[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.132' (ECDSA) to the list of known hosts. syzkaller login: [ 53.824580][ T7024] IPVS: ftp: loaded support on port[0] = 21 [ 53.828241][ T7022] IPVS: ftp: loaded support on port[0] = 21 [ 53.833000][ T7020] IPVS: ftp: loaded support on port[0] = 21 [ 53.842531][ T7026] IPVS: ftp: loaded support on port[0] = 21 [ 53.846433][ T7025] IPVS: ftp: loaded support on port[0] = 21 [ 53.858080][ T7023] IPVS: ftp: loaded support on port[0] = 21 [ 70.973466][T13709] ttyprintk ttyprintk: tty_port_close_start: tty->count = 1 port count = 3281 [ 70.983095][ C0] [ 70.983097][ C0] ====================================================== [ 70.983099][ C0] WARNING: possible circular locking dependency detected [ 70.983101][ C0] 5.6.0-syzkaller #0 Not tainted [ 70.983103][ C0] ------------------------------------------------------ [ 70.983105][ C0] syz-executor290/13709 is trying to acquire lock: [ 70.983106][ C0] ffffffff892e5060 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x2d/0x60 [ 70.983111][ C0] [ 70.983113][ C0] but task is already holding lock: [ 70.983114][ C0] ffffffff8c07c7c0 (&port->lock#2){-.-.}-{2:2}, at: tty_port_close_start+0x58/0x550 [ 70.983120][ C0] [ 70.983121][ C0] which lock already depends on the new lock. [ 70.983122][ C0] [ 70.983123][ C0] [ 70.983125][ C0] the existing dependency chain (in reverse order) is: [ 70.983126][ C0] [ 70.983127][ C0] -> #2 (&port->lock#2){-.-.}-{2:2}: [ 70.983132][ C0] lock_acquire+0x169/0x480 [ 70.983134][ C0] _raw_spin_lock_irqsave+0x9e/0xc0 [ 70.983135][ C0] tty_port_tty_get+0x21/0xe0 [ 70.983136][ C0] tty_port_default_wakeup+0x11/0x40 [ 70.983138][ C0] serial8250_tx_chars+0x5ea/0x800 [ 70.983140][ C0] serial8250_handle_irq+0x2fd/0x3e0 [ 70.983141][ C0] serial8250_default_handle_irq+0xac/0x190 [ 70.983143][ C0] serial8250_interrupt+0x93/0x180 [ 70.983144][ C0] __handle_irq_event_percpu+0x1b7/0x610 [ 70.983146][ C0] handle_irq_event+0xbd/0x280 [ 70.983147][ C0] handle_edge_irq+0x245/0xbf0 [ 70.983148][ C0] do_IRQ+0xf6/0x1d0 [ 70.983150][ C0] ret_from_intr+0x0/0x2b [ 70.983151][ C0] _raw_spin_unlock_irqrestore+0xa5/0xd0 [ 70.983152][ C0] uart_write+0x7d3/0x9c0 [ 70.983154][ C0] do_output_char+0x63b/0x940 [ 70.983155][ C0] n_tty_write+0xd5c/0x1170 [ 70.983156][ C0] tty_write+0x593/0x940 [ 70.983158][ C0] do_iter_write+0x402/0x540 [ 70.983159][ C0] do_writev+0x23f/0x4a0 [ 70.983160][ C0] do_syscall_64+0xf3/0x1b0 [ 70.983162][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 70.983163][ C0] [ 70.983163][ C0] -> #1 (&port->lock){-.-.}-{2:2}: [ 70.983168][ C0] lock_acquire+0x169/0x480 [ 70.983169][ C0] _raw_spin_lock_irqsave+0x9e/0xc0 [ 70.983171][ C0] serial8250_console_write+0x13e/0xd50 [ 70.983172][ C0] console_unlock+0x90c/0xec0 [ 70.983174][ C0] vprintk_emit+0x1f8/0x3b0 [ 70.983175][ C0] printk+0x62/0x83 [ 70.983176][ C0] register_console+0xb64/0xed0 [ 70.983178][ C0] univ8250_console_init+0x41/0x43 [ 70.983179][ C0] console_init+0x52/0x97 [ 70.983180][ C0] start_kernel+0x426/0x774 [ 70.983182][ C0] secondary_startup_64+0xa4/0xb0 [ 70.983182][ C0] [ 70.983183][ C0] -> #0 (console_owner){-.-.