* [syzbot] [input?] possible deadlock in input_ff_flush
@ 2025-01-05 12:40 syzbot
2025-01-06 10:29 ` [syzbot] " syzbot
` (3 more replies)
0 siblings, 4 replies; 8+ messages in thread
From: syzbot @ 2025-01-05 12:40 UTC (permalink / raw)
To: dmitry.torokhov, linux-input, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1613fac4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=dc863cc90857c683
dashboard link: https://syzkaller.appspot.com/bug?extid=ed7c6209f62eba1565aa
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17bd56df980000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-ccb98cce.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1f85617cae1e/vmlinux-ccb98cce.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0dc4d6c6c931/bzImage-ccb98cce.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ed7c6209f62eba1565aa@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0 Not tainted
------------------------------------------------------
udevd/5941 is trying to acquire lock:
ffff8880293600b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
but task is already holding lock:
ffff88804d45b2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4b/0xd0 drivers/input/input.c:647
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&dev->mutex#2){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
input_register_handle+0xca/0x5e0 drivers/input/input.c:2725
kbd_connect+0xca/0x160 drivers/tty/vt/keyboard.c:1587
input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:1032
input_register_device+0xa84/0x1110 drivers/input/input.c:2475
acpi_button_add+0x57a/0xb70 drivers/acpi/button.c:615
acpi_device_probe+0xc6/0x330 drivers/acpi/bus.c:1076
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
__driver_attach+0x283/0x580 drivers/base/dd.c:1216
bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:370
bus_add_driver+0x2e9/0x690 drivers/base/bus.c:675
driver_register+0x15c/0x4b0 drivers/base/driver.c:246
__acpi_bus_register_driver+0xdf/0x130 drivers/acpi/bus.c:1027
acpi_button_register_driver drivers/acpi/button.c:745 [inline]
acpi_button_driver_init+0x82/0x110 drivers/acpi/button.c:754
do_one_initcall+0x128/0x700 init/main.c:1266
do_initcall_level init/main.c:1328 [inline]
do_initcalls init/main.c:1344 [inline]
do_basic_setup init/main.c:1363 [inline]
kernel_init_freeable+0x5c7/0x900 init/main.c:1577
kernel_init+0x1c/0x2b0 init/main.c:1466
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #2 (input_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
input_register_device+0x98a/0x1110 drivers/input/input.c:2468
uinput_create_device drivers/input/misc/uinput.c:365 [inline]
uinput_ioctl_handler.isra.0+0x130c/0x1d70 drivers/input/misc/uinput.c:918
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&newdev->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x175/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x55b/0xbf0 drivers/input/ff-core.c:152
evdev_do_ioctl+0xf45/0x1ae0 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16a/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ff->mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0x97/0xd0 drivers/input/input.c:652
evdev_release+0x33d/0x400 drivers/input/evdev.c:435
__fput+0x3f8/0xb60 fs/file_table.c:450
__fput_sync+0xa1/0xc0 fs/file_table.c:535
__do_sys_close fs/open.c:1554 [inline]
__se_sys_close fs/open.c:1539 [inline]
__x64_sys_close+0x86/0x100 fs/open.c:1539
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&ff->mutex --> input_mutex --> &dev->mutex#2
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mutex#2);
lock(input_mutex);
lock(&dev->mutex#2);
lock(&ff->mutex);
*** DEADLOCK ***
2 locks held by udevd/5941:
#0: ffff888024d58118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x77/0x400 drivers/input/evdev.c:432
#1: ffff88804d45b2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4b/0xd0 drivers/input/input.c:647
stack backtrace:
CPU: 2 UID: 0 PID: 5941 Comm: udevd Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0x97/0xd0 drivers/input/input.c:652
evdev_release+0x33d/0x400 drivers/input/evdev.c:435
__fput+0x3f8/0xb60 fs/file_table.c:450
__fput_sync+0xa1/0xc0 fs/file_table.c:535
__do_sys_close fs/open.c:1554 [inline]
__se_sys_close fs/open.c:1539 [inline]
__x64_sys_close+0x86/0x100 fs/open.c:1539
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1d757850a8
Code: 48 8b 05 83 9d 0d 00 64 c7 00 16 00 00 00 83 c8 ff 48 83 c4 20 5b c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 5b 48 8b 15 51 9d 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fffb61bcef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f1d756b10e0 RCX: 00007f1d757850a8
RDX: fffffffffffffe60 RSI: 0000000080184540 RDI: 0000000000000008
RBP: 00005620d7ea5160 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000016
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-01-05 12:40 [syzbot] [input?] possible deadlock in input_ff_flush syzbot
@ 2025-01-06 10:29 ` syzbot
2025-01-06 11:08 ` Hillf Danton
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-01-06 10:29 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [input?] possible deadlock in input_ff_flush
Author: hdanton@sina.com
On Sun, 05 Jan 2025 04:40:19 -0800
> syzbot found the following issue on:
>
> HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17bd56df980000
#syz test
--- x/drivers/input/input.c
+++ y/drivers/input/input.c
@@ -642,17 +642,11 @@ EXPORT_SYMBOL(input_open_device);
int input_flush_device(struct input_handle *handle, struct file *file)
{
struct input_dev *dev = handle->dev;
- int retval;
-
- retval = mutex_lock_interruptible(&dev->mutex);
- if (retval)
- return retval;
if (dev->flush)
- retval = dev->flush(dev, file);
+ return dev->flush(dev, file);
- mutex_unlock(&dev->mutex);
- return retval;
+ return 0;
}
EXPORT_SYMBOL(input_flush_device);
--
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-01-05 12:40 [syzbot] [input?] possible deadlock in input_ff_flush syzbot
2025-01-06 10:29 ` [syzbot] " syzbot
@ 2025-01-06 11:08 ` Hillf Danton
2025-01-06 11:27 ` syzbot
2025-01-07 10:45 ` Hillf Danton
2025-07-26 18:46 ` syzbot
3 siblings, 1 reply; 8+ messages in thread
From: Hillf Danton @ 2025-01-06 11:08 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sun, 05 Jan 2025 04:40:19 -0800
> syzbot found the following issue on:
>
> HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17bd56df980000
#syz test
--- x/drivers/input/input.c
+++ y/drivers/input/input.c
@@ -642,17 +642,11 @@ EXPORT_SYMBOL(input_open_device);
int input_flush_device(struct input_handle *handle, struct file *file)
{
struct input_dev *dev = handle->dev;
- int retval;
-
- retval = mutex_lock_interruptible(&dev->mutex);
- if (retval)
- return retval;
if (dev->flush)
- retval = dev->flush(dev, file);
+ return dev->flush(dev, file);
- mutex_unlock(&dev->mutex);
- return retval;
+ return 0;
}
EXPORT_SYMBOL(input_flush_device);
--- x/mm/vmstat.c
+++ y/mm/vmstat.c
@@ -2122,9 +2122,11 @@ static void __init start_shepherd_timer(
{
int cpu;
- for_each_possible_cpu(cpu)
+ for_each_possible_cpu(cpu) {
INIT_DEFERRABLE_WORK(per_cpu_ptr(&vmstat_work, cpu),
vmstat_update);
+ disable_delayed_work(per_cpu_ptr(&vmstat_work, cpu));
+ }
schedule_delayed_work(&shepherd,
round_jiffies_relative(sysctl_stat_interval));
--
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-01-06 11:08 ` Hillf Danton
@ 2025-01-06 11:27 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-01-06 11:27 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in evdev_cleanup
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc6-syzkaller-g9d89551994a4-dirty #0 Not tainted
------------------------------------------------------
syz.1.17/6488 is trying to acquire lock:
ffff888035d51118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_mark_dead drivers/input/evdev.c:1311 [inline]
ffff888035d51118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_cleanup+0x21/0x1a0 drivers/input/evdev.c:1320
but task is already holding lock:
ffffffff8f7250e8 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x136/0x450 drivers/input/input.c:2271
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (input_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
input_register_device+0x98a/0x1110 drivers/input/input.c:2462
uinput_create_device drivers/input/misc/uinput.c:365 [inline]
uinput_ioctl_handler.isra.0+0x130c/0x1d70 drivers/input/misc/uinput.c:918
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&newdev->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x175/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x55b/0xbf0 drivers/input/ff-core.c:152
evdev_do_ioctl+0xf45/0x1ae0 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16a/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&ff->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0x6e/0xa0 drivers/input/input.c:647
evdev_release+0x33d/0x400 drivers/input/evdev.c:435
__fput+0x3f8/0xb60 fs/file_table.c:450
__fput_sync+0xa1/0xc0 fs/file_table.c:535
__do_sys_close fs/open.c:1554 [inline]
__se_sys_close fs/open.c:1539 [inline]
__x64_sys_close+0x86/0x100 fs/open.c:1539
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&evdev->mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
evdev_mark_dead drivers/input/evdev.c:1311 [inline]
evdev_cleanup+0x21/0x1a0 drivers/input/evdev.c:1320
evdev_disconnect+0x48/0xb0 drivers/input/evdev.c:1404
__input_unregister_device+0x1d5/0x450 drivers/input/input.c:2274
input_unregister_device+0xb9/0x100 drivers/input/input.c:2510
uinput_destroy_device+0x1f4/0x260 drivers/input/misc/uinput.c:299
uinput_release+0x34/0x50 drivers/input/misc/uinput.c:758
__fput+0x3f8/0xb60 fs/file_table.c:450
task_work_run+0x14e/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&evdev->mutex --> &newdev->mutex --> input_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(input_mutex);
lock(&newdev->mutex);
lock(input_mutex);
lock(&evdev->mutex);
*** DEADLOCK ***
1 lock held by syz.1.17/6488:
#0: ffffffff8f7250e8 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x136/0x450 drivers/input/input.c:2271
stack backtrace:
CPU: 1 UID: 0 PID: 6488 Comm: syz.1.17 Not tainted 6.13.0-rc6-syzkaller-g9d89551994a4-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
evdev_mark_dead drivers/input/evdev.c:1311 [inline]
evdev_cleanup+0x21/0x1a0 drivers/input/evdev.c:1320
evdev_disconnect+0x48/0xb0 drivers/input/evdev.c:1404
__input_unregister_device+0x1d5/0x450 drivers/input/input.c:2274
input_unregister_device+0xb9/0x100 drivers/input/input.c:2510
uinput_destroy_device+0x1f4/0x260 drivers/input/misc/uinput.c:299
uinput_release+0x34/0x50 drivers/input/misc/uinput.c:758
__fput+0x3f8/0xb60 fs/file_table.c:450
task_work_run+0x14e/0x250 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00f5385d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc4d0ae08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f00f5577ba0 RCX: 00007f00f5385d29
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f00f5577ba0 R08: 0000000000000000 R09: 00007ffdc4d0b0ff
R10: 00007f00f5577ac0 R11: 0000000000000246 R12: 0000000000012434
R13: 00007ffdc4d0af10 R14: 0000000000000032 R15: ffffffffffffffff
</TASK>
Tested on:
commit: 9d895519 Linux 6.13-rc6
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=172936f8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7bdfbaac3fbb90d6
dashboard link: https://syzkaller.appspot.com/bug?extid=ed7c6209f62eba1565aa
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10ab3418580000
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-01-05 12:40 [syzbot] [input?] possible deadlock in input_ff_flush syzbot
2025-01-06 10:29 ` [syzbot] " syzbot
2025-01-06 11:08 ` Hillf Danton
@ 2025-01-07 10:45 ` Hillf Danton
2025-07-26 18:46 ` syzbot
3 siblings, 0 replies; 8+ messages in thread
From: Hillf Danton @ 2025-01-07 10:45 UTC (permalink / raw)
To: dmitry.torokhov, Boqun Feng
Cc: syzbot, Tetsuo Handa, linux-input, linux-kernel, syzkaller-bugs
On Sun, 05 Jan 2025 04:40:19 -0800
> syzbot found the following issue on:
>
> HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1613fac4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=dc863cc90857c683
> dashboard link: https://syzkaller.appspot.com/bug?extid=ed7c6209f62eba1565aa
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17bd56df980000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-ccb98cce.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1f85617cae1e/vmlinux-ccb98cce.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/0dc4d6c6c931/bzImage-ccb98cce.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ed7c6209f62eba1565aa@syzkaller.appspotmail.com
>
> ======================================================
> WARNING: possible circular locking dependency detected
> 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0 Not tainted
> ------------------------------------------------------
> udevd/5941 is trying to acquire lock:
> ffff8880293600b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
>
> but task is already holding lock:
> ffff88804d45b2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4b/0xd0 drivers/input/input.c:647
>
> which lock already depends on the new lock.
>
>
> the existing dependency chain (in reverse order) is:
>
> -> #3 (&dev->mutex#2){+.+.}-{4:4}:
> __mutex_lock_common kernel/locking/mutex.c:585 [inline]
> __mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
> input_register_handle+0xca/0x5e0 drivers/input/input.c:2725
> kbd_connect+0xca/0x160 drivers/tty/vt/keyboard.c:1587
> input_attach_handler.isra.0+0x181/0x260 drivers/input/input.c:1032
> input_register_device+0xa84/0x1110 drivers/input/input.c:2475
> acpi_button_add+0x57a/0xb70 drivers/acpi/button.c:615
> acpi_device_probe+0xc6/0x330 drivers/acpi/bus.c:1076
> call_driver_probe drivers/base/dd.c:579 [inline]
> really_probe+0x23e/0xa90 drivers/base/dd.c:658
> __driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
> driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
> __driver_attach+0x283/0x580 drivers/base/dd.c:1216
> bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:370
> bus_add_driver+0x2e9/0x690 drivers/base/bus.c:675
> driver_register+0x15c/0x4b0 drivers/base/driver.c:246
> __acpi_bus_register_driver+0xdf/0x130 drivers/acpi/bus.c:1027
> acpi_button_register_driver drivers/acpi/button.c:745 [inline]
> acpi_button_driver_init+0x82/0x110 drivers/acpi/button.c:754
> do_one_initcall+0x128/0x700 init/main.c:1266
> do_initcall_level init/main.c:1328 [inline]
> do_initcalls init/main.c:1344 [inline]
> do_basic_setup init/main.c:1363 [inline]
> kernel_init_freeable+0x5c7/0x900 init/main.c:1577
> kernel_init+0x1c/0x2b0 init/main.c:1466
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> -> #2 (input_mutex){+.+.}-{4:4}:
> __mutex_lock_common kernel/locking/mutex.c:585 [inline]
> __mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
> input_register_device+0x98a/0x1110 drivers/input/input.c:2468
> uinput_create_device drivers/input/misc/uinput.c:365 [inline]
The upload callback is set [1] before registering the input device.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/input/misc/uinput.c?id=ccb98ccef0e5#n348
> uinput_ioctl_handler.isra.0+0x130c/0x1d70 drivers/input/misc/uinput.c:918
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline]
> __se_sys_ioctl fs/ioctl.c:892 [inline]
> __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #1 (&newdev->mutex){+.+.}-{4:4}:
> __mutex_lock_common kernel/locking/mutex.c:585 [inline]
> __mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
> uinput_request_send drivers/input/misc/uinput.c:151 [inline]
> uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
> uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
> uinput_dev_upload_effect+0x175/0x1f0 drivers/input/misc/uinput.c:257
> input_ff_upload+0x55b/0xbf0 drivers/input/ff-core.c:152
The dependence of #1 on #2 does not exist from the functional POV as
the upload callback can not be invoked before it is inited. So this
report is false positive.
> evdev_do_ioctl+0xf45/0x1ae0 drivers/input/evdev.c:1181
> evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
> evdev_ioctl+0x16a/0x1a0 drivers/input/evdev.c:1279
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline]
> __se_sys_ioctl fs/ioctl.c:892 [inline]
> __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #0 (&ff->mutex){+.+.}-{4:4}:
> check_prev_add kernel/locking/lockdep.c:3161 [inline]
> check_prevs_add kernel/locking/lockdep.c:3280 [inline]
> validate_chain kernel/locking/lockdep.c:3904 [inline]
> __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
> lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
> __mutex_lock_common kernel/locking/mutex.c:585 [inline]
> __mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
> input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
> uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
> input_flush_device+0x97/0xd0 drivers/input/input.c:652
> evdev_release+0x33d/0x400 drivers/input/evdev.c:435
> __fput+0x3f8/0xb60 fs/file_table.c:450
> __fput_sync+0xa1/0xc0 fs/file_table.c:535
> __do_sys_close fs/open.c:1554 [inline]
> __se_sys_close fs/open.c:1539 [inline]
> __x64_sys_close+0x86/0x100 fs/open.c:1539
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> other info that might help us debug this:
>
> Chain exists of:
> &ff->mutex --> input_mutex --> &dev->mutex#2
>
> Possible unsafe locking scenario:
>
> CPU0 CPU1
> ---- ----
> lock(&dev->mutex#2);
> lock(input_mutex);
> lock(&dev->mutex#2);
> lock(&ff->mutex);
>
> *** DEADLOCK ***
>
> 2 locks held by udevd/5941:
> #0: ffff888024d58118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x77/0x400 drivers/input/evdev.c:432
> #1: ffff88804d45b2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4b/0xd0 drivers/input/input.c:647
>
> stack backtrace:
> CPU: 2 UID: 0 PID: 5941 Comm: udevd Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
> print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074
> check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
> check_prev_add kernel/locking/lockdep.c:3161 [inline]
> check_prevs_add kernel/locking/lockdep.c:3280 [inline]
> validate_chain kernel/locking/lockdep.c:3904 [inline]
> __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5226
> lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
> __mutex_lock_common kernel/locking/mutex.c:585 [inline]
> __mutex_lock+0x19b/0xa60 kernel/locking/mutex.c:735
> input_ff_flush+0x63/0x170 drivers/input/ff-core.c:242
> uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
> input_flush_device+0x97/0xd0 drivers/input/input.c:652
> evdev_release+0x33d/0x400 drivers/input/evdev.c:435
> __fput+0x3f8/0xb60 fs/file_table.c:450
> __fput_sync+0xa1/0xc0 fs/file_table.c:535
> __do_sys_close fs/open.c:1554 [inline]
> __se_sys_close fs/open.c:1539 [inline]
> __x64_sys_close+0x86/0x100 fs/open.c:1539
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f1d757850a8
> Code: 48 8b 05 83 9d 0d 00 64 c7 00 16 00 00 00 83 c8 ff 48 83 c4 20 5b c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 5b 48 8b 15 51 9d 0d 00 f7 d8 64 89 02 48 83
> RSP: 002b:00007fffb61bcef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
> RAX: ffffffffffffffda RBX: 00007f1d756b10e0 RCX: 00007f1d757850a8
> RDX: fffffffffffffe60 RSI: 0000000080184540 RDI: 0000000000000008
> RBP: 00005620d7ea5160 R08: 00000000ffffffff R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000016
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-01-05 12:40 [syzbot] [input?] possible deadlock in input_ff_flush syzbot
` (2 preceding siblings ...)
