[syzbot] [input?] possible deadlock in tasklet_action_common (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e98d21c170b0 Add linux-next specific files for 20260508
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1354bfce580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59b98218d9b2edf4
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d7ab56d43de3fd5aac
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/66f2a00ee290/disk-e98d21c1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b982257ce9e/vmlinux-e98d21c1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a73fbea43e1a/bzImage-e98d21c1.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b5d7ab...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G L
------------------------------------------------------
syz.2.4328/32663 is trying to acquire lock:
ffff8880b8724168 (tasklet_sync_callback.cb_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
ffff8880b8724168 (tasklet_sync_callback.cb_lock){+...}-{3:3}, at: tasklet_lock_callback kernel/softirq.c:881 [inline]
ffff8880b8724168 (tasklet_sync_callback.cb_lock){+...}-{3:3}, at: tasklet_action_common+0xc5/0x610 kernel/softirq.c:931

but task is already holding lock:
ffff888058598270 (&dev->event_lock#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
ffff888058598270 (&dev->event_lock#2){+.+.}-{3:3}, at: class_spinlock_irqsave_constructor include/linux/spinlock.h:619 [inline]
ffff888058598270 (&dev->event_lock#2){+.+.}-{3:3}, at: input_inject_event+0xa4/0x320 drivers/input/input.c:419

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&dev->event_lock#2){+.+.}-{3:3}:
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
class_spinlock_irqsave_constructor include/linux/spinlock.h:619 [inline]
input_inject_event+0xa4/0x320 drivers/input/input.c:419
led_trigger_event+0x13b/0x220 drivers/leds/led-triggers.c:420
kbd_propagate_led_state drivers/tty/vt/keyboard.c:1118 [inline]
kbd_bh+0x1b4/0x2c0 drivers/tty/vt/keyboard.c:1297
tasklet_action_common+0x31c/0x610 kernel/softirq.c:942
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1155
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (tasklet_sync_callback.cb_lock){+...}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3167 [inline]
check_prevs_add kernel/locking/lockdep.c:3286 [inline]
validate_chain kernel/locking/lockdep.c:3910 [inline]
__lock_acquire+0x15a5/0x2d10 kernel/locking/lockdep.c:5239
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5870
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
tasklet_lock_callback kernel/softirq.c:881 [inline]
tasklet_action_common+0xc5/0x610 kernel/softirq.c:931
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
__alloc_skb+0x1aa/0x7d0 net/core/skbuff.c:697
alloc_skb include/linux/skbuff.h:1381 [inline]
hidp_send_message+0xb5/0x230 net/bluetooth/hidp/core.c:111
hidp_send_intr_message net/bluetooth/hidp/core.c:143 [inline]
hidp_input_event+0x2a4/0x380 net/bluetooth/hidp/core.c:175
input_event_dispose+0x80/0x6b0 drivers/input/input.c:322
input_inject_event+0x1d7/0x320 drivers/input/input.c:424
kbd_led_trigger_activate+0xbc/0x100 drivers/tty/vt/keyboard.c:1074
led_trigger_set+0x53b/0x960 drivers/leds/led-triggers.c:220
led_match_default_trigger drivers/leds/led-triggers.c:277 [inline]
led_trigger_set_default+0x266/0x2a0 drivers/leds/led-triggers.c:300
led_classdev_register_ext+0x787/0x9c0 drivers/leds/led-class.c:581
led_classdev_register include/linux/leds.h:274 [inline]
input_leds_connect+0x517/0x790 drivers/input/input-leds.c:145
input_attach_handler drivers/input/input.c:1011 [inline]
input_register_device+0xce0/0x1140 drivers/input/input.c:2395
hidp_session_dev_add net/bluetooth/hidp/core.c:861 [inline]
hidp_session_probe+0x1a5/0x8a0 net/bluetooth/hidp/core.c:1139
l2cap_register_user+0xc2/0x1d0 net/bluetooth/l2cap_core.c:1725
hidp_connection_add+0x158b/0x1a20 net/bluetooth/hidp/core.c:1411
do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:81 [inline]
hidp_sock_ioctl+0x403/0x650 net/bluetooth/hidp/sock.c:128
sock_do_ioctl+0x101/0x320 net/socket.c:1328
sock_ioctl+0x5c9/0x7f0 net/socket.c:1449
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&dev->event_lock#2);
lock(tasklet_sync_callback.cb_lock);
lock(&dev->event_lock#2);
lock(tasklet_sync_callback.cb_lock);

*** DEADLOCK ***

10 locks held by syz.2.4328/32663:
#0: ffff88805ebb3370 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_register_user+0x35/0x1d0 net/bluetooth/l2cap_core.c:1712
#1: ffffffff8f73d960 (hidp_session_sem){++++}-{4:4}, at: hidp_session_probe+0x98/0x8a0 net/bluetooth/hidp/core.c:1129
#2: ffffffff8f006e58 (input_mutex){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
#2: ffffffff8f006e58 (input_mutex){+.+.}-{4:4}, at: input_register_device+0xa56/0x1140 drivers/input/input.c:2391
#3: ffff8880125ea860 (&led_cdev->led_access){+.+.}-{4:4}, at: led_classdev_register_ext+0x484/0x9c0 drivers/leds/led-class.c:539
#4: ffffffff8e9c4400 (triggers_list_lock){++++}-{4:4}, at: led_trigger_set_default+0x77/0x2a0 drivers/leds/led-triggers.c:297
#5: ffff8880125ea788 (&led_cdev->trigger_lock){+.+.}-{4:4}, at: led_trigger_set_default+0x87/0x2a0 drivers/leds/led-triggers.c:298
#6: ffff888058598270 (&dev->event_lock#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#6: ffff888058598270 (&dev->event_lock#2){+.+.}-{3:3}, at: class_spinlock_irqsave_constructor include/linux/spinlock.h:619 [inline]
#6: ffff888058598270 (&dev->event_lock#2){+.+.}-{3:3}, at: input_inject_event+0xa4/0x320 drivers/input/input.c:419
#7: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#7: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#7: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#7: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#8: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#8: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#8: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
#8: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb0/0x320 drivers/input/input.c:420
#9: ffffffff8e1c8240 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163

stack backtrace:
CPU: 1 UID: 0 PID: 32663 Comm: syz.2.4328 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2045
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2177
check_prev_add kernel/locking/lockdep.c:3167 [inline]
check_prevs_add kernel/locking/lockdep.c:3286 [inline]
validate_chain kernel/locking/lockdep.c:3910 [inline]
__lock_acquire+0x15a5/0x2d10 kernel/locking/lockdep.c:5239
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5870
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
tasklet_lock_callback kernel/softirq.c:881 [inline]
tasklet_action_common+0xc5/0x610 kernel/softirq.c:931
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
__alloc_skb+0x1aa/0x7d0 net/core/skbuff.c:697
alloc_skb include/linux/skbuff.h:1381 [inline]
hidp_send_message+0xb5/0x230 net/bluetooth/hidp/core.c:111
hidp_send_intr_message net/bluetooth/hidp/core.c:143 [inline]
hidp_input_event+0x2a4/0x380 net/bluetooth/hidp/core.c:175
input_event_dispose+0x80/0x6b0 drivers/input/input.c:322
input_inject_event+0x1d7/0x320 drivers/input/input.c:424
kbd_led_trigger_activate+0xbc/0x100 drivers/tty/vt/keyboard.c:1074
led_trigger_set+0x53b/0x960 drivers/leds/led-triggers.c:220
led_match_default_trigger drivers/leds/led-triggers.c:277 [inline]
led_trigger_set_default+0x266/0x2a0 drivers/leds/led-triggers.c:300
led_classdev_register_ext+0x787/0x9c0 drivers/leds/led-class.c:581
led_classdev_register include/linux/leds.h:274 [inline]
input_leds_connect+0x517/0x790 drivers/input/input-leds.c:145
input_attach_handler drivers/input/input.c:1011 [inline]
input_register_device+0xce0/0x1140 drivers/input/input.c:2395
hidp_session_dev_add net/bluetooth/hidp/core.c:861 [inline]
hidp_session_probe+0x1a5/0x8a0 net/bluetooth/hidp/core.c:1139
l2cap_register_user+0xc2/0x1d0 net/bluetooth/l2cap_core.c:1725
hidp_connection_add+0x158b/0x1a20 net/bluetooth/hidp/core.c:1411
do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:81 [inline]
hidp_sock_ioctl+0x403/0x650 net/bluetooth/hidp/sock.c:128
sock_do_ioctl+0x101/0x320 net/socket.c:1328
sock_ioctl+0x5c9/0x7f0 net/socket.c:1449
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcb5e6cce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcb5c905028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcb5e946090 RCX: 00007fcb5e6cce59
RDX: 00002000000000c0 RSI: 00000000400448c8 RDI: 0000000000000009
RBP: 00007fcb5e762d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcb5e946128 R14: 00007fcb5e946090 R15: 00007ffddb8adae8
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

> Date: Wed, 20 May 2026 10:05:38 -0700 [thread overview]

Deadlock if the timer thread is preempted

timer thread
tasklet_sync_callback.cb_lock

// preempted
&dev->event_lock
do softirq
acquire tasklet_sync_callback.cb_lock

acquire &dev->event_lock

[Sebastian Andrzej Siewior]

This is obvious and looks fine.

> Deadlock if the timer thread is preempted
>
> timer thread
> tasklet_sync_callback.cb_lock
>
> // preempted
> &dev->event_lock
> do softirq
> acquire tasklet_sync_callback.cb_lock
>
> acquire &dev->event_lock

This shouldn't happen.

> > -> #0 (tasklet_sync_callback.cb_lock){+...}-{3:3}:
> > check_prev_add kernel/locking/lockdep.c:3167 [inline]
> > check_prevs_add kernel/locking/lockdep.c:3286 [inline]
> > validate_chain kernel/locking/lockdep.c:3910 [inline]
> > __lock_acquire+0x15a5/0x2d10 kernel/locking/lockdep.c:5239
> > lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5870
> > rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
> > spin_lock include/linux/spinlock_rt.h:45 [inline]
> > tasklet_lock_callback kernel/softirq.c:881 [inline]
> > tasklet_action_common+0xc5/0x610 kernel/softirq.c:931
> > handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
> > __do_softirq kernel/softirq.c:660 [inline]
> > __local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
> > local_bh_enable include/linux/bottom_half.h:33 [inline]
> > __alloc_skb+0x1aa/0x7d0 net/core/skbuff.c:697
> > alloc_skb include/linux/skbuff.h:1381 [inline]
> > hidp_send_message+0xb5/0x230 net/bluetooth/hidp/core.c:111
> > hidp_send_intr_message net/bluetooth/hidp/core.c:143 [inline]
> > hidp_input_event+0x2a4/0x380 net/bluetooth/hidp/core.c:175
> > input_event_dispose+0x80/0x6b0 drivers/input/input.c:322
> > input_inject_event+0x1d7/0x320 drivers/input/input.c:424

up to kbd_led_trigger_activate(), I can follow. In
kbd_led_trigger_activate() it disables the keyboard tasklet and then
does led_set_brightness(). Not sure how it ends up in
input_inject_event().

