program: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0}, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/serio/devices/serio2/drvctl\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='psmouse', 0x7) [ 115.331327][ T46] Bluetooth: hci0: command tx timeout [ 115.448792][ T5336] misc userio: Invalid payload size [ 116.296106][ T5335] [ 116.297199][ T5335] ====================================================== [ 116.300093][ T5335] WARNING: possible circular locking dependency detected [ 116.303174][ T5335] syzkaller #0 Not tainted [ 116.305151][ T5335] ------------------------------------------------------ [ 116.308296][ T5335] syz.0.0/5335 is trying to acquire lock: [ 116.310826][ T5335] ffff8880121e4788 (kn->active#67){++++}-{0:0}, at: __kernfs_remove+0x493/0x8e0 [ 116.314805][ T5335] [ 116.314805][ T5335] but task is already holding lock: [ 116.317891][ T5335] ffffffff8fcc3020 (serio_mutex){+.+.}-{4:4}, at: serio_unregister_port+0x2f/0x150 [ 116.321968][ T5335] [ 116.321968][ T5335] which lock already depends on the new lock. [ 116.321968][ T5335] [ 116.326385][ T5335] [ 116.326385][ T5335] the existing dependency chain (in reverse order) is: [ 116.330246][ T5335] [ 116.330246][ T5335] -> #1 (serio_mutex){+.+.}-{4:4}: [ 116.333398][ T5335] __mutex_lock+0x19d/0x1550 [ 116.335707][ T5335] drvctl_store+0x35/0x11e0 [ 116.337883][ T5335] kernfs_fop_write_iter+0x3a4/0x540 [ 116.340432][ T5335] vfs_write+0x612/0xba0 [ 116.342539][ T5335] ksys_write+0x150/0x270 [ 116.344699][ T5335] do_syscall_64+0x166/0x520 [ 116.346943][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.349700][ T5335] [ 116.349700][ T5335] -> #0 (kn->active#67){++++}-{0:0}: [ 116.352927][ T5335] __lock_acquire+0x164c/0x2de0 [ 116.355270][ T5335] lock_acquire+0x115/0x350 [ 116.357427][ T5335] kernfs_drain+0x293/0x640 [ 116.359615][ T5335] __kernfs_remove+0x493/0x8e0 [ 116.361786][ T5335] kernfs_remove_by_name_ns+0xc0/0x140 [ 116.364407][ T5335] sysfs_remove_group+0x101/0x2e0 [ 116.366766][ T5335] sysfs_remove_groups+0x54/0xb0 [ 116.369127][ T5335] device_remove_attrs+0x1cb/0x280 [ 116.371648][ T5335] device_del+0x51c/0x8f0 [ 116.373790][ T5335] serio_destroy_port+0x57a/0x840 [ 116.376240][ T5335] serio_unregister_port+0x130/0x150 [ 116.378767][ T5335] userio_char_release+0x80/0xc0 [ 116.381018][ T5335] __fput+0x418/0xa50 [ 116.383074][ T5335] task_work_run+0x1d9/0x270 [ 116.385255][ T5335] exit_to_user_mode_loop+0x204/0x770 [ 116.387768][ T5335] do_syscall_64+0x328/0x520 [ 116.390048][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.392800][ T5335] [ 116.392800][ T5335] other info that might help us debug this: [ 116.392800][ T5335] [ 116.397321][ T5335] Possible unsafe locking scenario: [ 116.397321][ T5335] [ 116.400572][ T5335] CPU0 CPU1 [ 116.403028][ T5335] ---- ---- [ 116.405444][ T5335] lock(serio_mutex); [ 116.407290][ T5335] lock(kn->active#67); [ 116.411813][ T5335] lock(serio_mutex); [ 116.414958][ T5335] lock(kn->active#67); [ 116.416921][ T5335] [ 116.416921][ T5335] *** DEADLOCK *** [ 116.416921][ T5335] [ 116.420440][ T5335] locks held by syz.0.0/5335: 1, last CPU#0: [ 116.422947][ T5335] #0: ffffffff8fcc3020 (serio_mutex){+.+.}-{4:4}, at: serio_unregister_port+0x2f/0x150 [ 116.426975][ T5335] [ 116.426975][ T5335] stack backtrace: [ 116.429500][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 116.433102][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.437535][ T5335] Call Trace: [ 116.439699][ T5335] [ 116.441045][ T5335] dump_stack_lvl+0xe8/0x150 [ 116.443106][ T5335] print_circular_bug+0x2e2/0x300 [ 116.445407][ T5335] check_noncircular+0x12f/0x150 [ 116.447677][ T5335] __lock_acquire+0x164c/0x2de0 [ 116.449766][ T5335] ? kasan_save_stack+0x4d/0x60 [ 116.451930][ T5335] ? call_rcu+0xee/0x8b0 [ 116.453821][ T5335] ? kernfs_remove_by_name_ns+0xc8/0x140 [ 116.456342][ T5335] ? sysfs_remove_group+0x101/0x2e0 [ 116.458681][ T5335] ? __lock_acquire+0x747/0x2de0 [ 116.460803][ T5335] lock_acquire+0x115/0x350 [ 116.462853][ T5335] ? __kernfs_remove+0x493/0x8e0 [ 116.465031][ T5335] kernfs_drain+0x293/0x640 [ 116.467117][ T5335] ? __kernfs_remove+0x493/0x8e0 [ 116.469292][ T5335] ? __pfx_kernfs_drain+0x10/0x10 [ 116.471570][ T5335] ? __kernfs_remove+0x318/0x8e0 [ 116.473804][ T5335] ? up_write+0x19d/0x4a0 [ 116.475785][ T5335] __kernfs_remove+0x493/0x8e0 [ 116.477910][ T5335] ? kernfs_find_ns+0x6f8/0x770 [ 116.480027][ T5335] kernfs_remove_by_name_ns+0xc0/0x140 [ 116.482460][ T5335] sysfs_remove_group+0x101/0x2e0 [ 116.484756][ T5335] sysfs_remove_groups+0x54/0xb0 [ 116.487007][ T5335] device_remove_attrs+0x1cb/0x280 [ 116.489426][ T5335] ? __pfx_device_remove_attrs+0x10/0x10 [ 116.491970][ T5335] ? kernfs_remove_by_name_ns+0x101/0x140 [ 116.494315][ T5335] device_del+0x51c/0x8f0 [ 116.496103][ T5335] ? __pfx_device_del+0x10/0x10 [ 116.498305][ T5335] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 116.500843][ T5335] serio_destroy_port+0x57a/0x840 [ 116.503166][ T5335] serio_unregister_port+0x130/0x150 [ 116.505601][ T5335] userio_char_release+0x80/0xc0 [ 116.507871][ T5335] ? __pfx_userio_char_release+0x10/0x10 [ 116.510413][ T5335] __fput+0x418/0xa50 [ 116.513815][ T5335] task_work_run+0x1d9/0x270 [ 116.515973][ T5335] ? __pfx_task_work_run+0x10/0x10 [ 116.518328][ T5335] exit_to_user_mode_loop+0x204/0x770 [ 116.520696][ T5335] ? rcu_is_watching+0x16/0xb0 [ 116.522833][ T5335] do_syscall_64+0x328/0x520 [ 116.525150][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.527967][ T5335] ? clear_bhb_loop+0x70/0xc0 [ 116.530142][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.532798][ T5335] RIP: 0033:0x7f0b9199e159 [ 116.534846][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.543121][ T5335] RSP: 002b:00007ffcaac6ec18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 116.546746][ T5335] RAX: 0000000000000000 RBX: 00007f0b91c27da0 RCX: 00007f0b9199e159 [ 116.549978][ T5335] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 116.553266][ T5335] RBP: 00007f0b91c27da0 R08: 0000000000000006 R09: 0000000000000000 [ 116.556577][ T5335] R10: 00007f0b91c27cb0 R11: 0000000000000246 R12: 000000000001c582 [ 116.559886][ T5335] R13: 00007f0b91c25fac R14: 000000000001c293 R15: 00007ffcaac6ed20 [ 116.563328][ T5335]