2025-01-07 10:45 ` Hillf Danton
@ 2025-07-26 18:46 ` syzbot
2025-07-27 3:59 ` Hillf Danton
3 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2025-07-26 18:46 UTC (permalink / raw)
To: boqun.feng, dmitry.torokhov, hdanton, linux-input, linux-kernel,
penguin-kernel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 5f33ebd2018c Merge tag 'drm-fixes-2025-07-26' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=130d4034580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9f175a9275d2cdd7
dashboard link: https://syzkaller.appspot.com/bug?extid=ed7c6209f62eba1565aa
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=108d4034580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=148d4034580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/744f4180f939/disk-5f33ebd2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/473dde4ed605/vmlinux-5f33ebd2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8a27e8b2b834/bzImage-5f33ebd2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ed7c6209f62eba1565aa@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 Not tainted
------------------------------------------------------
udevd/5831 is trying to acquire lock:
ffff8880259b80b0 (&ff->mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:225 [inline]
ffff8880259b80b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x63/0x180 drivers/input/ff-core.c:231
but task is already holding lock:
ffff8880268022c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:227 [inline]
ffff8880268022c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x55/0x110 drivers/input/input.c:625
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&dev->mutex#2){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
class_mutex_intr_constructor include/linux/mutex.h:227 [inline]
input_register_handle+0xdc/0x620 drivers/input/input.c:2653
kbd_connect+0xca/0x160 drivers/tty/vt/keyboard.c:1580
input_attach_handler.isra.0+0x184/0x260 drivers/input/input.c:993
input_register_device+0xa84/0x1130 drivers/input/input.c:2412
acpi_button_add+0x582/0xb70 drivers/acpi/button.c:621
acpi_device_probe+0xc6/0x330 drivers/acpi/bus.c:1076
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__driver_attach+0x283/0x580 drivers/base/dd.c:1215
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:370
bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678
driver_register+0x15c/0x4b0 drivers/base/driver.c:249
__acpi_bus_register_driver+0xdf/0x130 drivers/acpi/bus.c:1027
acpi_button_register_driver drivers/acpi/button.c:751 [inline]
acpi_button_driver_init+0x82/0x110 drivers/acpi/button.c:760
do_one_initcall+0x120/0x6e0 init/main.c:1274
do_initcall_level init/main.c:1336 [inline]
do_initcalls init/main.c:1352 [inline]
do_basic_setup init/main.c:1371 [inline]
kernel_init_freeable+0x5c2/0x900 init/main.c:1584
kernel_init+0x1c/0x2b0 init/main.c:1474
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (input_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
class_mutex_intr_constructor include/linux/mutex.h:227 [inline]
input_register_device+0x98a/0x1130 drivers/input/input.c:2408
uinput_create_device drivers/input/misc/uinput.c:365 [inline]
uinput_ioctl_handler.isra.0+0x1357/0x1df0 drivers/input/misc/uinput.c:918
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&newdev->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
uinput_request_send drivers/input/misc/uinput.c:151 [inline]
uinput_request_submit.part.0+0x25/0x2e0 drivers/input/misc/uinput.c:182
uinput_request_submit drivers/input/misc/uinput.c:179 [inline]
uinput_dev_upload_effect+0x174/0x1f0 drivers/input/misc/uinput.c:257
input_ff_upload+0x568/0xc10 drivers/input/ff-core.c:148
evdev_do_ioctl+0xf40/0x1b30 drivers/input/evdev.c:1181
evdev_ioctl_handler drivers/input/evdev.c:1270 [inline]
evdev_ioctl+0x16f/0x1a0 drivers/input/evdev.c:1279
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ff->mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3168 [inline]
check_prevs_add kernel/locking/lockdep.c:3287 [inline]
validate_chain kernel/locking/lockdep.c:3911 [inline]
__lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
class_mutex_constructor include/linux/mutex.h:225 [inline]
input_ff_flush+0x63/0x180 drivers/input/ff-core.c:231
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0xa1/0x110 drivers/input/input.c:627
evdev_release+0x344/0x420 drivers/input/evdev.c:435
__fput+0x3ff/0xb70 fs/file_table.c:465
fput_close_sync+0x118/0x260 fs/file_table.c:570
__do_sys_close fs/open.c:1589 [inline]
__se_sys_close fs/open.c:1574 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1574
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&ff->mutex --> input_mutex --> &dev->mutex#2
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mutex#2);
lock(input_mutex);
lock(&dev->mutex#2);
lock(&ff->mutex);
*** DEADLOCK ***
2 locks held by udevd/5831:
