock(&group->lock); *** DEADLOCK *** 1 lock held by syz-executor.3/6248: #0: ffff888025727910 (&group->lock){..-.}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:374 [inline] #0: ffff888025727910 (&group->lock){..-.}-{2:2}, at: snd_pcm_group_lock_irq sound/core/pcm_native.c:97 [inline] #0: ffff888025727910 (&group->lock){..-.}-{2:2}, at: snd_pcm_stream_lock_irq+0x8e/0xb0 sound/core/pcm_native.c:136 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (&group->lock){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 snd_pcm_period_elapsed+0x1d/0x50 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 get_current arch/x86/include/asm/current.h:15 [inline] finish_task_switch.isra.0+0x2b9/0xbb0 kernel/sched/core.c:5026 context_switch kernel/sched/core.c:5149 [inline] __schedule+0xa08/0x4b50 kernel/sched/core.c:6458 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6623 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x3c/0x40 kernel/locking/spinlock.c:202 spin_unlock_irq include/linux/spinlock.h:399 [inline] snd_rawmidi_write+0x471/0xb90 sound/core/rawmidi.c:1541 vfs_write+0x269/0xac0 fs/read_write.c:589 ksys_write+0x1e8/0x250 fs/read_write.c:644 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0x32/0x50 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:374 [inline] snd_pcm_group_lock_irq sound/core/pcm_native.c:97 [inline] snd_pcm_stream_lock_irq+0x8e/0xb0 sound/core/pcm_native.c:136 snd_pcm_oss_poll+0x2c3/0xb10 sound/core/oss/pcm_oss.c:2867 vfs_poll include/linux/poll.h:88 [inline] do_select+0x996/0x16a0 fs/select.c:538 compat_core_sys_select+0x61b/0x820 fs/select.c:1243 do_compat_pselect+0x1d3/0x210 fs/select.c:1344 __do_compat_sys_pselect6_time32 fs/select.c:1392 [inline] __se_compat_sys_pselect6_time32 fs/select.c:1383 [inline] __ia32_compat_sys_pselect6_time32+0x1d5/0x310 fs/select.c:1383 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 } ... key at: [] __key.8+0x0/0x40 the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (tasklist_lock){.+.+}-{2:2} { HARDIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 SOFTIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326 copy_process+0x445e/0x7020 kernel/fork.c:2374 kernel_clone+0xe7/0xab0 kernel/fork.c:2655 user_mode_thread+0xad/0xe0 kernel/fork.c:2724 rest_init+0x23/0x270 init/main.c:691 arch_call_rest_init+0xf/0x14 init/main.c:882 start_kernel+0x46e/0x48f init/main.c:1137 secondary_startup_64_no_verify+0xce/0xdb INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 } ... key at: [] tasklist_lock+0x18/0x40 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 send_sigio+0xab/0x380 fs/fcntl.c:791 kill_fasync_rcu fs/fcntl.c:1002 [inline] kill_fasync fs/fcntl.c:1016 [inline] kill_fasync+0x1f8/0x470 fs/fcntl.c:1009 fsnotify_insert_event+0x3ba/0x500 fs/notify/notification.c:128 fsnotify_add_event include/linux/fsnotify_backend.h:626 [inline] inotify_handle_inode_event+0x31b/0x5d0 fs/notify/inotify/inotify_fsnotify.c:119 fsnotify_handle_inode_event.isra.0+0x22e/0x370 fs/notify/fsnotify.c:264 fsnotify_handle_event fs/notify/fsnotify.c:316 [inline] send_to_group fs/notify/fsnotify.c:362 [inline] fsnotify+0xec5/0x13a0 fs/notify/fsnotify.c:567 __fsnotify_parent+0x62f/0xa60 fs/notify/fsnotify.c:230 fsnotify_parent include/linux/fsnotify.h:77 [inline] fsnotify_dentry include/linux/fsnotify.h:89 [inline] fsnotify_xattr include/linux/fsnotify.h:349 [inline] __vfs_setxattr_noperm+0x30d/0x5f0 fs/xattr.c:219 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 __do_sys_fsetxattr fs/xattr.c:667 [inline] __se_sys_fsetxattr fs/xattr.c:656 [inline] __ia32_sys_fsetxattr+0x241/0x300 fs/xattr.c:656 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 -> (&f->f_owner.lock){...