[PATCH] input/evdev: move kill_fasync() outside buffer_lock to fix SOFTIRQ deadlock

[PATCH] input/evdev: move kill_fasync() outside buffer_lock to fix SOFTIRQ deadlock

[Rik van Riel]

buffer_lock is a SOFTIRQ-safe spinlock. kill_fasync() acquires fa_lock
(SOFTIRQ-unsafe), creating a potential SOFTIRQ-safe->SOFTIRQ-unsafe lock
ordering violation that lockdep flags as a deadlock.

Fix by moving the kill_fasync() call to evdev_pass_values() after
buffer_lock is released, alongside the existing wake_up_interruptible_poll().

The wakeup condition check is the same in __pass_event() and
evdev_pass_values()

Found by syzkaller

Assisted-by: Claude:claude-opus-4.7
Signed-off-by: Rik van Riel <riel@surriel.com>
---
 drivers/input/evdev.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c7325226cb86..bda63f7a507a 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -235,10 +235,8 @@ static void __pass_event(struct evdev_client *client,
 		client->packet_head = client->tail;
 	}
 
-	if (event->type == EV_SYN && event->code == SYN_REPORT) {
+	if (event->type == EV_SYN && event->code == SYN_REPORT)
 		client->packet_head = client->head;
-		kill_fasync(&client->fasync, SIGIO, POLL_IN);
-	}
 }
 
 static void evdev_pass_values(struct evdev_client *client,
@@ -280,9 +278,11 @@ static void evdev_pass_values(struct evdev_client *client,
 
 	spin_unlock(&client->buffer_lock);
 
-	if (wakeup)
+	if (wakeup) {
+		kill_fasync(&client->fasync, SIGIO, POLL_IN);
 		wake_up_interruptible_poll(&client->wait,
 			EPOLLIN | EPOLLOUT | EPOLLRDNORM | EPOLLWRNORM);
+	}
 }
 
 /*
-- 
2.53.0-Meta

Re: [PATCH] input/evdev: move kill_fasync() outside buffer_lock to fix SOFTIRQ deadlock

[Dmitry Torokhov]

Hi Rik,

On Wed, May 13, 2026 at 11:50:00AM -0400, Rik van Riel wrote:
> buffer_lock is a SOFTIRQ-safe spinlock. kill_fasync() acquires fa_lock
> (SOFTIRQ-unsafe), creating a potential SOFTIRQ-safe->SOFTIRQ-unsafe lock
> ordering violation that lockdep flags as a deadlock.
> 
> Fix by moving the kill_fasync() call to evdev_pass_values() after
> buffer_lock is released, alongside the existing wake_up_interruptible_poll().
> 
> The wakeup condition check is the same in __pass_event() and
> evdev_pass_values()

Does this really fix anything? This code is running holding
input->event_lock with IRQs off...

Thanks.

-- 
Dmitry