======================================================== WARNING: possible irq lock inversion dependency detected 6.12.0-rc5-syzkaller-00047-g4236f913808c #0 Not tainted -------------------------------------------------------- syz-executor/11071 just changed the state of lock: ffff88807812e230 (&dev->event_lock#2){..-.}-{2:2}, at: input_inject_event+0xc5/0x340 drivers/input/input.c:423 but this lock took another, SOFTIRQ-READ-unsafe lock in the past: (tasklist_lock){.+.+}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &dev->event_lock#2 --> &new->fa_lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock#2); lock(&new->fa_lock); lock(&dev->event_lock#2); *** DEADLOCK *** 4 locks held by syz-executor/11071: #0: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: find_lock_entries+0x1b4/0xef0 mm/filemap.c:2095 #1: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: page_ref_add_unless include/linux/page_ref.h:235 [inline] #1: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: folio_ref_add_unless include/linux/page_ref.h:248 [inline] #1: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: folio_try_get+0x1e/0x350 include/linux/page_ref.h:264 #2: ffffc90000a18c00 (drivers/tty/vt/keyboard.c:274){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1791 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: input_handler_for_each_handle+0x29/0x1d0 drivers/input/input.c:2673 the shortest dependencies between 2nd lock and 1st lock: -> (tasklist_lock){.+.+}-{2:2} { HARDIRQ-ON-R at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 __do_wait+0x12d/0x850 kernel/exit.c:1648 do_wait+0x1e9/0x560 kernel/exit.c:1692 kernel_wait+0xe9/0x240 kernel/exit.c:1868 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 SOFTIRQ-ON-R at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 __do_wait+0x12d/0x850 kernel/exit.c:1648 do_wait+0x1e9/0x560 kernel/exit.c:1692 kernel_wait+0xe9/0x240 kernel/exit.c:1868 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INITIAL USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:326 copy_process+0x2267/0x3d50 kernel/fork.c:2500 kernel_clone+0x226/0x8f0 kernel/fork.c:2784 user_mode_thread+0x132/0x1a0 kernel/fork.c:2862 rest_init+0x23/0x300 init/main.c:712 start_kernel+0x47f/0x500 init/main.c:1105 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x147 INITIAL READ USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 __do_wait+0x12d/0x850 kernel/exit.c:1648 do_wait+0x1e9/0x560 kernel/exit.c:1692 kernel_wait+0xe9/0x240 kernel/exit.c:1868 call_usermodehelper_exec_sync kernel/umh.c:137 [inline] call_usermodehelper_exec_work+0xbd/0x230 kernel/umh.c:164 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] tasklist_lock+0x18/0x40 ... acquired at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228 send_sigio+0x108/0x390 fs/fcntl.c:924 dnotify_handle_event+0x157/0x460 fs/notify/dnotify/dnotify.c:114 fsnotify_handle_event fs/notify/fsnotify.c:350 [inline] send_to_group fs/notify/fsnotify.c:398 [inline] fsnotify+0x1946/0x1f60 fs/notify/fsnotify.c:607 fsnotify_name include/linux/fsnotify.h:55 [inline] fsnotify_dirent include/linux/fsnotify.h:61 [inline] fsnotify_create include/linux/fsnotify.h:278 [inline] open_last_lookups fs/namei.c:3697 [inline] path_openat+0x1686/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&f_owner->lock){....}-{2:2} { INITIAL USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:326 __f_setown+0x6b/0x380 fs/fcntl.c:137 fcntl_dirnotify+0x4cf/0x790 fs/notify/dnotify/dnotify.c:372 do_fcntl+0x7e2/0x1a60 fs/fcntl.c:534 __do_sys_fcntl fs/fcntl.c:586 [inline] __se_sys_fcntl+0xd2/0x1e0 fs/fcntl.c:571 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL READ USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236 send_sigio+0x37/0x390 fs/fcntl.c:910 dnotify_handle_event+0x157/0x460 fs/notify/dnotify/dnotify.c:114 fsnotify_handle_event fs/notify/fsnotify.c:350 [inline] send_to_group fs/notify/fsnotify.c:398 [inline] fsnotify+0x1946/0x1f60 fs/notify/fsnotify.c:607 fsnotify_inode include/linux/fsnotify.h:72 [inline] fsnotify_link_count include/linux/fsnotify.h:203 [inline] fsnotify_move+0x3cb/0x5c0 include/linux/fsnotify.h:237 vfs_rename+0x8d3/0xf00 fs/namei.c:5039 do_renameat2+0xd94/0x13f0 fs/namei.c:5170 __do_sys_rename fs/namei.c:5217 [inline] __se_sys_rename fs/namei.c:5215 [inline] __x64_sys_rename+0x82/0x90 fs/namei.c:5215 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] file_f_owner_allocate.__key+0x0/0x20 ... acquired at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236 send_sigio+0x37/0x390 fs/fcntl.c:910 kill_fasync_rcu fs/fcntl.c:1136 [inline] kill_fasync+0x256/0x4f0 fs/fcntl.c:1151 lease_break_callback+0x26/0x30 fs/locks.c:558 __break_lease+0x6d7/0x1820 fs/locks.c:1592 break_lease include/linux/filelock.h:436 [inline] do_dentry_open+0x8d4/0x1460 fs/open.c:949 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_open fs/open.c:1438 [inline] __se_sys_open fs/open.c:1434 [inline] __x64_sys_open+0x225/0x270 fs/open.c:1434 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&new->fa_lock){....}-{2:2} { INITIAL USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0xd3/0x120 kernel/locking/spinlock.c:326 fasync_remove_entry+0xff/0x1d0 fs/fcntl.c:1004 lease_modify+0x1bd/0x3a0 fs/locks.c:1455 locks_remove_lease fs/locks.c:2680 [inline] locks_remove_file+0x577/0x10c0 fs/locks.c:2705 __fput+0x1a6/0x880 fs/file_table.c:423 task_work_run+0x251/0x310 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL READ USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1127 [inline] kill_fasync+0x199/0x4f0 fs/fcntl.c:1151 wakeup_pipe_readers fs/splice.c:183 [inline] splice_pipe_to_pipe fs/splice.c:1865 [inline] do_splice+0x107e/0x18e0 fs/splice.c:1331 __do_splice fs/splice.c:1436 [inline] __do_sys_splice fs/splice.c:1652 [inline] __se_sys_splice+0x331/0x4a0 fs/splice.c:1634 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f } ... key at: [] fasync_insert_entry.__key+0x0/0x20 ... acquired at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xdd/0x130 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1127 [inline] kill_fasync+0x199/0x4f0 fs/fcntl.c:1151 mousedev_notify_readers+0x719/0xc80 drivers/input/mousedev.c:309 mousedev_event+0x5d9/0x1390 drivers/input/mousedev.c:394 input_handler_events_default+0x109/0x1c0 drivers/input/input.c:2549 input_pass_values+0x288/0x860 drivers/input/input.c:126 input_event_dispose+0x30f/0x600 drivers/input/input.c:341 input_handle_event+0xa71/0xbe0 drivers/input/input.c:369 input_inject_event+0x22f/0x340 drivers/input/input.c:428 evdev_write+0x5fd/0x790 drivers/input/evdev.c:528 vfs_write+0x2a5/0xd30 fs/read_write.c:681 ksys_write+0x183/0x2b0 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> (&dev->event_lock#2){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 input_inject_event+0xc5/0x340 drivers/input/input.c:423 kd_sound_helper+0x101/0x210 drivers/tty/vt/keyboard.c:256 input_handler_for_each_handle+0x105/0x1d0 drivers/input/input.c:2676 call_timer_fn+0x190/0x650 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers kernel/time/timer.c:2419 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2c7/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5829 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] page_ref_add_unless include/linux/page_ref.h:235 [inline] folio_ref_add_unless include/linux/page_ref.h:248 [inline] folio_try_get+0x3b/0x350 include/linux/page_ref.h:264 find_get_entry mm/filemap.c:2006 [inline] find_lock_entries+0x2e8/0xef0 mm/filemap.c:2096 shmem_undo_range+0x2c2/0x1cf0 mm/shmem.c:1014 shmem_truncate_range mm/shmem.c:1144 [inline] shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1274 evict+0x4ea/0x9b0 fs/inode.c:725 __dentry_kill+0x20d/0x630 fs/dcache.c:615 dput+0x19f/0x2b0 fs/dcache.c:857 __fput+0x5d2/0x880 fs/file_table.c:439 task_work_run+0x251/0x310 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f INITIAL USE at: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 input_inject_event+0xc5/0x340 drivers/input/input.c:423 kbd_led_trigger_activate+0xb8/0x100 drivers/tty/vt/keyboard.c:1036 led_trigger_set+0x584/0x9c0 drivers/leds/led-triggers.c:212 led_match_default_trigger drivers/leds/led-triggers.c:269 [inline] led_trigger_set_default+0x229/0x260 drivers/leds/led-triggers.c:287 led_classdev_register_ext+0x6e6/0x8a0 drivers/leds/led-class.c:555 led_classdev_register include/linux/leds.h:273 [inline] input_leds_connect+0x489/0x630 drivers/input/input-leds.c:145 input_attach_handler drivers/input/input.c:1027 [inline] input_register_device+0xd3d/0x1110 drivers/input/input.c:2470 atkbd_connect+0x752/0xa00 drivers/input/keyboard/atkbd.c:1340 serio_connect_driver drivers/input/serio/serio.c:44 [inline] serio_driver_probe+0x81/0xa0 drivers/input/serio/serio.c:775 really_probe+0x2ba/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __driver_attach+0x45f/0x710 drivers/base/dd.c:1216 bus_for_each_dev+0x23b/0x2b0 drivers/base/bus.c:370 serio_attach_driver drivers/input/serio/serio.c:804 [inline] serio_handle_event+0x1c7/0x920 drivers/input/serio/serio.c:224 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 } ... key at: [] input_allocate_device.