syzbot

------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
5.15.109-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/7699 is trying to acquire lock:
ffff80001497f4b8 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138

but task is already holding lock:
ffff80001508ed58 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (depot_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
       stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307
       kasan_save_stack+0x54/0x68 mm/kasan/common.c:40
       kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
       irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101
       tell_cpu_to_push+0x1d8/0x408 kernel/sched/rt.c:2149
       pull_rt_task kernel/sched/rt.c:2215 [inline]
       balance_rt+0x268/0x354 kernel/sched/rt.c:1560
       put_prev_task_balance kernel/sched/core.c:5620 [inline]
       __pick_next_task kernel/sched/core.c:5660 [inline]
       pick_next_task kernel/sched/core.c:6188 [inline]
       __schedule+0x714/0x1e38 kernel/sched/core.c:6336
       do_task_dead+0xcc/0xd0 kernel/sched/core.c:6390
       do_exit+0x14c8/0x2134 kernel/exit.c:923
       do_group_exit+0x110/0x268 kernel/exit.c:994
       get_signal+0x634/0x1550 kernel/signal.c:2889
       do_signal arch/arm64/kernel/signal.c:890 [inline]
       do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
       prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
       exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
       el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:597
       el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #2 (&rq->__lock){-.-.}-{2:2}:
       _raw_spin_lock_nested+0xb4/0x110 kernel/locking/spinlock.c:368
       raw_spin_rq_lock_nested+0x2c/0x44 kernel/sched/core.c:475
       raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
       rq_lock kernel/sched/sched.h:1621 [inline]
       task_fork_fair+0x7c/0x23c kernel/sched/fair.c:11477
       sched_cgroup_fork+0x334/0x3d8 kernel/sched/core.c:4462
       copy_process+0x24d4/0x3750 kernel/fork.c:2312
       kernel_clone+0x1d8/0xa58 kernel/fork.c:2601
       kernel_thread+0x148/0x1bc kernel/fork.c:2653
       rest_init+0x2c/0x38c init/main.c:701
       arch_call_rest_init+0x14/0x20 init/main.c:889
       start_kernel+0x440/0x600 init/main.c:1144
       __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468

-> #1 (&p->pi_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
       try_to_wake_up+0xb0/0xc2c kernel/sched/core.c:4026
       wake_up_process+0x18/0x24 kernel/sched/core.c:4211
       __up+0x11c/0x148 kernel/locking/semaphore.c:265
       up+0x90/0xb0 kernel/locking/semaphore.c:190
       __up_console_sem+0x8c/0x100 kernel/printk/printk.c:256
       console_unlock+0x1160/0x1394 kernel/printk/printk.c:2750
       do_fb_ioctl+0xc58/0xf9c drivers/video/fbdev/core/fbmem.c:1132
       fb_ioctl+0xec/0x134 drivers/video/fbdev/core/fbmem.c:1205
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:874 [inline]
       __se_sys_ioctl fs/ioctl.c:860 [inline]
       __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
       do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
       el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
       el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #0 ((console_sem).lock){-...}-{2:2}:
       check_prev_add kernel/locking/lockdep.c:3053 [inline]
       check_prevs_add kernel/locking/lockdep.c:3172 [inline]
       validate_chain kernel/locking/lockdep.c:3787 [inline]
       __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
       lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
       down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138
       __down_trylock_console_sem+0x80/0x144 kernel/printk/printk.c:239
       console_trylock+0xb8/0x1f8 kernel/printk/printk.c:2565
       console_trylock_spinning+0x1c/0x280 kernel/printk/printk.c:1867
       vprintk_emit+0x120/0x218 kernel/printk/printk.c:2267
       vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279
       vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50
       _printk+0xdc/0x128 kernel/printk/printk.c:2289
       __warn_printk+0xb4/0x134 kernel/panic.c:710
       depot_alloc_stack lib/stackdepot.c:114 [inline]
       stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312
       kasan_save_stack+0x54/0x68 mm/kasan/common.c:40
       kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
       irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101
       rto_push_irq_work_func+0x13c/0x340 kernel/sched/rt.c:2187
       irq_work_single+0xbc/0x1e4 kernel/irq_work.c:155
       flush_smp_call_function_queue+0x510/0x8c4 kernel/smp.c:666
       generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544
       do_handle_IPI arch/arm64/kernel/smp.c:902 [inline]
       ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948
       handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933
       generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
       handle_irq_desc kernel/irq/irqdesc.c:651 [inline]
       handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706
       gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
       call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:899
       do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
       el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
       el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
       el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
       tomoyo_update_stat security/tomoyo/common.c:2340 [inline]
       tomoyo_supervisor+0x2dc/0x115c security/tomoyo/common.c:2079
       tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
       tomoyo_path_permission+0x1f4/0x2fc security/tomoyo/file.c:587
       tomoyo_check_open_permission+0x264/0x3f4 security/tomoyo/file.c:777
       tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
       security_file_open+0x6c/0xb0 security/security.c:1650
       do_dentry_open+0x29c/0xed8 fs/open.c:813
       vfs_open+0x7c/0x90 fs/open.c:956
       do_open fs/namei.c:3538 [inline]
       path_openat+0x1f28/0x26f0 fs/namei.c:3672
       do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
       do_sys_openat2+0x128/0x3d8 fs/open.c:1211
       do_sys_open fs/open.c:1227 [inline]
       __do_sys_openat fs/open.c:1243 [inline]
       __se_sys_openat fs/open.c:1238 [inline]
       __arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
       do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
       el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
       el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
       el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

other info that might help us debug this:

Chain exists of:
  (console_sem).lock --> &rq->__lock --> depot_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(depot_lock);
                               lock(&rq->__lock);
                               lock(depot_lock);
  lock((console_sem).lock);

 *** DEADLOCK ***

2 locks held by syz-executor.0/7699:
 #0: ffff80001500ab38 (tomoyo_ss){....}-{0:0}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:268
 #1: ffff80001508ed58 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307

stack backtrace:
CPU: 1 PID: 7699 Comm: syz-executor.0 Not tainted 5.15.109-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
 check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
 check_prev_add kernel/locking/lockdep.c:3053 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain kernel/locking/lockdep.c:3787 [inline]
 __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162
 down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138
 __down_trylock_console_sem+0x80/0x144 kernel/printk/printk.c:239
 console_trylock+0xb8/0x1f8 kernel/printk/printk.c:2565
 console_trylock_spinning+0x1c/0x280 kernel/printk/printk.c:1867
 vprintk_emit+0x120/0x218 kernel/printk/printk.c:2267
 vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279
 vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50
 _printk+0xdc/0x128 kernel/printk/printk.c:2289
 __warn_printk+0xb4/0x134 kernel/panic.c:710
 depot_alloc_stack lib/stackdepot.c:114 [inline]
 stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312
 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40
 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101
 rto_push_irq_work_func+0x13c/0x340 kernel/sched/rt.c:2187
 irq_work_single+0xbc/0x1e4 kernel/irq_work.c:155
 flush_smp_call_function_queue+0x510/0x8c4 kernel/smp.c:666
 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544
 do_handle_IPI arch/arm64/kernel/smp.c:902 [inline]
 ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948
 handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq_desc kernel/irq/irqdesc.c:651 [inline]
 handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:899
 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
 tomoyo_update_stat security/tomoyo/common.c:2340 [inline]
 tomoyo_supervisor+0x2dc/0x115c security/tomoyo/common.c:2079
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission+0x1f4/0x2fc security/tomoyo/file.c:587
 tomoyo_check_open_permission+0x264/0x3f4 security/tomoyo/file.c:777
 tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
 security_file_open+0x6c/0xb0 security/security.c:1650
 do_dentry_open+0x29c/0xed8 fs/open.c:813
 vfs_open+0x7c/0x90 fs/open.c:956
 do_open fs/namei.c:3538 [inline]
 path_openat+0x1f28/0x26f0 fs/namei.c:3672
 do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
 do_sys_openat2+0x128/0x3d8 fs/open.c:1211
 do_sys_open fs/open.c:1227 [inline]
 __do_sys_openat fs/open.c:1243 [inline]
 __se_sys_openat fs/open.c:1238 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Stack depot reached limit capacity
WARNING: CPU: 1 PID: 7699 at lib/stackdepot.c:114 stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312
Modules linked in:
CPU: 1 PID: 7699 Comm: syz-executor.0 Not tainted 5.15.109-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312
lr : depot_alloc_stack lib/stackdepot.c:114 [inline]
lr : stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312
sp : ffff800008017a90
x29: ffff800008017aa0 x28: 0000000000000120 x27: 00000000000000c0
x26: 0000000000000000 x25: 00000000000bbdd3 x24: ffff0001b3000000
x23: 0000000038fbbdd3 x22: 0000000000000108 x21: 0000000000000000
x20: 0000000000000021 x19: ffff800008017b00 x18: 0000000000010002
x17: ff8080000833451c x16: ffff8000119409d4 x15: ffff80000833451c
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000832bfc4 x10: 0000000000010001 x9 : 13ae05a64c28b900
x8 : 13ae05a64c28b900 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000080171f8 x4 : ffff8000149af960 x3 : ffff80000854ade0
x2 : 0000000000000001 x1 : 0000000100010001 x0 : 0000000000000022
Call trace:
 stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312
 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40
 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101
 rto_push_irq_work_func+0x13c/0x340 kernel/sched/rt.c:2187
 irq_work_single+0xbc/0x1e4 kernel/irq_work.c:155
 flush_smp_call_function_queue+0x510/0x8c4 kernel/smp.c:666
 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544
 do_handle_IPI arch/arm64/kernel/smp.c:902 [inline]
 ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948
 handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq_desc kernel/irq/irqdesc.c:651 [inline]
 handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:899
 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
 tomoyo_update_stat security/tomoyo/common.c:2340 [inline]
 tomoyo_supervisor+0x2dc/0x115c security/tomoyo/common.c:2079
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission+0x1f4/0x2fc security/tomoyo/file.c:587
 tomoyo_check_open_permission+0x264/0x3f4 security/tomoyo/file.c:777
 tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311
 security_file_open+0x6c/0xb0 security/security.c:1650
 do_dentry_open+0x29c/0xed8 fs/open.c:813
 vfs_open+0x7c/0x90 fs/open.c:956
 do_open fs/namei.c:3538 [inline]
 path_openat+0x1f28/0x26f0 fs/namei.c:3672
 do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
 do_sys_openat2+0x128/0x3d8 fs/open.c:1211
 do_sys_open fs/open.c:1227 [inline]
 __do_sys_openat fs/open.c:1243 [inline]
 __se_sys_openat fs/open.c:1238 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 2848
hardirqs last  enabled at (2847): [<ffff80001193ee68>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline]
hardirqs last  enabled at (2847): [<ffff80001193ee68>] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91
hardirqs last disabled at (2848): [<ffff80001193f0b0>] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227
softirqs last  enabled at (1328): [<ffff800008030068>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31
softirqs last disabled at (1326): [<ffff800008030034>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace e3786c4ce23c87f0 ]---
vkms_vblank_simulate: vblank timer overrun