================================ WARNING: inconsistent lock state syzkaller #0 Tainted: G L -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. udevd/4980 [HC0[0]:SC1[1]:HE0:SE0] takes: ffff888055d38868 (&ccp->wait_input_report_lock){+.?.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] ffff888055d38868 (&ccp->wait_input_report_lock){+.?.}-{3:3}, at: ccp_raw_event+0x59/0x130 drivers/hwmon/corsair-cpro.c:161 {SOFTIRQ-ON-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173 spin_lock include/linux/spinlock.h:347 [inline] ccp_raw_event+0x59/0x130 drivers/hwmon/corsair-cpro.c:161 __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2175 uhid_dev_input2 drivers/hid/uhid.c:609 [inline] uhid_char_write+0xb6b/0x10e0 drivers/hid/uhid.c:767 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x1f8/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 79962507 hardirqs last enabled at (79962506): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (79962506): [] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (79962507): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (79962507): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:181 softirqs last enabled at (79962452): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (79962452): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (79962452): [] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 softirqs last disabled at (79962503): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (79962503): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (79962503): [] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&ccp->wait_input_report_lock); lock(&ccp->wait_input_report_lock); *** DEADLOCK *** locks held by udevd/4980: 3, last CPU#1: #0: ffff888036306460 (sb_writers#5){.+.+}-{0:0}, at: filename_unlinkat+0x1ad/0x730 fs/namei.c:5696 #1: ffff8880356ae308 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #1: ffff8880356ae308 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline] #1: ffff8880356ae308 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline] #1: ffff8880356ae308 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x262/0x730 fs/namei.c:5700 #2: ffff8880561bf850 (&lockref->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff8880561bf850 (&lockref->lock){+.+.}-{3:3}, at: __d_add fs/dcache.c:2930 [inline] #2: ffff8880561bf850 (&lockref->lock){+.+.}-{3:3}, at: d_splice_alias_ops+0x1b1/0x15b0 fs/dcache.c:3295 stack backtrace: CPU: 1 UID: 0 PID: 4980 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_usage_bug.part.0+0x258/0x340 kernel/locking/lockdep.c:4086 print_usage_bug kernel/locking/lockdep.c:4054 [inline] valid_state kernel/locking/lockdep.c:4100 [inline] mark_lock_irq kernel/locking/lockdep.c:4311 [inline] mark_lock+0x956/0x1020 kernel/locking/lockdep.c:4797 mark_usage kernel/locking/lockdep.c:4686 [inline] __lock_acquire+0x7f1/0x1f40 kernel/locking/lockdep.c:5242 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173 spin_lock include/linux/spinlock.h:347 [inline] ccp_raw_event+0x59/0x130 drivers/hwmon/corsair-cpro.c:161 __hid_input_report.constprop.0+0x319/0x470 drivers/hid/hid-core.c:2175 hid_irq_in+0x55d/0x710 drivers/hid/usbhid/hid-core.c:287 __usb_hcd_giveback_urb+0x38e/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xdaf/0x3820 drivers/usb/gadget/udc/dummy_hcd.c:2023 __run_hrtimer kernel/time/hrtimer.c:2074 [inline] __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2131 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2148 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__kasan_check_write+0x8/0x20 mm/kasan/shadow.c:37 Code: f3 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f6 ba 01 00 00 00 e9 dc f2 ff ff 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ffffc900035d7c78 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffffc900002b7058 RCX: ffffffff829af1f5 RDX: ffff88807f3e5dc0 RSI: 0000000000000008 RDI: ffffc900002b7058 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880561bf7c1 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 instrument_write include/linux/instrumented.h:41 [inline] __clear_bit_unlock include/asm-generic/bitops/instrumented-lock.h:42 [inline] __bit_spin_unlock include/linux/bit_spinlock.h:96 [inline] hlist_bl_unlock include/linux/list_bl.h:155 [inline] __d_rehash+0x1e5/0x340 fs/dcache.c:2719 __d_add fs/dcache.c:2946 [inline] d_splice_alias_ops+0x619/0x15b0 fs/dcache.c:3295 simple_lookup fs/libfs.c:81 [inline] simple_lookup+0xf4/0x1d0 fs/libfs.c:69 lookup_one_qstr_excl+0x1cd/0x250 fs/namei.c:1810 __start_dirop fs/namei.c:2920 [inline] start_dirop fs/namei.c:2942 [inline] filename_unlinkat+0x275/0x730 fs/namei.c:5700 __do_sys_unlink fs/namei.c:5754 [inline] __se_sys_unlink fs/namei.c:5751 [inline] __x64_sys_unlink+0x46/0x70 fs/namei.c:5751 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1ae7115937 Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8 RSP: 002b:00007ffe59913eb8 EFLAGS: 00000202 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007f1ae7115937 RDX: 0000000000000000 RSI: 0000000078483c80 RDI: 000055ea27d3e02e RBP: 0000000000000000 R08: 000000007853f881 R09: 0000000000000001 R10: 0000000000061602 R11: 0000000000000202 R12: 0000000000000000 R13: 000055ea27d59100 R14: 0000000000000001 R15: 0000000000000000 kcov: kcov_move_area: ffffc90025401000 1048576 <= ffffc90002111000 262143 virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4c410 response 0 status 0x0 sense_len 0 No more buffers in queue wireguard: wg1: Handshake for peer 109 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 19) wireguard: wg1: Handshake for peer 108 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 9) wireguard: wg1: Handshake for peer 115 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 2) wireguard: wg2: Handshake for peer 110 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 3) wireguard: wg0: Handshake for peer 107 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) wireguard: wg0: Handshake for peer 106 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2) wireguard: wg1: Sending keepalive packet to peer 115 (127.0.0.1:20003) wireguard: wg2: Sending keepalive packet to peer 