-}-{2:2} { IN-SOFTIRQ-R at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x45/0x90 kernel/locking/spinlock.c:236 send_sigurg+0x1e/0xaf0 fs/fcntl.c:816 sk_send_sigurg+0x76/0x310 net/core/sock.c:3275 tcp_check_urg net/ipv4/tcp_input.c:5604 [inline] tcp_urg+0x38e/0xb40 net/ipv4/tcp_input.c:5645 tcp_rcv_established+0x81d/0x20e0 net/ipv4/tcp_input.c:5992 tcp_v6_do_rcv+0x810/0x13c0 net/ipv6/tcp_ipv6.c:1476 tcp_v6_rcv+0x2d9b/0x37f0 net/ipv6/tcp_ipv6.c:1735 ip6_protocol_deliver_rcu+0x2f4/0x1950 net/ipv6/ip6_input.c:439 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:484 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:493 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x24c/0x380 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5484 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5598 process_backlog+0x3a0/0x7c0 net/core/dev.c:5926 __napi_poll+0xb3/0x6e0 net/core/dev.c:6492 napi_poll net/core/dev.c:6559 [inline] net_rx_action+0x9c1/0xd90 net/core/dev.c:6670 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x45/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326 f_modown+0x2a/0x390 fs/fcntl.c:90 __f_setown fs/fcntl.c:109 [inline] f_setown_ex fs/fcntl.c:199 [inline] do_fcntl+0x923/0x1040 fs/fcntl.c:382 do_compat_fcntl64+0x2c8/0x600 fs/fcntl.c:657 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 send_sigio+0x24/0x380 fs/fcntl.c:777 kill_fasync_rcu fs/fcntl.c:1002 [inline] kill_fasync fs/fcntl.c:1016 [inline] kill_fasync+0x1f8/0x470 fs/fcntl.c:1009 fsnotify_insert_event+0x3ba/0x500 fs/notify/notification.c:128 fsnotify_add_event include/linux/fsnotify_backend.h:626 [inline] inotify_handle_inode_event+0x31b/0x5d0 fs/notify/inotify/inotify_fsnotify.c:119 fsnotify_handle_inode_event.isra.0+0x22e/0x370 fs/notify/fsnotify.c:264 fsnotify_handle_event fs/notify/fsnotify.c:316 [inline] send_to_group fs/notify/fsnotify.c:362 [inline] fsnotify+0xec5/0x13a0 fs/notify/fsnotify.c:567 __fsnotify_parent+0x62f/0xa60 fs/notify/fsnotify.c:230 fsnotify_parent include/linux/fsnotify.h:77 [inline] fsnotify_dentry include/linux/fsnotify.h:89 [inline] fsnotify_xattr include/linux/fsnotify.h:349 [inline] __vfs_setxattr_noperm+0x30d/0x5f0 fs/xattr.c:219 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 __do_sys_fsetxattr fs/xattr.c:667 [inline] __se_sys_fsetxattr fs/xattr.c:656 [inline] __ia32_sys_fsetxattr+0x241/0x300 fs/xattr.c:656 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 } ... key at: [] __key.5+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 send_sigio+0x24/0x380 fs/fcntl.c:777 kill_fasync_rcu fs/fcntl.c:1002 [inline] kill_fasync fs/fcntl.c:1016 [inline] kill_fasync+0x1f8/0x470 fs/fcntl.c:1009 fsnotify_insert_event+0x3ba/0x500 fs/notify/notification.c:128 fsnotify_add_event include/linux/fsnotify_backend.h:626 [inline] inotify_handle_inode_event+0x31b/0x5d0 fs/notify/inotify/inotify_fsnotify.c:119 fsnotify_handle_inode_event.isra.0+0x22e/0x370 fs/notify/fsnotify.c:264 fsnotify_handle_event fs/notify/fsnotify.c:316 [inline] send_to_group fs/notify/fsnotify.c:362 [inline] fsnotify+0xec5/0x13a0 fs/notify/fsnotify.c:567 __fsnotify_parent+0x62f/0xa60 fs/notify/fsnotify.c:230 fsnotify_parent include/linux/fsnotify.h:77 [inline] fsnotify_dentry include/linux/fsnotify.h:89 [inline] fsnotify_xattr include/linux/fsnotify.h:349 [inline] __vfs_setxattr_noperm+0x30d/0x5f0 fs/xattr.c:219 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 __do_sys_fsetxattr fs/xattr.c:667 [inline] __se_sys_fsetxattr fs/xattr.c:656 [inline] __ia32_sys_fsetxattr+0x241/0x300 fs/xattr.c:656 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 -> (&new->fa_lock){....}-{2:2} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326 fasync_remove_entry+0xb6/0x1e0 fs/fcntl.c:872 fasync_helper+0x9e/0xb0 fs/fcntl.c:975 fsnotify_fasync+0x4d/0x80 fs/notify/group.c:170 __fput+0x834/0x9d0 fs/file_table.c:314 task_work_run+0xdd/0x1a0 kernel/task_work.c:177 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294 __do_fast_syscall_32+0x72/0xf0 arch/x86/entry/common.c:181 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:995 [inline] kill_fasync fs/fcntl.c:1016 [inline] kill_fasync+0x136/0x470 fs/fcntl.c:1009 fsnotify_insert_event+0x3ba/0x500 fs/notify/notification.c:128 fsnotify_add_event include/linux/fsnotify_backend.h:626 [inline] inotify_handle_inode_event+0x31b/0x5d0 fs/notify/inotify/inotify_fsnotify.c:119 fsnotify_handle_inode_event.isra.0+0x22e/0x370 fs/notify/fsnotify.c:264 fsnotify_handle_event fs/notify/fsnotify.c:316 [inline] send_to_group fs/notify/fsnotify.c:362 [inline] fsnotify+0xec5/0x13a0 fs/notify/fsnotify.c:567 __fsnotify_parent+0x62f/0xa60 fs/notify/fsnotify.c:230 fsnotify_parent include/linux/fsnotify.h:77 [inline] fsnotify_dentry include/linux/fsnotify.h:89 [inline] fsnotify_xattr include/linux/fsnotify.h:349 [inline] __vfs_setxattr_noperm+0x30d/0x5f0 fs/xattr.c:219 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 __do_sys_fsetxattr fs/xattr.c:667 [inline] __se_sys_fsetxattr fs/xattr.c:656 [inline] __ia32_sys_fsetxattr+0x241/0x300 fs/xattr.c:656 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 } ... key at: [] __key.0+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:995 [inline] kill_fasync fs/fcntl.c:1016 [inline] kill_fasync+0x136/0x470 fs/fcntl.c:1009 snd_ctl_notify.part.0+0x261/0x560 sound/core/control.c:184 snd_ctl_notify sound/core/control.c:213 [inline] snd_ctl_notify_one+0x234/0x280 sound/core/control.c:208 __snd_ctl_add_replace+0x599/0x760 sound/core/control.c:412 snd_ctl_elem_add+0x7dd/0x1220 sound/core/control.c:1587 snd_ctl_elem_add_compat+0x2bb/0x3c0 sound/core/control_compat.c:408 snd_ctl_ioctl_compat+0x140/0x9a0 sound/core/control_compat.c:460 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:968 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 -> (&card->ctl_files_rwlock){....}-{2:2} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_write_lock_irqsave include/linux/rwlock_api_smp.h:186 [inline] _raw_write_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:318 snd_ctl_open sound/core/control.c:80 [inline] snd_ctl_open+0x3a1/0x5c0 sound/core/control.c:42 snd_open+0x21f/0x460 sound/core/sound.c:169 chrdev_open+0x266/0x770 fs/char_dev.c:414 do_dentry_open+0x4a1/0x11f0 fs/open.c:848 do_open fs/namei.c:3520 [inline] path_openat+0x1c71/0x2910 fs/namei.c:3653 do_filp_open+0x1aa/0x400 fs/namei.c:3680 do_sys_openat2+0x16d/0x4c0 fs/open.c:1278 do_sys_open fs/open.c:1294 [inline] __do_compat_sys_openat fs/open.c:1354 [inline] __se_compat_sys_openat fs/open.c:1352 [inline] __ia32_compat_sys_openat+0x13f/0x1f0 fs/open.c:1352 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 snd_ctl_notify.part.0+0x36/0x560 sound/core/control.c:159 snd_ctl_notify sound/core/control.c:213 [inline] snd_ctl_notify_one+0x234/0x280 sound/core/control.c:208 __snd_ctl_add_replace+0x599/0x760 sound/core/control.c:412 snd_ctl_add_replace+0x76/0x130 sound/core/control.c:429 snd_card_dummy_new_mixer sound/drivers/dummy.c:884 [inline] snd_dummy_probe+0xbb9/0x10a0 sound/drivers/dummy.c:1079 platform_probe+0xfc/0x1f0 drivers/base/platform.c:1400 call_driver_probe drivers/base/dd.c:555 [inline] really_probe+0x23e/0xb90 drivers/base/dd.c:634 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:989 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xbda/0x1ea0 drivers/base/core.c:3428 platform_device_add+0x363/0x820 drivers/base/platform.c:717 platform_device_register_full+0x3ed/0x550 drivers/base/platform.c:844 platform_device_register_resndata include/linux/platform_device.h:141 [inline] platform_device_register_simple include/linux/platform_device.h:170 [inline] alsa_card_dummy_init+0x1e0/0x309 sound/drivers/dummy.c:1157 do_one_initcall+0x103/0x650 init/main.c:1295 do_initcall_level init/main.c:1368 [inline] do_initcalls init/main.c:1384 [inline] do_basic_setup init/main.c:1403 [inline] kernel_init_freeable+0x6b1/0x73a init/main.c:1610 kernel_init+0x1a/0x1d0 init/main.c:1499 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 } ... key at: [] __key.12+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 snd_ctl_notify.part.0+0x36/0x560 sound/core/control.c:159 snd_ctl_notify+0x8f/0xb0 sound/core/control.c:187 loopback_check_format sound/drivers/aloop.c:357 [inline] loopback_trigger+0x1177/0x1b10 sound/drivers/aloop.c:386 snd_pcm_do_start sound/core/pcm_native.c:1429 [inline] snd_pcm_do_start+0xb1/0xf0 sound/core/pcm_native.c:1424 snd_pcm_action_single+0x75/0x130 sound/core/pcm_native.c:1281 snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364 __snd_pcm_lib_xfer+0x14d0/0x1e10 sound/core/pcm_lib.c:2308 snd_pcm_oss_write3+0x103/0x250 sound/core/oss/pcm_oss.c:1253 io_playback_transfer+0x27e/0x330 sound/core/oss/io.c:47 snd_pcm_plug_write_transfer+0x2cd/0x3f0 sound/core/oss/pcm_plugin.c:630 snd_pcm_oss_write2+0x245/0x3f0 sound/core/oss/pcm_oss.c:1385 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1451 [inline] snd_pcm_oss_write+0x759/0x9c0 sound/core/oss/pcm_oss.c:2811 vfs_write+0x269/0xac0 fs/read_write.c:589 ksys_write+0x127/0x250 fs/read_write.c:644 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 stack backtrace: CPU: 0 PID: 6248 Comm: syz-executor.3 Not tainted 5.19.0-rc8-syzkaller-00102-g33ea1340bafe #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_bad_irq_dependency kernel/locking/lockdep.c:2609 [inline] check_irq_usage.cold+0x4c1/0x6b0 kernel/locking/lockdep.c:2848 check_prev_add kernel/locking/lockdep.c:3099 [inline] check_prevs_add kernel/locking/lockdep.c:3214 [inline] validate_chain kernel/locking/lockdep.c:3829 [inline] __lock_acquire+0x2ad6/0x5660 kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5630 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 snd_ctl_notify.part.0+0x36/0x560 sound/core/control.c:159 snd_ctl_notify+0x8f/0xb0 sound/core/control.c:187 loopback_check_format sound/drivers/aloop.c:357 [inline] loopback_trigger+0x1177/0x1b10 sound/drivers/aloop.c:386 snd_pcm_do_start sound/core/pcm_native.c:1429 [inline] snd_pcm_do_start+0xb1/0xf0 sound/core/pcm_native.c:1424 snd_pcm_action_single+0x75/0x130 sound/core/pcm_native.c:1281 snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364 __snd_pcm_lib_xfer+0x14d0/0x1e10 sound/core/pcm_lib.c:2308 snd_pcm_oss_write3+0x103/0x250 sound/core/oss/pcm_oss.c:1253 io_playback_transfer+0x27e/0x330 sound/core/oss/io.c:47 snd_pcm_plug_write_transfer+0x2cd/0x3f0 sound/core/oss/pcm_plugin.c:630 snd_pcm_oss_write2+0x245/0x3f0 sound/core/oss/pcm_oss.c:1385 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1451 [inline] snd_pcm_oss_write+0x759/0x9c0 sound/core/oss/pcm_oss.c:2811 vfs_write+0x269/0xac0 fs/read_write.c:589 ksys_write+0x127/0x250 fs/read_write.c:644 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 RIP: 0023:0xf7f14549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f7f0f5cc EFLAGS: 00000296 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000200 RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: 03 74 c0 01 add 0x1(%rax,%rax,8),%esi 4: 10 05 03 74 b8 01 adc %al,0x1b87403(%rip) # 0x1b8740d a: 10 06 adc %al,(%rsi) c: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 10: 10 07 adc %al,(%rdi) 12: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi 16: 10 08 adc %cl,(%rax) 18: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 1c: 00 00 add %al,(%rax) 1e: 00 00 add %al,(%rax) 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 retq 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 39: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi