===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected syzkaller #0 Tainted: G L ----------------------------------------------------- syz.4.4242/21391 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffff8880756c26a8 (&new->fa_lock){....}-{3:3}, at: kill_fasync_rcu fs/fcntl.c:1135 [inline] ffff8880756c26a8 (&new->fa_lock){....}-{3:3}, at: kill_fasync fs/fcntl.c:1159 [inline] ffff8880756c26a8 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x138/0x510 fs/fcntl.c:1152 and this task is already holding: ffff88805c98a028 (&client->buffer_lock){..-.}-{3:3}, at: spin_lock include/linux/spinlock.h:341 [inline] ffff88805c98a028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0x19c/0x910 drivers/input/evdev.c:261 which would create a new lock dependency: (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){....}-{3:3} but this new dependency connects a SOFTIRQ-irq-safe lock: (&client->buffer_lock){..-.}-{3:3} ... which became SOFTIRQ-irq-safe at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:341 [inline] evdev_pass_values+0x19c/0x910 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x753/0x880 drivers/input/input.c:128 input_event_dispose drivers/input/input.c:353 [inline] input_handle_event+0x37f/0x1500 drivers/input/input.c:370 input_event drivers/input/input.c:396 [inline] input_event+0x8e/0xd0 drivers/input/input.c:391 hidinput_hid_event+0x4dc/0x2460 drivers/hid/hid-input.c:1751 hid_process_event+0x4bc/0x5a0 drivers/hid/hid-core.c:1565 hid_process_report drivers/hid/hid-core.c:1713 [inline] hid_report_raw_event+0x9f3/0x1320 drivers/hid/hid-core.c:2075 __hid_input_report.constprop.0+0x33f/0x460 drivers/hid/hid-core.c:2145 hid_irq_in+0x52e/0x6b0 drivers/hid/usbhid/hid-core.c:286 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995 __run_hrtimer kernel/time/hrtimer.c:1785 [inline] __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xef/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 native_save_fl arch/x86/include/asm/irqflags.h:26 [inline] arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline] arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline] lock_acquire kernel/locking/lockdep.c:5864 [inline] lock_acquire+0x17c/0x380 kernel/locking/lockdep.c:5825 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 save_stack+0x162/0x1e0 mm/page_owner.c:165 __set_page_owner+0x8c/0x540 mm/page_owner.c:341 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889 prep_new_page mm/page_alloc.c:1897 [inline] get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3962 __alloc_frozen_pages_noprof+0x27c/0x2ba0 mm/page_alloc.c:5250 __alloc_pages_noprof mm/page_alloc.c:5284 [inline] alloc_pages_bulk_noprof+0x782/0x1490 mm/page_alloc.c:5204 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline] __kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline] __kasan_populate_vmalloc+0xf0/0x210 mm/kasan/shadow.c:424 kasan_populate_vmalloc include/linux/kasan.h:580 [inline] alloc_vmap_area+0x95d/0x2bd0 mm/vmalloc.c:2129 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3232 __vmalloc_node_range_noprof+0x213/0x1530 mm/vmalloc.c:4024 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4124 xt_counters_alloc+0x4c/0x70 net/netfilter/x_tables.c:1381 __do_replace+0x97/0x990 net/ipv4/netfilter/arp_tables.c:894 compat_do_replace+0x31e/0x500 net/ipv4/netfilter/ip_tables.c:1529 do_ip6t_set_ctl+0x562/0xb00 net/ipv6/netfilter/ip6_tables.c:1641 nf_setsockopt+0x8d/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:978 tcp_setsockopt+0xa7/0x100 net/ipv4/tcp.c:4218 do_sock_setsockopt+0xf3/0x1d0 net/socket.c:2322 __sys_setsockopt+0x119/0x190 net/socket.c:2347 __do_compat_sys_socketcall net/compat.c:491 [inline] __se_compat_sys_socketcall net/compat.c:423 [inline] __ia32_compat_sys_socketcall+0x556/0x770 net/compat.c:423 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e to a SOFTIRQ-irq-unsafe lock: (tasklist_lock){.+.+}-{3:3} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:161 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x13b/0x8b0 kernel/exit.c:1678 do_wait+0x1ec/0x5a0 kernel/exit.c:1722 kernel_wait+0xa1/0x160 kernel/exit.c:1898 call_usermodehelper_exec_sync kernel/umh.c:136 [inline] call_usermodehelper_exec_work+0xf6/0x180 kernel/umh.c:163 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276 process_scheduled_works kernel/workqueue.c:3359 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Chain exists of: &client->buffer_lock --> &new->fa_lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&client->buffer_lock); lock(&new->fa_lock); lock(&client->buffer_lock); *** DEADLOCK *** 7 locks held by syz.4.4242/21391: #0: ffff888000c84118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x184/0x430 drivers/input/evdev.c:511 #1: ffff888024021230 (&dev->event_lock#2){..-.}-{3:3}, at: class_spinlock_irqsave_constructor include/linux/spinlock.h:618 [inline] #1: ffff888024021230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0x9f/0x3b0 drivers/input/input.c:419 #2: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #2: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #2: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1193 [inline] #2: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xbb/0x3b0 drivers/input/input.c:420 #3: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #3: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #3: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1193 [inline] #3: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x80/0x880 drivers/input/input.c:119 #4: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #4: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #4: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x7b/0x390 drivers/input/evdev.c:298 #5: ffff88805c98a028 (&client->buffer_lock){..-.}-{3:3}, at: spin_lock include/linux/spinlock.h:341 [inline] #5: ffff88805c98a028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0x19c/0x910 drivers/input/evdev.c:261 #6: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #6: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #6: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: kill_fasync fs/fcntl.c:1158 [inline] #6: ffffffff8e7e7660 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x62/0x510 fs/fcntl.c:1152 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (&client->buffer_lock){..-.}-{3:3} { IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:341 [inline] evdev_pass_values+0x19c/0x910 drivers/input/evdev.c:261 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x753/0x880 drivers/input/input.c:128 input_event_dispose drivers/input/input.c:353 [inline] input_handle_event+0x37f/0x1500 drivers/input/input.c:370 input_event drivers/input/input.c:396 [inline] input_event+0x8e/0xd0 drivers/input/input.c:391 hidinput_hid_event+0x4dc/0x2460 drivers/hid/hid-input.c:1751 hid_process_event+0x4bc/0x5a0 drivers/hid/hid-core.c:1565 hid_process_report drivers/hid/hid-core.c:1713 [inline] hid_report_raw_event+0x9f3/0x1320 drivers/hid/hid-core.c:2075 __hid_input_report.constprop.0+0x33f/0x460 drivers/hid/hid-core.c:2145 hid_irq_in+0x52e/0x6b0 drivers/hid/usbhid/hid-core.c:286 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741 dummy_timer+0xd85/0x3670 drivers/usb/gadget/udc/dummy_hcd.c:1995 __run_hrtimer kernel/time/hrtimer.c:1785 [inline] __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xef/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 native_save_fl arch/x86/include/asm/irqflags.h:26 [inline] arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline] arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline] lock_acquire kernel/locking/lockdep.c:5864 [inline] lock_acquire+0x17c/0x380 kernel/locking/lockdep.c:5825 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 save_stack+0x162/0x1e0 mm/page_owner.c:165 __set_page_owner+0x8c/0x540 mm/page_owner.c:341 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889 prep_new_page mm/page_alloc.c:1897 [inline] get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3962 __alloc_frozen_pages_noprof+0x27c/0x2ba0 mm/page_alloc.c:5250 __alloc_pages_noprof mm/page_alloc.c:5284 [inline] alloc_pages_bulk_noprof+0x782/0x1490 mm/page_alloc.c:5204 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline] __kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline] __kasan_populate_vmalloc+0xf0/0x210 mm/kasan/shadow.c:424 kasan_populate_vmalloc include/linux/kasan.h:580 [inline] alloc_vmap_area+0x95d/0x2bd0 mm/vmalloc.c:2129 __get_vm_area_node+0x1ca/0x330 mm/vmalloc.c:3232 __vmalloc_node_range_noprof+0x213/0x1530 mm/vmalloc.c:4024 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4124 xt_counters_alloc+0x4c/0x70 net/netfilter/x_tables.c:1381 __do_replace+0x97/0x990 net/ipv4/netfilter/arp_tables.c:894 compat_do_replace+0x31e/0x500 net/ipv4/netfilter/ip_tables.c:1529 do_ip6t_set_ctl+0x562/0xb00 net/ipv6/netfilter/ip6_tables.c:1641 nf_setsockopt+0x8d/0xf0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x135/0x170 net/ipv6/ipv6_sockglue.c:978 tcp_setsockopt+0xa7/0x100 net/ipv4/tcp.c:4218 do_sock_setsockopt+0xf3/0x1d0 net/socket.c:2322 __sys_setsockopt+0x119/0x190 net/socket.c:2347 __do_compat_sys_socketcall net/compat.c:491 [inline] __se_compat_sys_socketcall net/compat.c:423 [inline] __ia32_compat_sys_socketcall+0x556/0x770 net/compat.c:423 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:371 [inline] evdev_fetch_next_event drivers/input/evdev.c:543 [inline] evdev_read+0x37d/0xc60 drivers/input/evdev.c:584 do_loop_readv_writev fs/read_write.c:849 [inline] do_loop_readv_writev fs/read_write.c:837 [inline] vfs_readv+0x5d8/0x8d0 fs/read_write.c:1022 do_readv+0x28a/0x340 fs/read_write.c:1082 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e } ... key at: [] __key.88+0x0/0x40 the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (tasklist_lock){.+.+}-{3:3} { HARDIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:161 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x13b/0x8b0 kernel/exit.c:1678 do_wait+0x1ec/0x5a0 kernel/exit.c:1722 kernel_wait+0xa1/0x160 kernel/exit.c:1898 call_usermodehelper_exec_sync kernel/umh.c:136 [inline] call_usermodehelper_exec_work+0xf6/0x180 kernel/umh.c:163 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276 process_scheduled_works kernel/workqueue.c:3359 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 SOFTIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:161 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x13b/0x8b0 kernel/exit.c:1678 do_wait+0x1ec/0x5a0 kernel/exit.c:1722 kernel_wait+0xa1/0x160 kernel/exit.c:1898 call_usermodehelper_exec_sync kernel/umh.c:136 [inline] call_usermodehelper_exec_work+0xf6/0x180 kernel/umh.c:163 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276 process_scheduled_works kernel/workqueue.c:3359 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:211 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 copy_process+0x67f1/0x7a40 kernel/fork.c:2369 kernel_clone+0xfc/0x9a0 kernel/fork.c:2653 user_mode_thread+0xcc/0x110 kernel/fork.c:2729 rest_init+0x21/0x260 init/main.c:725 start_kernel+0x47f/0x480 init/main.c:1210 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x148 INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock include/linux/rwlock_api_smp.h:161 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 __do_wait+0x13b/0x8b0 kernel/exit.c:1678 do_wait+0x1ec/0x5a0 kernel/exit.c:1722 kernel_wait+0xa1/0x160 kernel/exit.c:1898 call_usermodehelper_exec_sync kernel/umh.c:136 [inline] call_usermodehelper_exec_work+0xf6/0x180 kernel/umh.c:163 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276 process_scheduled_works kernel/workqueue.c:3359 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 } ... key at: [] tasklist_lock+0x18/0x40 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:161 [inline] _raw_read_lock+0x5f/0x70 kernel/locking/spinlock.c:228 send_sigurg+0xed/0xc80 fs/fcntl.c:978 sk_send_sigurg+0x76/0x370 net/core/sock.c:3669 queue_oob net/unix/af_unix.c:2354 [inline] unix_stream_sendmsg+0xbbf/0x1310 net/unix/af_unix.c:2488 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x9e1/0xb70 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x2ff/0x430 net/socket.c:2728 __compat_sys_sendmmsg net/compat.c:360 [inline] __do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline] __ia32_compat_sys_sendmmsg+0x9d/0x100 net/compat.c:364 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> (&f_owner->lock){....}-{3:3} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:211 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 __f_setown+0x65/0x390 fs/fcntl.c:136 generic_add_lease fs/locks.c:1908 [inline] generic_setlease+0xb3d/0x1300 fs/locks.c:1984 kernel_setlease fs/locks.c:2031 [inline] vfs_setlease+0x283/0x370 fs/locks.c:2065 do_fcntl_add_lease+0x3c4/0x550 fs/locks.c:2086 fcntl_setlease+0xfc/0x180 fs/locks.c:2111 do_fcntl+0x1149/0x1670 fs/fcntl.c:535 do_compat_fcntl64+0x66d/0x720 fs/fcntl.c:800 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x31/0x3e0 fs/fcntl.c:918 kill_fasync_rcu fs/fcntl.c:1144 [inline] kill_fasync fs/fcntl.c:1159 [inline] kill_fasync+0x214/0x510 fs/fcntl.c:1152 lease_break_callback+0x23/0x30 fs/locks.c:577 __break_lease+0x7f4/0x19b0 fs/locks.c:1657 break_lease include/linux/filelock.h:484 [inline] break_lease include/linux/filelock.h:469 [inline] do_dentry_open+0xd3a/0x1660 fs/open.c:940 vfs_open+0x82/0x3f0 fs/open.c:1081 backing_file_open+0x62/0xb0 fs/backing-file.c:45 ovl_open_realfile+0x3a0/0x4a0 fs/overlayfs/file.c:51 ovl_open+0x1dd/0x330 fs/overlayfs/file.c:222 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4671 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4830 do_file_open+0x20e/0x430 fs/namei.c:4859 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_compat_sys_openat fs/open.c:1434 [inline] __se_compat_sys_openat fs/open.c:1432 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1432 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e } ... key at: [] __key.1+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 send_sigio+0x31/0x3e0 fs/fcntl.c:918 kill_fasync_rcu fs/fcntl.c:1144 [inline] kill_fasync fs/fcntl.c:1159 [inline] kill_fasync+0x214/0x510 fs/fcntl.c:1152 lease_break_callback+0x23/0x30 fs/locks.c:577 __break_lease+0x7f4/0x19b0 fs/locks.c:1657 break_lease include/linux/filelock.h:484 [inline] break_lease include/linux/filelock.h:469 [inline] do_dentry_open+0xd3a/0x1660 fs/open.c:940 vfs_open+0x82/0x3f0 fs/open.c:1081 backing_file_open+0x62/0xb0 fs/backing-file.c:45 ovl_open_realfile+0x3a0/0x4a0 fs/overlayfs/file.c:51 ovl_open+0x1dd/0x330 fs/overlayfs/file.c:222 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4671 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4830 do_file_open+0x20e/0x430 fs/namei.c:4859 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_compat_sys_openat fs/open.c:1434 [inline] __se_compat_sys_openat fs/open.c:1432 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1432 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> (&new->fa_lock){....}-{3:3} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_write_lock_irq include/linux/rwlock_api_smp.h:211 [inline] _raw_write_lock_irq+0x36/0x50 kernel/locking/spinlock.c:326 fasync_remove_entry+0xb2/0x1e0 fs/fcntl.c:1012 fasync_helper+0xaf/0xd0 fs/fcntl.c:1115 lease_modify+0x22c/0x480 fs/locks.c:1514 locks_remove_lease fs/locks.c:2757 [inline] locks_remove_file+0x330/0x610 fs/locks.c:2782 __fput+0x351/0xb40 fs/file_table.c:461 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x100/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] __do_fast_syscall_32+0x578/0x8c0 arch/x86/entry/syscall_32.c:310 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1135 [inline] kill_fasync fs/fcntl.c:1159 [inline] kill_fasync+0x138/0x510 fs/fcntl.c:1152 lease_break_callback+0x23/0x30 fs/locks.c:577 __break_lease+0x7f4/0x19b0 fs/locks.c:1657 break_lease include/linux/filelock.h:484 [inline] break_lease include/linux/filelock.h:469 [inline] do_dentry_open+0xd3a/0x1660 fs/open.c:940 vfs_open+0x82/0x3f0 fs/open.c:1081 backing_file_open+0x62/0xb0 fs/backing-file.c:45 ovl_open_realfile+0x3a0/0x4a0 fs/overlayfs/file.c:51 ovl_open+0x1dd/0x330 fs/overlayfs/file.c:222 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4671 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4830 do_file_open+0x20e/0x430 fs/namei.c:4859 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_compat_sys_openat fs/open.c:1434 [inline] __se_compat_sys_openat fs/open.c:1432 [inline] __ia32_compat_sys_openat+0x12d/0x210 fs/open.c:1432 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e } ... key at: [] __key.0+0x0/0x40 ... acquired at: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1135 [inline] kill_fasync fs/fcntl.c:1159 [inline] kill_fasync+0x138/0x510 fs/fcntl.c:1152 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x5da/0x910 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x753/0x880 drivers/input/input.c:128 input_event_dispose drivers/input/input.c:342 [inline] input_handle_event+0x7e4/0x1500 drivers/input/input.c:370 input_inject_event+0x1f1/0x3b0 drivers/input/input.c:424 evdev_write+0x2dd/0x430 drivers/input/evdev.c:528 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e stack backtrace: CPU: 3 UID: 0 PID: 21391 Comm: syz.4.4242 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_bad_irq_dependency kernel/locking/lockdep.c:2616 [inline] check_irq_usage+0x7aa/0x810 kernel/locking/lockdep.c:2857 check_prev_add kernel/locking/lockdep.c:3169 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x14cf/0x2630 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline] _raw_read_lock_irqsave+0x74/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:1135 [inline] kill_fasync fs/fcntl.c:1159 [inline] kill_fasync+0x138/0x510 fs/fcntl.c:1152 __pass_event drivers/input/evdev.c:240 [inline] evdev_pass_values+0x5da/0x910 drivers/input/evdev.c:278 evdev_events+0x1bb/0x390 drivers/input/evdev.c:306 input_pass_values+0x753/0x880 drivers/input/input.c:128 input_event_dispose drivers/input/input.c:342 [inline] input_handle_event+0x7e4/0x1500 drivers/input/input.c:370 input_inject_event+0x1f1/0x3b0 drivers/input/input.c:424 evdev_write+0x2dd/0x430 drivers/input/evdev.c:528 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7fc8f6c Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000040 RDX: 0000000000001068 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: d2 74 05 c1 shlb %cl,-0x3f(%rbp,%rax,1) 4: e8 0c 89 02 8b call 0x8b028915 9: 5d pop %rbp a: fc cld b: 31 c0 xor %eax,%eax d: c9 leave e: c3 ret f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 0f 1f 00 nopl (%rax) 21: 51 push %rcx 22: 52 push %rdx 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 2e 8d b4 26 00 00 00 cs lea 0x0(%rsi,%riz,1),%esi 36: 00 37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 3e: 58 pop %rax 3f: b8 .byte 0xb8