[v6.1] possible deadlock in snd_seq_deliver_event

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: dc5c83b7f5f8 Linux 6.1.178
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=143ec7b1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=e4261fc52d6431f1e410
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/96393e4697a3/disk-dc5c83b7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0d4afce44fab/vmlinux-dc5c83b7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4787e310d875/Image-dc5c83b7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e4261f...@syzkaller.appspotmail.com

============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/0:0/7 is trying to acquire lock:
ffff0000d3ee3930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff0000d3ee3930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

but task is already holding lock:
ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&grp->list_lock);
lock(&grp->list_lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by kworker/0:0/7:
#0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff80001cb17c40 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2: ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
#2: ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

stack backtrace:
CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: events snd_rawmidi_input_event_work
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__lock_acquire+0x15d0/0x6634 kernel/locking/lockdep.c:-1
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
__raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
_raw_read_lock+0x64/0x80 kernel/locking/spinlock.c:228
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]
snd_seq_control_queue+0x6c0/0xe54 sound/core/seq/seq_queue.c:721
event_input_timer+0x34/0x48 sound/core/seq/seq_system.c:103
snd_seq_deliver_single_event+0x318/0x780 sound/core/seq/seq_clientmgr.c:663
snd_seq_deliver_event+0x1b4/0x5d0 sound/core/seq/seq_clientmgr.c:865
snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
snd_seq_oss_timer_start+0x234/0x420 sound/core/seq/oss/seq_oss_timer.c:161
send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
snd_seq_oss_midi_input+0x298/0x7b4 sound/core/seq/oss/seq_oss_midi.c:544
snd_seq_oss_event_input+0x108/0x1f0 sound/core/seq/oss/seq_oss_event.c:429
snd_seq_deliver_single_event+0x318/0x780 sound/core/seq/seq_clientmgr.c:663
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:720 [inline]
snd_seq_deliver_event+0x2dc/0x5d0 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
snd_midi_input_event+0x234/0x37c sound/core/seq/seq_midi.c:92
snd_rawmidi_input_event_work+0x68/0x84 sound/core/rawmidi.c:129
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup