Extracting prog: 2m3.800415846s Minimizing prog: 11m59.363829362s Simplifying prog options: 3m43.068946699s Extracting C: 34.692839708s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in input_ff_flush single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(0x0, 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program did not crash testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF program crashed: possible deadlock in uinput_request_submit a never seen crash title: possible deadlock in uinput_request_submit, ignore simplifying guilty program options testing program (duration=56.888550039s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in uinput_request_submit a never seen crash title: possible deadlock in uinput_request_submit, ignore testing program (duration=56.888550039s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in uinput_request_submit a never seen crash title: possible deadlock in uinput_request_submit, ignore testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in uinput_request_submit a never seen crash title: possible deadlock in uinput_request_submit, ignore testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in input_ff_flush validation run: crashed=true testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in uinput_request_submit validation run: crashed=true testing program (duration=56.888550039s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_DEV_SETUP-ioctl$UI_SET_FFBIT-ioctl$UI_DEV_CREATE-syz_open_dev$evdev-ioctl$EVIOCSFF detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{}, 'syz0\x00', 0x45}) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x51) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x50, 0xffff, 0x2, {0x0, 0x40}, {0x1, 0x7}, @ramp}) program crashed: possible deadlock in input_ff_flush validation run: crashed=true reproducing took 20m55.703817134s repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ udevd/5810 is trying to acquire lock: ffff88802779f0b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] ffff88802779f0b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231 but task is already holding lock: ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline] ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4a/0x140 drivers/input/input.c:626 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&dev->mutex#2){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_intr_constructor include/linux/mutex.h:255 [inline] input_register_handle+0xca/0x630 drivers/input/input.c:2619 kbd_connect+0xce/0x180 drivers/tty/vt/keyboard.c:1559 input_attach_handler.isra.0+0x177/0x1e0 drivers/input/input.c:994 input_register_device.cold+0x139/0x375 drivers/input/input.c:2378 acpi_button_probe+0x5d3/0xbc0 drivers/acpi/button.c:622 platform_probe+0x106/0x1d0 drivers/base/platform.c:1446 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __driver_attach+0x2f4/0x6a0 drivers/base/dd.c:1227 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715 driver_register+0x1e2/0x360 drivers/base/driver.c:249 acpi_button_init+0xe4/0x100 drivers/acpi/button.c:759 do_one_initcall+0x11d/0x760 init/main.c:1382 do_initcall_level init/main.c:1444 [inline] do_initcalls init/main.c:1460 [inline] do_basic_setup init/main.c:1479 [inline] kernel_init_freeable+0x6e5/0x7a0 init/main.c:1692 kernel_init+0x1f/0x1e0 init/main.c:1582 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #2 (input_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_intr_constructor include/linux/mutex.h:255 [inline] input_register_device.cold+0x5b/0x375 drivers/input/input.c:2374 uinput_create_device drivers/input/misc/uinput.c:365 [inline] uinput_ioctl_handler.isra.0+0x8d8/0x1d10 drivers/input/misc/uinput.c:919 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&newdev->mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 uinput_request_send drivers/input/misc/uinput.c:151 [inline] uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182 uinput_request_submit drivers/input/misc/uinput.c:179 [inline] uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257 input_ff_upload+0x578/0xc60 drivers/input/ff-core.c:148 evdev_do_ioctl+0x1228/0x1b60 drivers/input/evdev.c:1181 evdev_ioctl_handler drivers/input/evdev.c:1270 [inline] evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&ff->mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_constructor include/linux/mutex.h:253 [inline] input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231 uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283 input_flush_device+0xc9/0x140 drivers/input/input.c:628 evdev_release+0x344/0x420 drivers/input/evdev.c:435 __fput+0x3ff/0xb40 fs/file_table.c:469 fput_close_sync+0x118/0x250 fs/file_table.c:574 __do_sys_close fs/open.c:1509 [inline] __se_sys_close fs/open.c:1494 [inline] __x64_sys_close+0x8b/0x120 fs/open.c:1494 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &ff->mutex --> input_mutex --> &dev->mutex#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&dev->mutex#2); lock(input_mutex); lock(&dev->mutex#2); lock(&ff->mutex); *** DEADLOCK *** 2 locks held by udevd/5810: #0: ffff8880482d4118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x79/0x420 drivers/input/evdev.c:432 #1: ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline] #1: ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4a/0x140 drivers/input/input.c:626 stack backtrace: CPU: 0 UID: 0 PID: 5810 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_constructor include/linux/mutex.h:253 [inline] input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231 uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283 input_flush_device+0xc9/0x140 drivers/input/input.c:628 evdev_release+0x344/0x420 drivers/input/evdev.c:435 __fput+0x3ff/0xb40 fs/file_table.c:469 fput_close_sync+0x118/0x250 fs/file_table.c:574 __do_sys_close fs/open.c:1509 [inline] __se_sys_close fs/open.c:1494 [inline] __x64_sys_close+0x8b/0x120 fs/open.c:1494 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f244f8a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc752a2690 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 00007f244ffd6880 RCX: 00007f244f8a7407 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: 00007f244ffd66e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000016 R13: 00007ffc752a27a0 R14: 0000000000000000 R15: 0000000000000000 final repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ udevd/5810 is trying to acquire lock: ffff88802779f0b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] ffff88802779f0b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231 but task is already holding lock: ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline] ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4a/0x140 drivers/input/input.c:626 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&dev->mutex#2){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_intr_constructor include/linux/mutex.h:255 [inline] input_register_handle+0xca/0x630 drivers/input/input.c:2619 kbd_connect+0xce/0x180 drivers/tty/vt/keyboard.c:1559 input_attach_handler.isra.0+0x177/0x1e0 drivers/input/input.c:994 input_register_device.cold+0x139/0x375 drivers/input/input.c:2378 acpi_button_probe+0x5d3/0xbc0 drivers/acpi/button.c:622 platform_probe+0x106/0x1d0 drivers/base/platform.c:1446 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __driver_attach+0x2f4/0x6a0 drivers/base/dd.c:1227 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715 driver_register+0x1e2/0x360 drivers/base/driver.c:249 acpi_button_init+0xe4/0x100 drivers/acpi/button.c:759 do_one_initcall+0x11d/0x760 init/main.c:1382 do_initcall_level init/main.c:1444 [inline] do_initcalls init/main.c:1460 [inline] do_basic_setup init/main.c:1479 [inline] kernel_init_freeable+0x6e5/0x7a0 init/main.c:1692 kernel_init+0x1f/0x1e0 init/main.c:1582 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #2 (input_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_intr_constructor include/linux/mutex.h:255 [inline] input_register_device.cold+0x5b/0x375 drivers/input/input.c:2374 uinput_create_device drivers/input/misc/uinput.c:365 [inline] uinput_ioctl_handler.isra.0+0x8d8/0x1d10 drivers/input/misc/uinput.c:919 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&newdev->mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 uinput_request_send drivers/input/misc/uinput.c:151 [inline] uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182 uinput_request_submit drivers/input/misc/uinput.c:179 [inline] uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257 input_ff_upload+0x578/0xc60 drivers/input/ff-core.c:148 evdev_do_ioctl+0x1228/0x1b60 drivers/input/evdev.c:1181 evdev_ioctl_handler drivers/input/evdev.c:1270 [inline] evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&ff->mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_constructor include/linux/mutex.h:253 [inline] input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231 uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283 input_flush_device+0xc9/0x140 drivers/input/input.c:628 evdev_release+0x344/0x420 drivers/input/evdev.c:435 __fput+0x3ff/0xb40 fs/file_table.c:469 fput_close_sync+0x118/0x250 fs/file_table.c:574 __do_sys_close fs/open.c:1509 [inline] __se_sys_close fs/open.c:1494 [inline] __x64_sys_close+0x8b/0x120 fs/open.c:1494 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &ff->mutex --> input_mutex --> &dev->mutex#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&dev->mutex#2); lock(input_mutex); lock(&dev->mutex#2); lock(&ff->mutex); *** DEADLOCK *** 2 locks held by udevd/5810: #0: ffff8880482d4118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x79/0x420 drivers/input/evdev.c:432 #1: ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline] #1: ffff88802621e2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4a/0x140 drivers/input/input.c:626 stack backtrace: CPU: 0 UID: 0 PID: 5810 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x14b8/0x2630 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x1a2/0x1b90 kernel/locking/mutex.c:776 class_mutex_constructor include/linux/mutex.h:253 [inline] input_ff_flush+0x63/0x1b0 drivers/input/ff-core.c:231 uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283 input_flush_device+0xc9/0x140 drivers/input/input.c:628 evdev_release+0x344/0x420 drivers/input/evdev.c:435 __fput+0x3ff/0xb40 fs/file_table.c:469 fput_close_sync+0x118/0x250 fs/file_table.c:574 __do_sys_close fs/open.c:1509 [inline] __se_sys_close fs/open.c:1494 [inline] __x64_sys_close+0x8b/0x120 fs/open.c:1494 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f244f8a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc752a2690 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 00007f244ffd6880 RCX: 00007f244f8a7407 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: 00007f244ffd66e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000016 R13: 00007ffc752a27a0 R14: 0000000000000000 R15: 0000000000000000