======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/1:20/4438 is trying to acquire lock:
ffff0000d36ce2e8 (&tty->termios_rwsem){++++}-{3:3}, at: n_tty_flush_buffer+0x30/0x1e4 drivers/tty/n_tty.c:370

but task is already holding lock:
ffff0000c08480b8 (&buf->lock){+.+.}-{3:3}, at: tty_buffer_flush+0x80/0x3fc drivers/tty/tty_buffer.c:230

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&buf->lock){+.+.}-{3:3}:
       __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       tty_buffer_flush+0x80/0x3fc drivers/tty/tty_buffer.c:230
       tty_ldisc_flush+0x70/0xcc drivers/tty/tty_ldisc.c:389
       __do_SAK+0x224/0x5b8 drivers/tty/tty_io.c:3011
       vc_SAK+0x78/0x1d4 drivers/tty/vt/vt_ioctl.c:995
       process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
       worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
       kthread+0x254/0x2e0 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #2 (console_lock){+.+.}-{0:0}:
       console_lock+0x1bc/0x230 kernel/printk/printk.c:2629
       register_console+0x404/0x8c4 kernel/printk/printk.c:3236
       uart_configure_port drivers/tty/serial/serial_core.c:2616 [inline]
       uart_add_one_port+0x10d0/0x1974 drivers/tty/serial/serial_core.c:3135
       pl011_register_port+0x190/0x430 drivers/tty/serial/amba-pl011.c:2776
       sbsa_uart_probe+0x420/0x548 drivers/tty/serial/amba-pl011.c:2935
       platform_probe+0x148/0x1c8 drivers/base/platform.c:1400
       call_driver_probe drivers/base/dd.c:-1 [inline]
       really_probe+0x3a0/0xac4 drivers/base/dd.c:638
       __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804
       driver_probe_device+0x78/0x324 drivers/base/dd.c:834
       __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962
       bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429
       __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034
       device_initial_probe+0x24/0x34 drivers/base/dd.c:1083
       bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489
       device_add+0x93c/0xe4c drivers/base/core.c:3712
       platform_device_add+0x3f8/0x6f4 drivers/base/platform.c:717
       platform_device_register_full+0x4fc/0x610 drivers/base/platform.c:844
       acpi_create_platform_device+0x464/0x594 drivers/acpi/acpi_platform.c:152
       acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2118
       acpi_bus_attach+0x880/0xa9c drivers/acpi/scan.c:2229
       acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1090
       device_for_each_child+0xf0/0x180 drivers/base/core.c:4043
       acpi_dev_for_each_child+0x98/0xe4 drivers/acpi/bus.c:1102
       acpi_bus_attach+0x284/0xa9c drivers/acpi/scan.c:2234
       acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1090
       device_for_each_child+0xf0/0x180 drivers/base/core.c:4043
       acpi_dev_for_each_child+0x98/0xe4 drivers/acpi/bus.c:1102
       acpi_bus_attach+0x284/0xa9c drivers/acpi/scan.c:2234
       acpi_bus_scan+0xbc/0x1bc drivers/acpi/scan.c:2445
       acpi_scan_init+0x1bc/0x5dc drivers/acpi/scan.c:2615
       acpi_init+0x16c/0x220 drivers/acpi/bus.c:1411
       do_one_initcall+0x278/0x9f0 init/main.c:1309
       do_initcall_level+0x158/0x214 init/main.c:1382
       do_initcalls+0x58/0xac init/main.c:1398
       do_basic_setup+0x8c/0xa0 init/main.c:1417
       kernel_init_freeable+0x35c/0x4f0 init/main.c:1637
       kernel_init+0x24/0x1d8 init/main.c:1525
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #1 (&port->mutex){+.+.}-{3:3}:
       __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       uart_set_termios+0x74/0x718 drivers/tty/serial/serial_core.c:1651
       tty_set_termios+0x8d4/0x1150 drivers/tty/tty_ioctl.c:363
       set_termios+0x484/0x610 drivers/tty/tty_ioctl.c:537
       tty_mode_ioctl+0x510/0x790 drivers/tty/tty_ioctl.c:822
       n_tty_ioctl_helper+0xb0/0x2d8 drivers/tty/tty_ioctl.c:1001
       n_tty_ioctl+0x190/0x42c drivers/tty/n_tty.c:2510
       tty_ioctl+0x920/0xd88 drivers/tty/tty_io.c:2785
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:870 [inline]
       __se_sys_ioctl fs/ioctl.c:856 [inline]
       __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #0 (&tty->termios_rwsem){++++}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3095 [inline]
       check_prevs_add kernel/locking/lockdep.c:3214 [inline]
       validate_chain kernel/locking/lockdep.c:3830 [inline]
       __lock_acquire+0x2808/0x6634 kernel/locking/lockdep.c:5063
       lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
       down_write+0x5c/0x88 kernel/locking/rwsem.c:1573
       n_tty_flush_buffer+0x30/0x1e4 drivers/tty/n_tty.c:370
       tty_buffer_flush+0x2e8/0x3fc drivers/tty/tty_buffer.c:242
       tty_ldisc_flush+0x70/0xcc drivers/tty/tty_ldisc.c:389
       __do_SAK+0x224/0x5b8 drivers/tty/tty_io.c:3011
       vc_SAK+0x78/0x1d4 drivers/tty/vt/vt_ioctl.c:995
       process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
       worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
       kthread+0x254/0x2e0 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

other info that might help us debug this:

Chain exists of:
  &tty->termios_rwsem --> console_lock --> &buf->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&buf->lock);
                               lock(console_lock);
                               lock(&buf->lock);
  lock(&tty->termios_rwsem);

 *** DEADLOCK ***

5 locks held by kworker/1:20/4438:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000214d7c40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff80001554d1a0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x30/0x1d4 drivers/tty/vt/vt_ioctl.c:985
 #3: ffff0000d36ce098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref drivers/tty/tty_ldisc.c:264 [inline]
 #3: ffff0000d36ce098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x24/0xcc drivers/tty/tty_ldisc.c:387
 #4: ffff0000c08480b8 (&buf->lock){+.+.}-{3:3}, at: tty_buffer_flush+0x80/0x3fc drivers/tty/tty_buffer.c:230

stack backtrace:
CPU: 1 PID: 4438 Comm: kworker/1:20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: events vc_SAK
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
 check_noncircular+0x264/0x2f8 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3095 [inline]
 check_prevs_add kernel/locking/lockdep.c:3214 [inline]
 validate_chain kernel/locking/lockdep.c:3830 [inline]
 __lock_acquire+0x2808/0x6634 kernel/locking/lockdep.c:5063
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 down_write+0x5c/0x88 kernel/locking/rwsem.c:1573
 n_tty_flush_buffer+0x30/0x1e4 drivers/tty/n_tty.c:370
 tty_buffer_flush+0x2e8/0x3fc drivers/tty/tty_buffer.c:242
 tty_ldisc_flush+0x70/0xcc drivers/tty/tty_ldisc.c:389
 __do_SAK+0x224/0x5b8 drivers/tty/tty_io.c:3011
 vc_SAK+0x78/0x1d4 drivers/tty/vt/vt_ioctl.c:995
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
tty tty1: SAK: killed process 4571 (syz.1.70): by fd#3
tty tty1: SAK: killed process 4575 (syz.1.74): by fd#3
tty tty1: SAK: killed process 4614 (syz.0.113): by fd#3
tty tty1: SAK: killed process 4658 (syz.3.138): by fd#3
tty tty1: SAK: killed process 4664 (syz.3.144): by fd#3
tty tty1: SAK: killed process 4665 (syz.4.21): by fd#3
tty tty1: SAK: killed process 4666 (syz.2.19): by fd#3