116 ([::1]:20001/0%0) wireguard: wg2: Sending keepalive packet to peer 117 (127.0.0.1:20002) dummy_hcd dummy_hcd.5: no ep configured for urb ffff88803af33000 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88807f3e5dc0, size = 262144, area = ffffc90002111000 kcov: kcov_move_area: ffffc90025401000 1048576 <= ffffc90002111000 4 dummy_hcd dummy_hcd.5: no ep configured for urb ffff88802776a900 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff88807f3e5dc0, size = 262144, area = ffffc90002111000 kcov: kcov_move_area: ffffc90025401000 1048576 <= ffffc90002111000 59 usbhid 6-1:0.0: retrying intr urb dummy_hcd dummy_hcd.5: no ep configured for urb ffff88802776a900 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888026f4be80, size = 262144, area = ffffc90002111000 kcov: kcov_move_area: ffffc90025401000 1048576 <= ffffc90002111000 58 virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4da90 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4cb90 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4c410 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4d310 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4c7d0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4cf50 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4d6d0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4de50 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be3fc50 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be404d0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be3f890 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be40110 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be40c50 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be40890 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be3f110 response 0 status 0x0 sense_len 0 No more buffers in queue usbhid 6-1:0.0: retrying intr urb dummy_hcd dummy_hcd.5: no ep configured for urb ffff88802776a900 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888026f4be80, size = 262144, area = ffffc90002111000 kcov: kcov_move_area: ffffc90025401000 1048576 <= ffffc90002111000 55 virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be3f4d0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff888029323910 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be42a50 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be42690 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be413d0 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be41f10 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be41790 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be41b50 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be42e10 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be422d0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be440d0 response 0 status 0x0 sense_len 0 No more buffers in queue sd 0:0:1:0: cmd ffff88802be44850 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be431d0 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be43d10 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be43590 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be44c10 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be44490 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be43950 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be45b10 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be45ed0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be44fd0 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be46290 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be46650 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be45390 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be45750 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be46a10 response 0 status 0x0 sense_len 0 No more buffers in queue usbhid 6-1:0.0: retrying intr urb dummy_hcd dummy_hcd.5: no ep configured for urb ffff88802776a900 kcov: kcov_remote_start: handle = 100000000000006, context: softirq kcov: kcov_start: t = ffff888026f4be80, size = 262144, area = ffffc90002111000 kcov: kcov_move_area: ffffc90025401000 1048576 <= ffffc90002111000 55 virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be48f90 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be49ad0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be46dd0 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be48810 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be48bd0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be47550 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be48090 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4a610 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be47190 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be47cd0 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be48450 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be47910 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be49710 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be49350 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be49e90 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4a250 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4a250 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4ad90 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4b150 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4bc90 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4c050 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4b8d0 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880273c5600 (ffffffff86a10f70) sd 0:0:1:0: cmd ffff88802be4b510 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff88802be4a9d0 response 0 status 0x0 sense_len 0 No more buffers in queue ---------------- Code disassembly (best guess): 0: f3 ff repz (bad) 2: ff 66 66 jmp *0x66(%rsi) 5: 2e 0f 1f 84 00 00 00 cs nopl 0x0(%rax,%rax,1) c: 00 00 e: 0f 1f 40 00 nopl 0x0(%rax) 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: f3 0f 1e fa endbr64 26: 48 8b 0c 24 mov (%rsp),%rcx * 2a: 89 f6 mov %esi,%esi <-- trapping instruction 2c: ba 01 00 00 00 mov $0x1,%edx 31: e9 dc f2 ff ff jmp 0xfffff312 36: 66 data16 37: 66 data16 38: 2e cs 39: 0f .byte 0xf 3a: 1f (bad) 3b: 84 00 test %al,(%rax) 3d: 00 00 add %al,(%rax)