Now, input_inject_event() does spin_lock_irqsave() and alloc_skb() does
local_bh_disable()/ local_bh_enable(). On !RT this is not legal. On RT
it is okay but then local_bh_enable() here should not invoke any
softirqs because none were raised within the section (alloc_skb()).
Not sure if this really did occur as such or lockdep comes with the
shortest backtrace based on the lockclass and this is it.

> > kbd_led_trigger_activate+0xbc/0x100 drivers/tty/vt/keyboard.c:1074
> > led_trigger_set+0x53b/0x960 drivers/leds/led-triggers.c:220
> > led_match_default_trigger drivers/leds/led-triggers.c:277 [inline]
> > led_trigger_set_default+0x266/0x2a0 drivers/leds/led-triggers.c:300
> > led_classdev_register_ext+0x787/0x9c0 drivers/leds/led-class.c:581
> > led_classdev_register include/linux/leds.h:274 [inline]
> > input_leds_connect+0x517/0x790 drivers/input/input-leds.c:145
> > input_attach_handler drivers/input/input.c:1011 [inline]
> > input_register_device+0xce0/0x1140 drivers/input/input.c:2395
> > hidp_session_dev_add net/bluetooth/hidp/core.c:861 [inline]
> > hidp_session_probe+0x1a5/0x8a0 net/bluetooth/hidp/core.c:1139
> > l2cap_register_user+0xc2/0x1d0 net/bluetooth/l2cap_core.c:1725
> > hidp_connection_add+0x158b/0x1a20 net/bluetooth/hidp/core.c:1411
> > do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:81 [inline]
> > hidp_sock_ioctl+0x403/0x650 net/bluetooth/hidp/sock.c:128
> > sock_do_ioctl+0x101/0x320 net/socket.c:1328
> > sock_ioctl+0x5c9/0x7f0 net/socket.c:1449
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94

Sebastian

[Hillf Danton]

input_inject_event() is invoked in the brightness_set callback [1] for
example.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/input/input-leds.c#n142

> Now, input_inject_event() does spin_lock_irqsave() and alloc_skb() does
> local_bh_disable()/ local_bh_enable(). On !RT this is not legal. On RT

Can you please specify why that is illegal on !RT?

> it is okay but then local_bh_enable() here should not invoke any
> softirqs because none were raised within the section (alloc_skb()).

On RT spinlock is replaced with mutex, and softirq can be raised in the
irq that could come any moment after spin_lock_irqsave().

[Sebastian Andrzej Siewior]

On 2026-05-22 06:35:14 [+0800], Hillf Danton wrote:
> input_inject_event() is invoked in the brightness_set callback [1] for
> example.
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/input/input-leds.c#n142
>
> > Now, input_inject_event() does spin_lock_irqsave() and alloc_skb() does
> > local_bh_disable()/ local_bh_enable(). On !RT this is not legal. On RT
>
> Can you please specify why that is illegal on !RT?

So if you do
spin_lock_irq();
local_bh_disable();

then the
local_bh_enable();

has lockdep_assert_irqs_enabled() which will yell. Then there is also
this local_irq_enable() which will enable interrupts before the unlock
which bad, again. Also, should softirqs been raised within this section,
the this enable will invoke the required callback which again, enable
interrupts.

> > it is okay but then local_bh_enable() here should not invoke any
> > softirqs because none were raised within the section (alloc_skb()).
>
> On RT spinlock is replaced with mutex, and softirq can be raised in the
> irq that could come any moment after spin_lock_irqsave().

That is true on the other hand. That means having raised another tasklet
could lead to the backtrace. But it would have been two different locks,
not blocking on each other.

Sebastian

[Hillf Danton]

On Fri, 22 May 2026 08:39:38 +0200 Sebastian Andrzej Siewior wrote:
> On 2026-05-22 06:35:14 [+0800], Hillf Danton wrote:
> > input_inject_event() is invoked in the brightness_set callback [1] for
> > example.
> >
> > [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/input/input-leds.c#n142
> >
> > > Now, input_inject_event() does spin_lock_irqsave() and alloc_skb() does
> > > local_bh_disable()/ local_bh_enable(). On !RT this is not legal. On RT
> >
> > Can you please specify why that is illegal on !RT?
>
> So if you do
> spin_lock_irq();
> local_bh_disable();
>
> then the
> local_bh_enable();
>
> has lockdep_assert_irqs_enabled() which will yell. Then there is also

Ah got it, thanks.

> this local_irq_enable() which will enable interrupts before the unlock
> which bad, again. Also, should softirqs been raised within this section,
> the this enable will invoke the required callback which again, enable
> interrupts.
>
> > > it is okay but then local_bh_enable() here should not invoke any
> > > softirqs because none were raised within the section (alloc_skb()).
> >
> > On RT spinlock is replaced with mutex, and softirq can be raised in the
> > irq that could come any moment after spin_lock_irqsave().
>
> That is true on the other hand. That means having raised another tasklet
> could lead to the backtrace. But it would have been two different locks,
> not blocking on each other.
>

The last question, by two different locks, do you mean that the
tasklet_sync_callback.cb_lock is per cpu?

[Sebastian Andrzej Siewior]

On 2026-05-22 15:21:43 [+0800], Hillf Danton wrote:
> > > On RT spinlock is replaced with mutex, and softirq can be raised in the
> > > irq that could come any moment after spin_lock_irqsave().
> >
> > That is true on the other hand. That means having raised another tasklet
> > could lead to the backtrace. But it would have been two different locks,
> > not blocking on each other.
> >
> The last question, by two different locks, do you mean that the
> tasklet_sync_callback.cb_lock is per cpu?

Yes, it is but this does not matter. kbd_led_trigger_activate() does
tasklet_disable(&keyboard_tasklet) so you can't have kbd_bh() running
and led_set_brightness() which would kick the softirq again. Not from
kbd_led_trigger_activate().

Even if another component would raise a softirq in that window, you
could run tasklets, yes, but never kbd_bh(). Not in this window.

So the kbd_led_trigger_activate() -> input_inject_event() needs to be a
different event device than kbd_propagate_led_state() -> event. I don't
see how you could unfold this.

I *think* lockdep observed all this possible interactions and sketched
this possibility but it does not know about tasklet_disable().

I do have an idea how to avoid alloc_skb() invoking softirqs if someone
else raised them while alloc_skb() was preempted. This could avoid this
kind of splat.

Sebastian

[Hillf Danton]

On Fri, 22 May 2026 09:35:08 +0200 Sebastian Andrzej Siewior wrote:
> On 2026-05-22 15:21:43 [+0800], Hillf Danton wrote:
> > > > On RT spinlock is replaced with mutex, and softirq can be raised in the
> > > > irq that could come any moment after spin_lock_irqsave().
> > >
> > > That is true on the other hand. That means having raised another tasklet
> > > could lead to the backtrace. But it would have been two different locks,
> > > not blocking on each other.
> > >
> > The last question, by two different locks, do you mean that the
> > tasklet_sync_callback.cb_lock is per cpu?
>
> Yes, it is but this does not matter. kbd_led_trigger_activate() does
> tasklet_disable(&keyboard_tasklet) so you can't have kbd_bh() running
> and led_set_brightness() which would kick the softirq again. Not from
> kbd_led_trigger_activate().
>
> Even if another component would raise a softirq in that window, you
> could run tasklets, yes, but never kbd_bh(). Not in this window.
>

After a look at fd4e876f59b7 ("softirq: Provide a handshake for canceling
tasklets via polling") add a shameless question (obvious the above one is
not last), any chance for cutting tasklet_sync_callback off if wait_on_bit()
for TASKLET_STATE_RUN is used in tasklet_unlock_spin_wait()?

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: cc2b5f627e8c Add linux-next specific files for 20260714
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13d446b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d7ab56d43de3fd5aac
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1310a232580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13c3b2ea580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6836f8efb1da/disk-cc2b5f62.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0109d3477cc7/vmlinux-cc2b5f62.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c2e49e350bbf/bzImage-cc2b5f62.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b5d7ab...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected

syzkaller #0 Not tainted
------------------------------------------------------
syz.2.50/6022 is trying to acquire lock:
ffff8880b86241a8 (tasklet_sync_callback.cb_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
ffff8880b86241a8 (tasklet_sync_callback.cb_lock){+...}-{3:3}, at: tasklet_lock_callback kernel/softirq.c:881 [inline]
ffff8880b86241a8 (tasklet_sync_callback.cb_lock){+...}-{3:3}, at: tasklet_action_common+0xc5/0x600 kernel/softirq.c:931

but task is already holding lock:

ffff88802bcbc270 (&dev->event_lock#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
ffff88802bcbc270 (&dev->event_lock#2){+.+.}-{3:3}, at: class_spinlock_irqsave_constructor include/linux/spinlock.h:620 [inline]
ffff88802bcbc270 (&dev->event_lock#2){+.+.}-{3:3}, at: input_inject_event+0xab/0x310 drivers/input/input.c:419

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&dev->event_lock#2){+.+.}-{3:3}:
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]

class_spinlock_irqsave_constructor include/linux/spinlock.h:620 [inline]
input_inject_event+0xab/0x310 drivers/input/input.c:419
led_trigger_event+0x13b/0x220 drivers/leds/led-triggers.c:420
kbd_propagate_led_state drivers/tty/vt/keyboard.c:1124 [inline]
kbd_bh+0x1b4/0x2c0 drivers/tty/vt/keyboard.c:1303
tasklet_action_common+0x31c/0x600 kernel/softirq.c:942
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626

__do_softirq kernel/softirq.c:660 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1155

smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160

kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (tasklet_sync_callback.cb_lock){+...}-{3:3}:

check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x15ff/0x2e40 kernel/locking/lockdep.c:5254
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906

rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
tasklet_lock_callback kernel/softirq.c:881 [inline]

tasklet_action_common+0xc5/0x600 kernel/softirq.c:931
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626

__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]

__alloc_skb+0x1ad/0x7a0 net/core/skbuff.c:699
alloc_skb include/linux/skbuff.h:1384 [inline]
hidp_send_message+0xb5/0x230 net/bluetooth/hidp/core.c:108
hidp_send_intr_message net/bluetooth/hidp/core.c:140 [inline]
hidp_input_event+0x2a4/0x380 net/bluetooth/hidp/core.c:172
input_event_dispose+0x80/0x6b0 drivers/input/input.c:322
input_inject_event+0x1fa/0x310 drivers/input/input.c:424
kbd_led_trigger_activate+0xbc/0x100 drivers/tty/vt/keyboard.c:1080
led_trigger_set+0x52b/0x940 drivers/leds/led-triggers.c:220
led_match_default_trigger drivers/leds/led-triggers.c:277 [inline]
led_trigger_set_default+0x269/0x2a0 drivers/leds/led-triggers.c:300
led_classdev_register_ext+0x761/0x990 drivers/leds/led-class.c:596
led_classdev_register include/linux/leds.h:274 [inline]
input_leds_connect+0x4de/0x750 drivers/input/input-leds.c:145
input_attach_handler drivers/input/input.c:1011 [inline]
input_register_device+0xd08/0x1150 drivers/input/input.c:2398
hidp_session_dev_add net/bluetooth/hidp/core.c:871 [inline]
hidp_session_probe+0x1a5/0x8b0 net/bluetooth/hidp/core.c:1149
l2cap_register_user+0xbd/0x1d0 net/bluetooth/l2cap_core.c:1754
hidp_connection_add+0x1582/0x1a10 net/bluetooth/hidp/core.c:1421
do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:78 [inline]
hidp_sock_ioctl+0x403/0x650 net/bluetooth/hidp/sock.c:125
sock_do_ioctl+0x101/0x320 net/socket.c:1340
sock_ioctl+0x57d/0x7f0 net/socket.c:1461

vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583

do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85

entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&dev->event_lock#2);
lock(tasklet_sync_callback.cb_lock);
lock(&dev->event_lock#2);
lock(tasklet_sync_callback.cb_lock);

*** DEADLOCK ***

locks held by syz.2.50/6022: 10, last CPU#0:
#0: ffff88802a6afb70 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_register_user+0x34/0x1d0 net/bluetooth/l2cap_core.c:1741
#1: ffffffff8f973720 (hidp_session_sem){++++}-{4:4}, at: hidp_session_probe+0x98/0x8b0 net/bluetooth/hidp/core.c:1139
#2: ffffffff8f236758 (input_mutex){+.+.}-{4:4}, at: class_mutex_intr_constructor include/linux/mutex.h:255 [inline]
#2: ffffffff8f236758 (input_mutex){+.+.}-{4:4}, at: input_register_device+0xa7f/0x1150 drivers/input/input.c:2394
#3: ffff88803c562860 (&led_cdev->led_access){+.+.}-{4:4}, at: led_classdev_register_ext+0x45e/0x990 drivers/leds/led-class.c:554
#4: ffffffff8ebefde0 (triggers_list_lock){++++}-{4:4}, at: led_trigger_set_default+0x7b/0x2a0 drivers/leds/led-triggers.c:297
#5: ffff88803c562788 (&led_cdev->trigger_lock){+.+.}-{4:4}, at: led_trigger_set_default+0x8b/0x2a0 drivers/leds/led-triggers.c:298
#6: ffff88802bcbc270 (&dev->event_lock#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#6: ffff88802bcbc270 (&dev->event_lock#2){+.+.}-{3:3}, at: class_spinlock_irqsave_constructor include/linux/spinlock.h:620 [inline]
#6: ffff88802bcbc270 (&dev->event_lock#2){+.+.}-{3:3}, at: input_inject_event+0xab/0x310 drivers/input/input.c:419
#7: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#7: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#7: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#7: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
#8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb7/0x310 drivers/input/input.c:420
#9: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163

stack backtrace:
CPU: 0 UID: 0 PID: 6022 Comm: syz.2.50 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026

Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120

print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2059
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2191
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x15ff/0x2e40 kernel/locking/lockdep.c:5254
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906

rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
tasklet_lock_callback kernel/softirq.c:881 [inline]

tasklet_action_common+0xc5/0x600 kernel/softirq.c:931
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626

__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]

__alloc_skb+0x1ad/0x7a0 net/core/skbuff.c:699
alloc_skb include/linux/skbuff.h:1384 [inline]
hidp_send_message+0xb5/0x230 net/bluetooth/hidp/core.c:108
hidp_send_intr_message net/bluetooth/hidp/core.c:140 [inline]
hidp_input_event+0x2a4/0x380 net/bluetooth/hidp/core.c:172
input_event_dispose+0x80/0x6b0 drivers/input/input.c:322
input_inject_event+0x1fa/0x310 drivers/input/input.c:424
kbd_led_trigger_activate+0xbc/0x100 drivers/tty/vt/keyboard.c:1080
led_trigger_set+0x52b/0x940 drivers/leds/led-triggers.c:220
led_match_default_trigger drivers/leds/led-triggers.c:277 [inline]
led_trigger_set_default+0x269/0x2a0 drivers/leds/led-triggers.c:300
led_classdev_register_ext+0x761/0x990 drivers/leds/led-class.c:596
led_classdev_register include/linux/leds.h:274 [inline]
input_leds_connect+0x4de/0x750 drivers/input/input-leds.c:145
input_attach_handler drivers/input/input.c:1011 [inline]
input_register_device+0xd08/0x1150 drivers/input/input.c:2398
hidp_session_dev_add net/bluetooth/hidp/core.c:871 [inline]
hidp_session_probe+0x1a5/0x8b0 net/bluetooth/hidp/core.c:1149
l2cap_register_user+0xbd/0x1d0 net/bluetooth/l2cap_core.c:1754
hidp_connection_add+0x1582/0x1a10 net/bluetooth/hidp/core.c:1421
do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:78 [inline]
hidp_sock_ioctl+0x403/0x650 net/bluetooth/hidp/sock.c:125
sock_do_ioctl+0x101/0x320 net/socket.c:1340
sock_ioctl+0x57d/0x7f0 net/socket.c:1461

vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583

do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f272c33de99

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffff0d71338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f272c5c5fa0 RCX: 00007f272c33de99
RDX: 0000200000000200 RSI: 00000000400448c8 RDI: 0000000000000004
RBP: 00007f272c3d3eaf R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f272c5c5fac R14: 00007f272c5c5fa0 R15: 00007f272c5c5fa0
</TASK>
raw-gadget.1 gadget.0: ignoring, device is not running


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Hillf Danton]

> Date: Sat, 25 Jul 2026 17:38:28 -0700 [thread overview]

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: cc2b5f627e8c Add linux-next specific files for 20260714
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13d446b9580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
> dashboard link: https://syzkaller.appspot.com/bug?extid=b5d7ab56d43de3fd5aac
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1310a232580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13c3b2ea580000

#syz test

--- x/kernel/softirq.c
+++ y/kernel/softirq.c
@@ -924,7 +924,6 @@ static void tasklet_action_common(struct
tl_head->tail = &tl_head->head;
local_irq_enable();

- tasklet_lock_callback();
while (list) {
struct tasklet_struct *t = list;

@@ -944,7 +943,6 @@ static void tasklet_action_common(struct
}
}
tasklet_unlock(t);
- tasklet_callback_sync_wait_running();
continue;
}
tasklet_unlock(t);
@@ -957,7 +955,6 @@ static void tasklet_action_common(struct
__raise_softirq_irqoff(softirq_nr);
local_irq_enable();
}
- tasklet_unlock_callback();
}

static __latent_entropy void tasklet_action(void)
@@ -1006,11 +1003,10 @@ void tasklet_unlock_spin_wait(struct tas
while (test_bit(TASKLET_STATE_RUN, &(t)->state)) {
if (IS_ENABLED(CONFIG_PREEMPT_RT)) {
/*
- * Prevent a live lock when current preempted soft
- * interrupt processing or prevents ksoftirqd from
- * running.
+ * wait_on_bit(TASKLET_STATE_RUN)
+ * https://lore.kernel.org/lkml/20260524004526...@sina.com/
*/
- tasklet_callback_cancel_wait_running();
+ tasklet_unlock_wait(t);
} else {
cpu_relax();
}
--

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

000b4600000-0x00000000b8600000] (64MB)
[ 6.309562][ T1] ACPI: bus type thunderbolt registered
[ 6.377027][ T70] kworker/u8:3 (70) used greatest stack depth: 27600 bytes left
[ 6.379001][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 6.385482][ T71] kworker/u8:4 (71) used greatest stack depth: 26864 bytes left
[ 6.443590][ T1] kvm_amd: CPU 0 isn't AMD or Hygon
[ 6.443627][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb63109b96, max_idle_ns: 440795265316 ns
[ 6.444316][ T1] clocksource: Switched to clocksource tsc
[ 6.521823][ T90] kworker/u8:4 (90) used greatest stack depth: 26464 bytes left
[ 6.528340][ T1] Initialise system trusted keyrings
[ 6.539063][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0)
[ 6.567689][ T1] DLM installed
[ 6.582216][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 6.600381][ T1] NFS: Registering the id_resolver key type
[ 6.600572][ T1] Key type id_resolver registered
[ 6.600588][ T1] Key type id_legacy registered
[ 6.601046][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 6.601294][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 6.607818][ T1] smbdirect: subsystem loading...
[ 6.658888][ T1] smbdirect: subsystem loaded
[ 6.689756][ T1] Key type cifs.spnego registered
[ 6.690042][ T1] Key type cifs.idmap registered
[ 6.714353][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 6.714364][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 6.714789][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 6.717535][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 6.717745][ T1] QNX4 filesystem 0.2.3 registered.
[ 6.717904][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 6.719175][ T1] fuse: init (API version 7.45)
[ 6.777683][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 6.788433][ T1] orangefs_init: module version upstream loaded
[ 6.797450][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 6.825598][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[ 6.858402][ T1] 9p: Installing v9fs 9p2000 file system support
[ 6.866996][ T1] NILFS version 2 loaded
[ 6.867015][ T1] befs: version: 0.9.3
[ 6.868718][ T1] ocfs2: Registered cluster interface o2cb
[ 6.886839][ T1] ocfs2: Registered cluster interface user
[ 6.888383][ T1] OCFS2 User DLM kernel interface loaded
[ 6.947010][ T1] gfs2: GFS2 installed
[ 6.978529][ T1] ceph: loaded (mds proto 32)
[ 7.012563][ T1] NET: Registered PF_ALG protocol family
[ 7.013620][ T1] async_tx: api initialized (async)
[ 7.013699][ T1] Key type asymmetric registered
[ 7.013790][ T1] Asymmetric key parser 'x509' registered
[ 7.013807][ T1] Asymmetric key parser 'pkcs8' registered
[ 7.013824][ T1] Key type pkcs7_test registered
[ 7.015569][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 7.017819][ T1] io scheduler mq-deadline registered
[ 7.017849][ T1] io scheduler kyber registered
[ 7.018479][ T1] io scheduler bfq registered
[ 7.085666][ T1] raid6: skipped pq benchmark and selected avx2x4
[ 7.128877][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 7.143344][ T1] ACPI: button: Power Button [PWRF]
[ 7.148753][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[ 7.172466][ T1] ACPI: button: Sleep Button [SLPF]
[ 7.224406][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 7.293693][ T10] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 7.294089][ T10] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 7.363984][ T10] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 7.364224][ T10] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 7.436996][ T10] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 7.437156][ T10] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 7.494545][ T10] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 8.725739][ T1] N_HDLC line discipline registered with maxframe=4096
[ 8.727756][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 8.754638][ T1] 00:02: ttyS0 I/O:0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 8.791590][ T1] 00:03: ttyS1 I/O:0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 8.826686][ T1] 00:04: ttyS2 I/O:0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 8.865829][ T1] 00:05: ttyS3 I/O:0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 8.929462][ T1] Non-volatile memory driver v1.3
[ 8.985374][ T1] usbcore: registered new interface driver xillyusb
[ 9.004396][ T1] ACPI: bus type drm_connector registered
[ 9.023763][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 9.037874][ T1] ------------[ cut here ]------------
[ 9.037874][ T1] ------------[ cut here ]------------
[ 9.037889][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup
[ 9.037911][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:873 at drm_mode_config_validate+0x1c6d/0x1e60, CPU#1: swapper/0/1
[ 9.037976][ T1] Modules linked in:
[ 9.038028][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 9.038057][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 9.038079][ T1] RIP: 0010:drm_mode_config_validate+0x1cae/0x1e60
[ 9.038109][ T1] Code: 0f 85 ae 00 00 00 4d 8d 77 10 8b 6d 00 4c 89 f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 ea db ac fc 49 8b 16 4c 89 ef 89 ee <67> 48 0f b9 3a eb 05 e8 b6 16 40 fc 49 bd 00 00 00 00 00 fc ff df
[ 9.038132][ T1] RSP: 0000:ffffc90000067810 EFLAGS: 00010246
[ 9.038150][ T1] RAX: 1ffff11004bc6a08 RBX: dffffc0000000000 RCX: ffff88801c6f5dc0
[ 9.038166][ T1] RDX: ffff888025749980 RSI: 0000000000000023 RDI: ffffffff8fdc6500
[ 9.038189][ T1] RBP: 0000000000000023 R08: 0000000000000000 R09: 0000000000000000
[ 9.038202][ T1] R10: dffffc0000000000 R11: fffffbfff1fa23b0 R12: dffffc0000000000
[ 9.038217][ T1] R13: ffffffff8fdc6500 R14: ffff888025e35040 R15: ffff888025e35030
[ 9.038233][ T1] FS: 0000000000000000(0000) GS:ffff888125ae1000(0000) knlGS:0000000000000000
[ 9.038251][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9.038266][ T1] CR2: 0000000000000000 CR3: 000000000e1b0000 CR4: 00000000003526f0
[ 9.038284][ T1] Call Trace:
[ 9.038293][ T1] <TASK>
[ 9.038317][ T1] ? debugfs_create_file_full+0x3f/0x60
[ 9.038358][ T1] drm_dev_register+0x7f/0xd80
[ 9.038385][ T1] vkms_create+0x40d/0x4f0
[ 9.038415][ T1] ? __pfx_vkms_init+0x10/0x10
[ 9.038445][ T1] vkms_init+0x57/0x80
[ 9.038468][ T1] do_one_initcall+0x250/0x870
[ 9.038496][ T1] ? __pfx_vkms_init+0x10/0x10
[ 9.038521][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 9.038554][ T1] ? lapic_next_event+0x11/0x20
[ 9.038586][ T1] ? clockevents_program_event+0x491/0x630
[ 9.038616][ T1] ? __pfx___schedule+0x10/0x10
[ 9.038666][ T1] ? irqentry_exit+0x218/0x8f0
[ 9.038699][ T1] ? lockdep_hardirqs_on+0x7a/0x110
[ 9.038732][ T1] ? irqentry_exit+0x218/0x8f0
[ 9.038763][ T1] ? trace_irq_disable+0x3b/0x140
[ 9.038804][ T1] ? strlen+0x2e/0x70
[ 9.038825][ T1] ? next_arg+0x4a0/0x5e0
[ 9.038846][ T1] ? parameq+0x14d/0x170
[ 9.038881][ T1] ? parse_args+0x9c3/0xad0
[ 9.038991][ T1] ? trace_kmalloc+0x2a/0xf0
[ 9.039173][ T1] ? rcu_is_watching+0x15/0xb0
[ 9.039282][ T1] do_initcall_level+0x10a/0x1a0
[ 9.039383][ T1] ? kernel_init+0x22/0x1d0
[ 9.039466][ T1] do_initcalls+0x59/0xa0
[ 9.039663][ T1] kernel_init_freeable+0x29d/0x3e0
[ 9.039697][ T1] ? __pfx_kernel_init+0x10/0x10
[ 9.039725][ T1] kernel_init+0x22/0x1d0
[ 9.039926][ T1] ? __pfx_kernel_init+0x10/0x10
[ 9.040000][ T1] ret_from_fork+0x514/0xb70
[ 9.040097][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 9.040206][ T1] ? __switch_to+0xc89/0x1420
[ 9.040362][ T1] ? __pfx_kernel_init+0x10/0x10
[ 9.040420][ T1] ret_from_fork_asm+0x1a/0x30
[ 9.040581][ T1] </TASK>
[ 9.040669][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 9.040725][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 9.040807][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 9.040848][ T1] Call Trace:
[ 9.040882][ T1] <TASK>
[ 9.040904][ T1] vpanic+0x56c/0xa60
[ 9.040992][ T1] ? __pfx__printk+0x10/0x10
[ 9.041074][ T1] ? __pfx_vpanic+0x10/0x10
[ 9.041130][ T1] ? is_bpf_text_address+0x292/0x2b0
[ 9.041204][ T1] ? is_bpf_text_address+0x26/0x2b0
[ 9.041339][ T1] panic+0xc5/0xd0
[ 9.041403][ T1] ? __pfx_panic+0x10/0x10
[ 9.041481][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 9.041578][ T1] __warn+0x315/0x4c0
[ 9.041653][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 9.041739][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 9.041799][ T1] __report_bug+0x276/0x570
[ 9.041905][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 9.041986][ T1] ? __pfx___report_bug+0x10/0x10
[ 9.042092][ T1] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 9.042187][ T1] ? lockdep_hardirqs_on+0x7a/0x110
[ 9.042302][ T1] ? rt_mutex_slowunlock+0x4ee/0xa20
[ 9.042385][ T1] report_bug_entry+0x19a/0x290
[ 9.042480][ T1] ? drm_mode_config_validate+0x1cae/0x1e60
[ 9.042543][ T1] ? drm_mode_config_validate+0x1cb3/0x1e60
[ 9.042614][ T1] handle_bug+0xce/0x200
[ 9.042680][ T1] exc_invalid_op+0x1a/0x50
[ 9.042758][ T1] asm_exc_invalid_op+0x1a/0x20
[ 9.042823][ T1] RIP: 0010:drm_mode_config_validate+0x1cae/0x1e60
[ 9.042898][ T1] Code: 0f 85 ae 00 00 00 4d 8d 77 10 8b 6d 00 4c 89 f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 ea db ac fc 49 8b 16 4c 89 ef 89 ee <67> 48 0f b9 3a eb 05 e8 b6 16 40 fc 49 bd 00 00 00 00 00 fc ff df
[ 9.042950][ T1] RSP: 0000:ffffc90000067810 EFLAGS: 00010246
[ 9.043010][ T1] RAX: 1ffff11004bc6a08 RBX: dffffc0000000000 RCX: ffff88801c6f5dc0
[ 9.043062][ T1] RDX: ffff888025749980 RSI: 0000000000000023 RDI: ffffffff8fdc6500
[ 9.043113][ T1] RBP: 0000000000000023 R08: 0000000000000000 R09: 0000000000000000
[ 9.043147][ T1] R10: dffffc0000000000 R11: fffffbfff1fa23b0 R12: dffffc0000000000
[ 9.043195][ T1] R13: ffffffff8fdc6500 R14: ffff888025e35040 R15: ffff888025e35030
[ 9.043316][ T1] ? debugfs_create_file_full+0x3f/0x60
[ 9.043423][ T1] drm_dev_register+0x7f/0xd80
[ 9.043498][ T1] vkms_create+0x40d/0x4f0
[ 9.043593][ T1] ? __pfx_vkms_init+0x10/0x10
[ 9.043664][ T1] vkms_init+0x57/0x80
[ 9.043729][ T1] do_one_initcall+0x250/0x870
[ 9.044094][ T1] ? __pfx_vkms_init+0x10/0x10
[ 9.044118][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 9.044146][ T1] ? lapic_next_event+0x11/0x20
[ 9.044174][ T1] ? clockevents_program_event+0x491/0x630
[ 9.044199][ T1] ? __pfx___schedule+0x10/0x10
[ 9.044248][ T1] ? irqentry_exit+0x218/0x8f0
[ 9.044343][ T1] ? lockdep_hardirqs_on+0x7a/0x110
[ 9.044442][ T1] ? irqentry_exit+0x218/0x8f0
[ 9.044538][ T1] ? trace_irq_disable+0x3b/0x140
[ 9.044829][ T1] ? strlen+0x2e/0x70
[ 9.044909][ T1] ? next_arg+0x4a0/0x5e0
[ 9.044985][ T1] ? parameq+0x14d/0x170
[ 9.045093][ T1] ? parse_args+0x9c3/0xad0
[ 9.045252][ T1] ? trace_kmalloc+0x2a/0xf0
[ 9.045367][ T1] ? rcu_is_watching+0x15/0xb0
[ 9.045464][ T1] do_initcall_level+0x10a/0x1a0
[ 9.045576][ T1] ? kernel_init+0x22/0x1d0
[ 9.045641][ T1] do_initcalls+0x59/0xa0
[ 9.045737][ T1] kernel_init_freeable+0x29d/0x3e0
[ 9.045822][ T1] ? __pfx_kernel_init+0x10/0x10
[ 9.045927][ T1] kernel_init+0x22/0x1d0
[ 9.045999][ T1] ? __pfx_kernel_init+0x10/0x10
[ 9.046085][ T1] ret_from_fork+0x514/0xb70
[ 9.046377][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 9.046408][ T1] ? __switch_to+0xc89/0x1420
[ 9.046436][ T1] ? __pfx_kernel_init+0x10/0x10
[ 9.046461][ T1] ret_from_fork_asm+0x1a/0x30
[ 9.046513][ T1] </TASK>
[ 9.047284][ T1] Kernel Offset: disabled


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2961944591=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 492bab153d
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=492bab153dea5e0e414bd0bbf60c3871267255ed -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-151452" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=492bab153dea5e0e414bd0bbf60c3871267255ed -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-151452" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=492bab153dea5e0e414bd0bbf60c3871267255ed -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-151452" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"492bab153dea5e0e414bd0bbf60c3871267255ed\"
/usr/bin/ld: /tmp/ccHTRlOp.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=177c909e580000


Tested on:

commit: 9eebf259 Add linux-next specific files for 20260723
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=76133f44547cb4b0

dashboard link: https://syzkaller.appspot.com/bug?extid=b5d7ab56d43de3fd5aac
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=16ebb2ea580000

[Hillf Danton]

> Date: Sat, 25 Jul 2026 17:38:28 -0700 [thread overview]

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: cc2b5f627e8c Add linux-next specific files for 20260714
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13d446b9580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
> dashboard link: https://syzkaller.appspot.com/bug?extid=b5d7ab56d43de3fd5aac
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1310a232580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13c3b2ea580000

--- x/drivers/gpu/drm/drm_mode_config.c
+++ y/drivers/gpu/drm/drm_mode_config.c
@@ -869,8 +869,7 @@ static void validate_blend_mode_for_alph
for (i = 0; i < plane->format_count; i++) {
fmt = drm_format_info(plane->format_types[i]);
if (fmt->has_alpha) {
- WARN(1, "[PLANE:%d:%s] pixel format with alpha exposed but blend mode not setup",
- plane->base.id, plane->name);
+ pr_err("[PLANE:%d:%s] pixel format with alpha exposed but blend mode not setup\n", plane->base.id, plane->name);
break;
}
}
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine



Tested on:

commit: 9eebf259 Add linux-next specific files for 20260723
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14aaa499580000
kernel config: https://syzkaller.appspot.com/x/.config?x=76133f44547cb4b0

dashboard link: https://syzkaller.appspot.com/bug?extid=b5d7ab56d43de3fd5aac
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17a03fde580000