====================================================== WARNING: possible circular locking dependency detected 6.4.0-syzkaller #0 Not tainted ------------------------------------------------------ syz.2.16/5546 is trying to acquire lock: ffff8881093dc8b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x36/0xc0 drivers/input/ff-core.c:240 but task is already holding lock: ffff8881686ccac0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x2c/0x80 drivers/input/input.c:679 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&dev->mutex#2){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0xab/0x9a0 kernel/locking/mutex.c:747 input_register_handle+0x33/0x1b0 drivers/input/input.c:2553 kbd_connect+0x4e/0xb0 drivers/tty/vt/keyboard.c:1589 input_attach_handler.isra.0+0xd4/0x130 drivers/input/input.c:1062 input_register_device+0x62d/0x820 drivers/input/input.c:2394 acpi_button_add+0x2c1/0x6c0 drivers/acpi/button.c:594 acpi_device_probe+0x64/0x190 drivers/acpi/bus.c:990 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x136/0x590 drivers/base/dd.c:658 __driver_probe_device+0xcd/0x1f0 drivers/base/dd.c:798 driver_probe_device+0x2a/0x120 drivers/base/dd.c:828 __driver_attach+0x17e/0x2b0 drivers/base/dd.c:1214 bus_for_each_dev+0xb6/0x120 drivers/base/bus.c:368 bus_add_driver+0x162/0x2e0 drivers/base/bus.c:673 driver_register+0x85/0x180 drivers/base/driver.c:246 acpi_bus_register_driver+0x52/0x70 drivers/acpi/bus.c:941 acpi_button_register_driver drivers/acpi/button.c:724 [inline] acpi_button_driver_init+0x52/0xb0 drivers/acpi/button.c:733 do_one_initcall+0xa0/0x360 init/main.c:1232 do_initcall_level init/main.c:1305 [inline] do_initcalls init/main.c:1321 [inline] do_basic_setup init/main.c:1340 [inline] kernel_init_freeable+0x33b/0x5d0 init/main.c:1557 kernel_init+0x1b/0x290 init/main.c:1448 ret_from_fork+0x29/0x50 arch/x86/entry/entry_64.S:308 -> #2 (input_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0xab/0x9a0 kernel/locking/mutex.c:747 input_register_device+0x59a/0x820 drivers/input/input.c:2387 uinput_create_device drivers/input/misc/uinput.c:364 [inline] uinput_ioctl_handler.isra.0+0xc4f/0xfd0 drivers/input/misc/uinput.c:870 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0xf6/0x150 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 -> #1 (&newdev->mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0xab/0x9a0 kernel/locking/mutex.c:747 uinput_request_send drivers/input/misc/uinput.c:150 [inline] uinput_request_submit.part.0+0x1f/0x130 drivers/input/misc/uinput.c:181 uinput_request_submit drivers/input/misc/uinput.c:178 [inline] uinput_dev_upload_effect+0xbc/0x100 drivers/input/misc/uinput.c:256 input_ff_upload+0x34b/0x4c0 drivers/input/ff-core.c:150 evdev_do_ioctl+0xac2/0x11c0 drivers/input/evdev.c:1183 evdev_ioctl_handler drivers/input/evdev.c:1272 [inline] evdev_ioctl+0xd6/0xe0 drivers/input/evdev.c:1281 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0xf6/0x150 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 -> #0 (&ff->mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3113 [inline] check_prevs_add kernel/locking/lockdep.c:3232 [inline] validate_chain kernel/locking/lockdep.c:3847 [inline] __lock_acquire+0x13fd/0x1c00 kernel/locking/lockdep.c:5088 lock_acquire kernel/locking/lockdep.c:5705 [inline] lock_acquire+0xcd/0x2c0 kernel/locking/lockdep.c:5670 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0xab/0x9a0 kernel/locking/mutex.c:747 input_ff_flush+0x36/0xc0 drivers/input/ff-core.c:240 uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:282 input_flush_device+0x5a/0x80 drivers/input/input.c:684 evdev_release+0x19f/0x1b0 drivers/input/evdev.c:444 __fput+0x1d3/0x4c0 fs/file_table.c:378 task_work_run+0x8f/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x1f3/0x200 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1e/0x60 kernel/entry/common.c:297 do_syscall_64+0x4c/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 other info that might help us debug this: Chain exists of: &ff->mutex --> input_mutex --> &dev->mutex#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&dev->mutex#2); lock(input_mutex); lock(&dev->mutex#2); lock(&ff->mutex); *** DEADLOCK *** 2 locks held by syz.2.16/5546: #0: ffff8881686cf910 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x34/0x1b0 drivers/input/evdev.c:441 #1: ffff8881686ccac0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x2c/0x80 drivers/input/input.c:679 stack backtrace: CPU: 0 PID: 5546 Comm: syz.2.16 Not tainted 6.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 check_noncircular+0xf8/0x110 kernel/locking/lockdep.c:2188 check_prev_add kernel/locking/lockdep.c:3113 [inline] check_prevs_add kernel/locking/lockdep.c:3232 [inline] validate_chain kernel/locking/lockdep.c:3847 [inline] __lock_acquire+0x13fd/0x1c00 kernel/locking/lockdep.c:5088 lock_acquire kernel/locking/lockdep.c:5705 [inline] lock_acquire+0xcd/0x2c0 kernel/locking/lockdep.c:5670 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0xab/0x9a0 kernel/locking/mutex.c:747 input_ff_flush+0x36/0xc0 drivers/input/ff-core.c:240 uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:282 input_flush_device+0x5a/0x80 drivers/input/input.c:684 evdev_release+0x19f/0x1b0 drivers/input/evdev.c:444 __fput+0x1d3/0x4c0 fs/file_table.c:378 task_work_run+0x8f/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x1f3/0x200 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1e/0x60 kernel/entry/common.c:297 do_syscall_64+0x4c/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 RIP: 0033:0x7f3d8618e9a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3d86f39038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffed RBX: 00007f3d863b5fa0 RCX: 00007f3d8618e9a9 RDX: 0000200000000300 RSI: 0000000040304580 RDI: 0000000000000004 RBP: 00007f3d86210d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f3d863b5fa0 R15: 00007ffdd59fe5b8