}-{0:0}: [ 70.983188][ C0] validate_chain+0x1b09/0x8920 [ 70.983189][ C0] __lock_acquire+0x116c/0x2b90 [ 70.983191][ C0] lock_acquire+0x169/0x480 [ 70.983192][ C0] console_lock_spinning_enable+0x52/0x60 [ 70.983193][ C0] console_unlock+0x73f/0xec0 [ 70.983195][ C0] vprintk_emit+0x1f8/0x3b0 [ 70.983196][ C0] printk+0x62/0x83 [ 70.983197][ C0] tty_port_close_start+0x3c8/0x550 [ 70.983199][ C0] tty_port_close+0x25/0x140 [ 70.983200][ C0] tty_release+0x40a/0x1100 [ 70.983201][ C0] __fput+0x2ed/0x750 [ 70.983202][ C0] task_work_run+0x147/0x1d0 [ 70.983204][ C0] prepare_exit_to_usermode+0x48e/0x600 [ 70.983206][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 70.983206][ C0] [ 70.983208][ C0] other info that might help us debug this: [ 70.983209][ C0] [ 70.983210][ C0] Chain exists of: [ 70.983211][ C0] console_owner --> &port->lock --> &port->lock#2 [ 70.983217][ C0] [ 70.983218][ C0] Possible unsafe locking scenario: [ 70.983219][ C0] [ 70.983221][ C0] CPU0 CPU1 [ 70.983222][ C0] ---- ---- [ 70.983223][ C0] lock(&port->lock#2); [ 70.983226][ C0] lock(&port->lock); [ 70.983230][ C0] lock(&port->lock#2); [ 70.983233][ C0] lock(console_owner); [ 70.983235][ C0] [ 70.983236][ C0] *** DEADLOCK *** [ 70.983237][ C0] [ 70.983239][ C0] 3 locks held by syz-executor290/13709: [ 70.983239][ C0] #0: ffff88809ec0b1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_release+0xb3/0x1100 [ 70.983245][ C0] #1: ffffffff8c07c7c0 (&port->lock#2){-.-.}-{2:2}, at: tty_port_close_start+0x58/0x550 [ 70.983251][ C0] #2: ffffffff892e4f40 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x1db/0x3b0 [ 70.983257][ C0] [ 70.983258][ C0] stack backtrace: [ 70.983260][ C0] CPU: 0 PID: 13709 Comm: syz-executor290 Not tainted 5.6.0-syzkaller #0 [ 70.983262][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 70.983263][ C0] Call Trace: [ 70.983265][ C0] dump_stack+0x1e9/0x30e [ 70.983266][ C0] print_circular_bug+0xc72/0xea0 [ 70.983267][ C0] ? stack_trace_save+0xad/0x150 [ 70.983268][ C0] ? save_trace+0x49/0xb60 [ 70.983270][ C0] check_noncircular+0x1fb/0x3a0 [ 70.983271][ C0] validate_chain+0x1b09/0x8920 [ 70.983272][ C0] ? mark_lock+0x102/0x1b00 [ 70.983273][ C0] ? put_dec_trunc8+0x19a/0x290 [ 70.983275][ C0] ? number+0xf14/0x1190 [ 70.983276][ C0] __lock_acquire+0x116c/0x2b90 [ 70.983277][ C0] ? sprintf+0x71/0x90 [ 70.983278][ C0] lock_acquire+0x169/0x480 [ 70.983280][ C0] ? console_lock_spinning_enable+0x2d/0x60 [ 70.983281][ C0] console_lock_spinning_enable+0x52/0x60 [ 70.983284][ C0] ? console_lock_spinning_enable+0x2d/0x60 [ 70.983286][ C0] console_unlock+0x73f/0xec0 [ 70.983288][ C0] ? __down_trylock_console_sem+0x178/0x1b0 [ 70.983290][ C0] ? vprintk_emit+0x1db/0x3b0 [ 70.983292][ C0] ? vprintk_emit+0x1db/0x3b0 [ 70.983294][ C0] vprintk_emit+0x1f8/0x3b0 [ 70.983296][ C0] printk+0x62/0x83 [ 70.983298][ C0] ? _raw_spin_lock_irqsave+0xaa/0xc0 [ 70.983300][ C0] tty_port_close_start+0x3c8/0x550 [ 70.983302][ C0] tty_port_close+0x25/0x140 [ 70.983304][ C0] ? tpk_open+0x60/0x60 [ 70.983306][ C0] tty_release+0x40a/0x1100 [ 70.983307][ C0] ? ima_file_free+0xea/0x3b0 [ 70.983309][ C0] ? tty_release_struct+0xd0/0xd0 [ 70.983311][ C0] __fput+0x2ed/0x750 [ 70.983313][ C0] task_work_run+0x147/0x1d0 [ 70.983315][ C0] prepare_exit_to_usermode+0x48e/0x600 [ 70.983317][ C0] ? syscall_return_slowpath+0xf9/0x420 [ 70.983319][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 70.983321][ C0] RIP: 0033:0x406511 [ 70.983326][ C0] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 24 1a 00 00 c3 48 83 ec 08 e8 6a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 b3 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 70.983328][ C0] RSP: 002b:00007ffec1fc1b40 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 70.983333][ C0] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000406511 [ 70.983335][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 70.983338][ C0] RBP: 00000000006ddc30 R08: 0000000000000000 R09: 0000000000000000 [ 70.983341][ C0] R10: 00007ffec1fc1b60 R11: 0000000000000293 R12: 00000000006ddc3c [ 70.983344][ C0] R13: 0000000000000001 R14: 000000000000002d R15: 20c49ba5e353f7cf