#0: ffff888026803118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x79/0x420 drivers/input/evdev.c:432
#1: ffff8880268022c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:227 [inline]
#1: ffff8880268022c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x55/0x110 drivers/input/input.c:625
stack backtrace:
CPU: 0 UID: 0 PID: 5831 Comm: udevd Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2046
check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2178
check_prev_add kernel/locking/lockdep.c:3168 [inline]
check_prevs_add kernel/locking/lockdep.c:3287 [inline]
validate_chain kernel/locking/lockdep.c:3911 [inline]
__lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
__mutex_lock_common kernel/locking/mutex.c:602 [inline]
__mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
class_mutex_constructor include/linux/mutex.h:225 [inline]
input_ff_flush+0x63/0x180 drivers/input/ff-core.c:231
uinput_dev_flush+0x2a/0x40 drivers/input/misc/uinput.c:283
input_flush_device+0xa1/0x110 drivers/input/input.c:627
evdev_release+0x344/0x420 drivers/input/evdev.c:435
__fput+0x3ff/0xb70 fs/file_table.c:465
fput_close_sync+0x118/0x260 fs/file_table.c:570
__do_sys_close fs/open.c:1589 [inline]
__se_sys_close fs/open.c:1574 [inline]
__x64_sys_close+0x8b/0x120 fs/open.c:1574
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c2f2a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff6a7623b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f7c2fa12880 RCX: 00007f7c2f2a7407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 00007f7c2fa126e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000016
R13: 00007fff6a7624c0 R14: 0000000000000000 R15: 0000000000000000
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-07-26 18:46 ` syzbot
@ 2025-07-27 3:59 ` Hillf Danton
2025-07-27 4:48 ` syzbot
0 siblings, 1 reply; 8+ messages in thread
From: Hillf Danton @ 2025-07-27 3:59 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Sat, 26 Jul 2025 11:46:30 -0700 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 5f33ebd2018c Merge tag 'drm-fixes-2025-07-26' of https://g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=130d4034580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=9f175a9275d2cdd7
> dashboard link: https://syzkaller.appspot.com/bug?extid=ed7c6209f62eba1565aa
> compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=108d4034580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=148d4034580000
#syz test
--- x/drivers/input/misc/uinput.c
+++ y/drivers/input/misc/uinput.c
@@ -35,7 +35,7 @@
#define UINPUT_NUM_REQUESTS 16
#define UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS 10
-enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED };
+enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_REGISTERING, UIST_CREATED };
struct uinput_request {
unsigned int id;
@@ -289,6 +289,8 @@ static void uinput_destroy_device(struct
struct input_dev *dev = udev->dev;
enum uinput_state old_state = udev->state;
+ if (udev->state == UIST_REGISTERING)
+ return;
udev->state = UIST_NEW_DEVICE;
if (dev) {
@@ -309,8 +311,10 @@ static void uinput_destroy_device(struct
static int uinput_create_device(struct uinput_device *udev)
{
struct input_dev *dev = udev->dev;
+ enum uinput_state old_state = udev->state;
int error, nslot;
+ lockdep_assert_held(&udev->mutex);
if (udev->state != UIST_SETUP_COMPLETE) {
printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
return -EINVAL;
@@ -362,7 +366,11 @@ static int uinput_create_device(struct u
input_set_drvdata(udev->dev, udev);
+ udev->state = UIST_REGISTERING;
+ mutex_unlock(&udev->mutex);
error = input_register_device(udev->dev);
+ mutex_lock(&udev->mutex);
+ udev->state = old_state;
if (error)
goto fail2;
--
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [input?] possible deadlock in input_ff_flush
2025-07-27 3:59 ` Hillf Danton
@ 2025-07-27 4:48 ` syzbot
0 siblings, 0 replies; 8+ messages in thread
From: syzbot @ 2025-07-27 4:48 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+ed7c6209f62eba1565aa@syzkaller.appspotmail.com
Tested-by: syzbot+ed7c6209f62eba1565aa@syzkaller.appspotmail.com
Tested on:
commit: ec2df436 Merge tag 'spi-fix-v6.16-rc7' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1743e8a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9f175a9275d2cdd7
dashboard link: https://syzkaller.appspot.com/bug?extid=ed7c6209f62eba1565aa
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14b5e8a2580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-07-27 4:48 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-05 12:40 [syzbot] [input?] possible deadlock in input_ff_flush syzbot
2025-01-06 10:29 ` [syzbot] " syzbot
2025-01-06 11:08 ` Hillf Danton
2025-01-06 11:27 ` syzbot
2025-01-07 10:45 ` Hillf Danton
2025-07-26 18:46 ` syzbot
2025-07-27 3:59 ` Hillf Danton
2025-07-27 4:48 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox