[v6.1] possible deadlock in snd_seq_deliver_event

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: dc5c83b7f5f8 Linux 6.1.178
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=143ec7b1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=e4261fc52d6431f1e410
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/96393e4697a3/disk-dc5c83b7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0d4afce44fab/vmlinux-dc5c83b7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4787e310d875/Image-dc5c83b7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e4261f...@syzkaller.appspotmail.com

============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/0:0/7 is trying to acquire lock:
ffff0000d3ee3930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff0000d3ee3930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

but task is already holding lock:
ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&grp->list_lock);
lock(&grp->list_lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by kworker/0:0/7:
#0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#1: ffff80001cb17c40 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
#2: ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
#2: ffff0000d3bac930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854

stack backtrace:
CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: events snd_rawmidi_input_event_work
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__lock_acquire+0x15d0/0x6634 kernel/locking/lockdep.c:-1
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
__raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
_raw_read_lock+0x64/0x80 kernel/locking/spinlock.c:228
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
snd_seq_deliver_event+0x18c/0x5d0 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]
snd_seq_control_queue+0x6c0/0xe54 sound/core/seq/seq_queue.c:721
event_input_timer+0x34/0x48 sound/core/seq/seq_system.c:103
snd_seq_deliver_single_event+0x318/0x780 sound/core/seq/seq_clientmgr.c:663
snd_seq_deliver_event+0x1b4/0x5d0 sound/core/seq/seq_clientmgr.c:865
snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
snd_seq_oss_timer_start+0x234/0x420 sound/core/seq/oss/seq_oss_timer.c:161
send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
snd_seq_oss_midi_input+0x298/0x7b4 sound/core/seq/oss/seq_oss_midi.c:544
snd_seq_oss_event_input+0x108/0x1f0 sound/core/seq/oss/seq_oss_event.c:429
snd_seq_deliver_single_event+0x318/0x780 sound/core/seq/seq_clientmgr.c:663
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:720 [inline]
snd_seq_deliver_event+0x2dc/0x5d0 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x1cc/0x2ec sound/core/seq/seq_clientmgr.c:2406
snd_midi_input_event+0x234/0x37c sound/core/seq/seq_midi.c:92
snd_rawmidi_input_event_work+0x68/0x84 sound/core/rawmidi.c:129
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10ba7a49580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=f7d4003f58de3f8e24ae

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+f7d400...@syzkaller.appspotmail.com

============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------

kworker/1:1/23 is trying to acquire lock:
ffff88802a0d5130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff88802a0d5130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854

but task is already holding lock:

ffff888073bf0130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
ffff888073bf0130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&grp->list_lock);
lock(&grp->list_lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by kworker/1:1/23:
#0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000ddfd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff888073bf0130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
#2: ffff888073bf0130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854

stack backtrace:
CPU: 1 PID: 23 Comm: kworker/1:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events snd_rawmidi_input_event_work
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
__raw_read_lock include/linux/rwlock_api_smp.h:149 [inline]
_raw_read_lock+0x32/0x40 kernel/locking/spinlock.c:228
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:708 [inline]
snd_seq_deliver_event+0x1cb/0x8c0 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x1fc/0x2f0 sound/core/seq/seq_clientmgr.c:2407

queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]

snd_seq_control_queue+0x8ff/0x1010 sound/core/seq/seq_queue.c:721
snd_seq_deliver_single_event+0x806/0xb30 sound/core/seq/seq_clientmgr.c:663
snd_seq_kernel_client_dispatch+0x1fc/0x2f0 sound/core/seq/seq_clientmgr.c:2407
send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
snd_seq_oss_timer_start+0x2ce/0x510 sound/core/seq/oss/seq_oss_timer.c:161
send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
snd_seq_oss_midi_input+0x2e8/0x890 sound/core/seq/oss/seq_oss_midi.c:544
snd_seq_deliver_single_event+0x806/0xb30 sound/core/seq/seq_clientmgr.c:663
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:720 [inline]
snd_seq_deliver_event+0x49d/0x8c0 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x1fc/0x2f0 sound/core/seq/seq_clientmgr.c:2407
snd_midi_input_event+0x289/0x3d0 sound/core/seq/seq_midi.c:89
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a1153c0deb44 Linux 6.6.147
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14739db9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=dcf425e9f7c7b0caba3d

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/9f646bfa1b52/disk-a1153c0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a2aec2e8f0fd/vmlinux-a1153c0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7abe1f87405/bzImage-a1153c0d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+dcf425...@syzkaller.appspotmail.com

============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------

kworker/0:3/5822 is trying to acquire lock:
ffff88802cf69930 (&grp->list_lock){.+.+}-{2:2}, at: __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
ffff88802cf69930 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
ffff88802cf69930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854

but task is already holding lock:

ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&grp->list_lock);
lock(&grp->list_lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by kworker/0:3/5822:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#1: ffffc9000486fd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc9000486fd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#2: ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
#2: ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
#2: ffff88807e1ba130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854

stack backtrace:
CPU: 0 PID: 5822 Comm: kworker/0:3 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events snd_rawmidi_input_event_work
Call Trace:
<TASK>

dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain kernel/locking/lockdep.c:3856 [inline]
__lock_acquire+0x6809/0x7d80 kernel/locking/lockdep.c:5137
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
__raw_read_lock include/linux/rwlock_api_smp.h:150 [inline]
_raw_read_lock+0x36/0x50 kernel/locking/spinlock.c:228
__deliver_to_subscribers sound/core/seq/seq_clientmgr.c:762 [inline]
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
snd_seq_deliver_event+0x248/0x970 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x201/0x2f0 sound/core/seq/seq_clientmgr.c:2546

queue_broadcast_event sound/core/seq/seq_queue.c:645 [inline]
snd_seq_queue_process_event sound/core/seq/seq_queue.c:661 [inline]

snd_seq_control_queue+0x886/0x1060 sound/core/seq/seq_queue.c:721
__snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:656 [inline]
snd_seq_deliver_single_event+0x5a3/0xbc0 sound/core/seq/seq_clientmgr.c:719
snd_seq_deliver_event+0x270/0x970 sound/core/seq/seq_clientmgr.c:856
snd_seq_kernel_client_dispatch+0x201/0x2f0 sound/core/seq/seq_clientmgr.c:2546
send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
snd_seq_oss_timer_start+0x337/0x570 sound/core/seq/oss/seq_oss_timer.c:161
send_midi_event sound/core/seq/oss/seq_oss_midi.c:622 [inline]
snd_seq_oss_midi_input+0x34d/0x9b0 sound/core/seq/oss/seq_oss_midi.c:544
__snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:656 [inline]
snd_seq_deliver_single_event+0x5a3/0xbc0 sound/core/seq/seq_clientmgr.c:719
__deliver_to_subscribers sound/core/seq/seq_clientmgr.c:774 [inline]
deliver_to_subscribers sound/core/seq/seq_clientmgr.c:804 [inline]
snd_seq_deliver_event+0x502/0x970 sound/core/seq/seq_clientmgr.c:854
snd_seq_kernel_client_dispatch+0x201/0x2f0 sound/core/seq/seq_clientmgr.c:2546
snd_midi_input_event+0x2b2/0x3f0 sound/core/seq/seq_midi.c:93
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293