__key.5+0x0/0x20 ... acquired at: mark_lock+0x223/0x360 kernel/locking/lockdep.c:4725 __lock_acquire+0xbf9/0x2050 kernel/locking/lockdep.c:5156 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 input_inject_event+0xc5/0x340 drivers/input/input.c:423 kd_sound_helper+0x101/0x210 drivers/tty/vt/keyboard.c:256 input_handler_for_each_handle+0x105/0x1d0 drivers/input/input.c:2676 call_timer_fn+0x190/0x650 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers kernel/time/timer.c:2419 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2c7/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5829 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] page_ref_add_unless include/linux/page_ref.h:235 [inline] folio_ref_add_unless include/linux/page_ref.h:248 [inline] folio_try_get+0x3b/0x350 include/linux/page_ref.h:264 find_get_entry mm/filemap.c:2006 [inline] find_lock_entries+0x2e8/0xef0 mm/filemap.c:2096 shmem_undo_range+0x2c2/0x1cf0 mm/shmem.c:1014 shmem_truncate_range mm/shmem.c:1144 [inline] shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1274 evict+0x4ea/0x9b0 fs/inode.c:725 __dentry_kill+0x20d/0x630 fs/dcache.c:615 dput+0x19f/0x2b0 fs/dcache.c:857 __fput+0x5d2/0x880 fs/file_table.c:439 task_work_run+0x251/0x310 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f stack backtrace: CPU: 1 UID: 0 PID: 11071 Comm: syz-executor Not tainted 6.12.0-rc5-syzkaller-00047-g4236f913808c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_irq_inversion_bug+0x33d/0x390 kernel/locking/lockdep.c:4121 mark_lock_irq+0x80c/0xc20 kernel/locking/lockdep.c:4290 mark_lock+0x223/0x360 kernel/locking/lockdep.c:4725 __lock_acquire+0xbf9/0x2050 kernel/locking/lockdep.c:5156 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 input_inject_event+0xc5/0x340 drivers/input/input.c:423 kd_sound_helper+0x101/0x210 drivers/tty/vt/keyboard.c:256 input_handler_for_each_handle+0x105/0x1d0 drivers/input/input.c:2676 call_timer_fn+0x190/0x650 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers kernel/time/timer.c:2419 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2c7/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5829 Code: 2b 00 74 08 4c 89 f7 e8 1a 4f 8e 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc900040873a0 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff92000810e80 RCX: be2c3fe10fcfc000 RDX: dffffc0000000000 RSI: ffffffff8c0adc40 RDI: ffffffff8c610420 RBP: ffffc900040874f0 R08: ffffffff942cc807 R09: 1ffffffff2859900 R10: dffffc0000000000 R11: fffffbfff2859901 R12: 1ffff92000810e7c R13: dffffc0000000000 R14: ffffc90004087400 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] page_ref_add_unless include/linux/page_ref.h:235 [inline] folio_ref_add_unless include/linux/page_ref.h:248 [inline] folio_try_get+0x3b/0x350 include/linux/page_ref.h:264 find_get_entry mm/filemap.c:2006 [inline] find_lock_entries+0x2e8/0xef0 mm/filemap.c:2096 shmem_undo_range+0x2c2/0x1cf0 mm/shmem.c:1014 shmem_truncate_range mm/shmem.c:1144 [inline] shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1274 evict+0x4ea/0x9b0 fs/inode.c:725 __dentry_kill+0x20d/0x630 fs/dcache.c:615 dput+0x19f/0x2b0 fs/dcache.c:857 __fput+0x5d2/0x880 fs/file_table.c:439 task_work_run+0x251/0x310 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb7e6f7d3aa Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 13 8c 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 73 8c 02 00 8b 44 24 RSP: 002b:00007ffc3b085330 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fb7e6f7d3aa RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffc3b08537c R08: 0000000000000000 R09: 00007ffc3b085097 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000032 R13: 000000000006dfcd R14: 000000000006da40 R15: 00007ffc3b0853d0 cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 ---------------- Code disassembly (best guess): 0: 2b 00 sub (%rax),%eax 2: 74 08 je 0xc 4: 4c 89 f7 mov %r14,%rdi 7: e8 1a 4f 8e 00 call 0x8e4f26 c: f6 44 24 61 02 testb $0x2,0x61(%rsp) 11: 0f 85 85 01 00 00 jne 0x19c 17: 41 f7 c7 00 02 00 00 test $0x200,%r15d 1e: 74 01 je 0x21 20: fb sti 21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp) 28: e0 45 * 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction 31: 00 00 33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1) 3a: 00 00 3c: 43 rex.XB 3d: c7 .byte 0xc7 3e: 44 rex.R 3f: 25 .byte 0x25