syzbot

IPVS: ftp: loaded support on port[0] = 21
======================================================
WARNING: possible circular locking dependency detected
4.14.303-syzkaller #0 Not tainted
------------------------------------------------------
swapper/1/0 is trying to acquire lock:
 (&(&gsm->tx_lock)->rlock){-...}, at: [<ffffffff8357517e>] gsmld_write_wakeup+0x4e/0xd0 drivers/tty/n_gsm.c:2490

but task is already holding lock:
 (&port_lock_key){-.-.}, at: [<ffffffff835caa20>] serial8250_handle_irq.part.0+0x20/0x390 drivers/tty/serial/8250/8250_port.c:1894

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&port_lock_key){-.-.}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
       uart_write_room+0xd5/0x340 drivers/tty/serial/serial_core.c:643
       tty_write_room+0x61/0x80 drivers/tty/tty_ioctl.c:78
       gsmld_write+0x69/0x120 drivers/tty/n_gsm.c:2546
       do_tty_write drivers/tty/tty_io.c:959 [inline]
       tty_write+0x410/0x740 drivers/tty/tty_io.c:1043
       __vfs_write+0xe4/0x630 fs/read_write.c:480
       __kernel_write+0xf5/0x330 fs/read_write.c:501
       write_pipe_buf+0x143/0x1c0 fs/splice.c:797
       splice_from_pipe_feed fs/splice.c:502 [inline]
       __splice_from_pipe+0x326/0x7a0 fs/splice.c:626
       splice_from_pipe fs/splice.c:661 [inline]
       default_file_splice_write+0xc5/0x150 fs/splice.c:809
       do_splice_from fs/splice.c:851 [inline]
       direct_splice_actor+0x115/0x160 fs/splice.c:1018
       splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
       do_splice_direct+0x164/0x210 fs/splice.c:1061
       do_sendfile+0x47f/0xb30 fs/read_write.c:1441
       SYSC_sendfile64 fs/read_write.c:1502 [inline]
       SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x5e/0xd3

-> #0 (&(&gsm->tx_lock)->rlock){-...}:
       lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
       gsmld_write_wakeup+0x4e/0xd0 drivers/tty/n_gsm.c:2490
       tty_wakeup+0xc3/0xf0 drivers/tty/tty_io.c:533
       tty_port_default_wakeup+0x26/0x40 drivers/tty/tty_port.c:49
       serial8250_tx_chars+0x3fe/0xc70 drivers/tty/serial/8250/8250_port.c:1828
       serial8250_handle_irq.part.0+0x2c7/0x390 drivers/tty/serial/8250/8250_port.c:1918
       serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1891 [inline]
       serial8250_default_handle_irq+0x8a/0x1f0 drivers/tty/serial/8250/8250_port.c:1934
       serial8250_interrupt+0xf3/0x210 drivers/tty/serial/8250/8250_core.c:129
       __handle_irq_event_percpu+0xee/0x7f0 kernel/irq/handle.c:147
       handle_irq_event_percpu kernel/irq/handle.c:187 [inline]
       handle_irq_event+0xed/0x240 kernel/irq/handle.c:204
       handle_edge_irq+0x224/0xc40 kernel/irq/chip.c:770
       generic_handle_irq_desc include/linux/irqdesc.h:159 [inline]
       handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87
       do_IRQ+0x93/0x1d0 arch/x86/kernel/irq.c:230
       ret_from_intr+0x0/0x1e
       native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
       arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
       default_idle+0x47/0x370 arch/x86/kernel/process.c:558
       cpuidle_idle_call kernel/sched/idle.c:156 [inline]
       do_idle+0x250/0x3c0 kernel/sched/idle.c:246
       cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:351
       start_secondary+0x4db/0x670 arch/x86/kernel/smpboot.c:272
       secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&port_lock_key);
                               lock(&(&gsm->tx_lock)->rlock);
                               lock(&port_lock_key);
  lock(&(&gsm->tx_lock)->rlock);

 *** DEADLOCK ***

3 locks held by swapper/1/0:
 #0:  (&(&i->lock)->rlock){-.-.}, at: [<ffffffff835b7daa>] spin_lock include/linux/spinlock.h:317 [inline]
 #0:  (&(&i->lock)->rlock){-.-.}, at: [<ffffffff835b7daa>] serial8250_interrupt+0x3a/0x210 drivers/tty/serial/8250/8250_core.c:119
 #1:  (&port_lock_key){-.-.}, at: [<ffffffff835caa20>] serial8250_handle_irq.part.0+0x20/0x390 drivers/tty/serial/8250/8250_port.c:1894
 #2:  (&tty->ldisc_sem){++++}, at: [<ffffffff8355cfab>] tty_ldisc_ref+0x1b/0x80 drivers/tty/tty_ldisc.c:305

stack backtrace:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.303-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258
 check_prev_add kernel/locking/lockdep.c:1905 [inline]
 check_prevs_add kernel/locking/lockdep.c:2022 [inline]
 validate_chain kernel/locking/lockdep.c:2464 [inline]
 __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
 gsmld_write_wakeup+0x4e/0xd0 drivers/tty/n_gsm.c:2490
 tty_wakeup+0xc3/0xf0 drivers/tty/tty_io.c:533
 tty_port_default_wakeup+0x26/0x40 drivers/tty/tty_port.c:49
 serial8250_tx_chars+0x3fe/0xc70 drivers/tty/serial/8250/8250_port.c:1828
 serial8250_handle_irq.part.0+0x2c7/0x390 drivers/tty/serial/8250/8250_port.c:1918
 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1891 [inline]
 serial8250_default_handle_irq+0x8a/0x1f0 drivers/tty/serial/8250/8250_port.c:1934
 serial8250_interrupt+0xf3/0x210 drivers/tty/serial/8250/8250_core.c:129
 __handle_irq_event_percpu+0xee/0x7f0 kernel/irq/handle.c:147
 handle_irq_event_percpu kernel/irq/handle.c:187 [inline]
 handle_irq_event+0xed/0x240 kernel/irq/handle.c:204
 handle_edge_irq+0x224/0xc40 kernel/irq/chip.c:770
 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline]
 handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87
 do_IRQ+0x93/0x1d0 arch/x86/kernel/irq.c:230
 common_interrupt+0x93/0x93 arch/x86/entry/entry_64.S:578
 </IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
RSP: 0018:ffff8880b5477e68 EFLAGS: 000002c6 ORIG_RAX: ffffffffffffffc8
RAX: 1ffffffff11e13dc RBX: dffffc0000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880b5464bc4
RBP: ffffffff88f09ed0 R08: ffffffff88ccbd68 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffed1016a8c868
R13: ffff8880b5464340 R14: 0000000000000000 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
 default_idle+0x47/0x370 arch/x86/kernel/process.c:558
 cpuidle_idle_call kernel/sched/idle.c:156 [inline]
 do_idle+0x250/0x3c0 kernel/sched/idle.c:246
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:351
 start_secondary+0x4db/0x670 arch/x86/kernel/smpboot.c:272
 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240