====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.70/5242 is trying to acquire lock: ffff0000dc70d4b8 (kn->active#61){++++}-{0:0}, at: __kernfs_remove+0x354/0x718 fs/kernfs/dir.c:1579 but task is already holding lock: ffff8000898af0c0 (serio_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] ffff8000898af0c0 (serio_mutex){+.+.}-{4:4}, at: serio_unregister_port+0x2c/0x54 drivers/input/serio/serio.c:677 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (serio_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_interruptible_nested+0x24/0x30 kernel/locking/mutex.c:899 class_mutex_intr_constructor include/linux/mutex.h:255 [inline] drvctl_store+0x44/0x2f8 drivers/input/serio/serio.c:360 dev_attr_store+0x6c/0x90 drivers/base/core.c:2509 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 -> #0 (kn->active#61){++++}-{0:0}: check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 kernfs_drain+0x1cc/0x4d0 fs/kernfs/dir.c:532 __kernfs_remove+0x354/0x718 fs/kernfs/dir.c:1579 kernfs_remove_by_name_ns+0x70/0xd0 fs/kernfs/dir.c:1797 kernfs_remove_by_name include/linux/kernfs.h:644 [inline] remove_files+0x90/0x184 fs/sysfs/group.c:28 sysfs_remove_group+0x98/0x160 fs/sysfs/group.c:328 sysfs_remove_groups+0x5c/0xb4 fs/sysfs/group.c:352 device_remove_groups drivers/base/core.c:2918 [inline] device_remove_attrs+0x188/0x238 drivers/base/core.c:3048 device_del+0x3e4/0x71c drivers/base/core.c:3964 serio_destroy_port+0x2e0/0x3f0 drivers/input/serio/serio.c:543 serio_unregister_port+0x3c/0x54 drivers/input/serio/serio.c:680 userio_char_release+0x88/0xc4 drivers/input/serio/userio.c:105 __fput+0x338/0x74c fs/file_table.c:512 ____fput+0x20/0x30 fs/file_table.c:540 task_work_run+0x1cc/0x25c kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(serio_mutex); lock(kn->active#61); lock(serio_mutex); lock(kn->active#61); *** DEADLOCK *** locks held by syz.3.70/5242: 1, last CPU#1: #0: ffff8000898af0c0 (serio_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] #0: ffff8000898af0c0 (serio_mutex){+.+.}-{4:4}, at: serio_unregister_port+0x2c/0x54 drivers/input/serio/serio.c:677 stack backtrace: CPU: 1 UID: 0 PID: 5242 Comm: syz.3.70 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2059 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2191 check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 kernfs_drain+0x1cc/0x4d0 fs/kernfs/dir.c:532 __kernfs_remove+0x354/0x718 fs/kernfs/dir.c:1579 kernfs_remove_by_name_ns+0x70/0xd0 fs/kernfs/dir.c:1797 kernfs_remove_by_name include/linux/kernfs.h:644 [inline] remove_files+0x90/0x184 fs/sysfs/group.c:28 sysfs_remove_group+0x98/0x160 fs/sysfs/group.c:328 sysfs_remove_groups+0x5c/0xb4 fs/sysfs/group.c:352 device_remove_groups drivers/base/core.c:2918 [inline] device_remove_attrs+0x188/0x238 drivers/base/core.c:3048 device_del+0x3e4/0x71c drivers/base/core.c:3964 serio_destroy_port+0x2e0/0x3f0 drivers/input/serio/serio.c:543 serio_unregister_port+0x3c/0x54 drivers/input/serio/serio.c:680 userio_char_release+0x88/0xc4 drivers/input/serio/userio.c:105 __fput+0x338/0x74c fs/file_table.c:512 ____fput+0x20/0x30 fs/file_table.c:540 task_work_run+0x1cc/0x25c kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590