program: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_ACTIVATE(r0, 0x5606, 0x14) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) [ 75.262018][ T5284] Bluetooth: hci0: command tx timeout [ 75.344334][ T5321] input: syz0 as /devices/virtual/input/input5 [ 75.373282][ T5301] [ 75.373288][ T5301] ====================================================== [ 75.373292][ T5301] WARNING: possible circular locking dependency detected [ 75.373296][ T5301] syzkaller #0 Not tainted [ 75.373300][ T5301] ------------------------------------------------------ [ 75.373303][ T5301] kworker/0:4/5301 is trying to acquire lock: [ 75.373307][ T5301] ffff8880124852c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 75.373402][ T5301] [ 75.373402][ T5301] but task is already holding lock: [ 75.373405][ T5301] ffff888036db20b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 75.373426][ T5301] [ 75.373426][ T5301] which lock already depends on the new lock. [ 75.373426][ T5301] [ 75.373429][ T5301] [ 75.373429][ T5301] the existing dependency chain (in reverse order) is: [ 75.373431][ T5301] [ 75.373431][ T5301] -> #3 (&buf->lock){+.+.}-{4:4}: [ 75.373442][ T5301] __mutex_lock+0x19d/0x1550 [ 75.373479][ T5301] tty_buffer_flush+0x74/0x2b0 [ 75.373489][ T5301] tty_ldisc_flush+0x6b/0xc0 [ 75.373499][ T5301] __do_SAK+0x25e/0x680 [ 75.373506][ T5301] vc_SAK+0x78/0x220 [ 75.373514][ T5301] process_scheduled_works+0xa8e/0x14e0 [ 75.373539][ T5301] worker_thread+0xa47/0xfb0 [ 75.373547][ T5301] kthread+0x388/0x470 [ 75.373556][ T5301] ret_from_fork+0x514/0xb70 [ 75.373566][ T5301] ret_from_fork_asm+0x1a/0x30 [ 75.373573][ T5301] [ 75.373573][ T5301] -> #2 (console_lock){+.+.}-{0:0}: [ 75.373608][ T5301] console_lock+0x76/0x90 [ 75.373620][ T5301] serial_core_register_port+0xc47/0x2840 [ 75.373635][ T5301] serial8250_register_8250_port+0x16b4/0x2090 [ 75.373646][ T5301] serial_pnp_probe+0x56a/0x7f0 [ 75.373655][ T5301] pnp_device_probe+0x30b/0x4c0 [ 75.373664][ T5301] really_probe+0x254/0xae0 [ 75.373672][ T5301] __driver_probe_device+0x1e8/0x360 [ 75.373679][ T5301] driver_probe_device+0x4f/0x240 [ 75.373686][ T5301] __driver_attach+0x339/0x600 [ 75.373693][ T5301] bus_for_each_dev+0x23b/0x2c0 [ 75.373702][ T5301] bus_add_driver+0x345/0x670 [ 75.373711][ T5301] driver_register+0x23a/0x320 [ 75.373721][ T5301] serial8250_init+0x8f/0x160 [ 75.373785][ T5301] do_one_initcall+0x250/0x870 [ 75.373796][ T5301] do_initcall_level+0x10a/0x1a0 [ 75.373804][ T5301] do_initcalls+0x59/0xa0 [ 75.373812][ T5301] kernel_init_freeable+0x29d/0x3e0 [ 75.373820][ T5301] kernel_init+0x1d/0x1d0 [ 75.373830][ T5301] ret_from_fork+0x514/0xb70 [ 75.373840][ T5301] ret_from_fork_asm+0x1a/0x30 [ 75.373845][ T5301] [ 75.373845][ T5301] -> #1 (&port->mutex){+.+.}-{4:4}: [ 75.373856][ T5301] __mutex_lock+0x19d/0x1550 [ 75.373864][ T5301] uart_set_termios+0x83/0x12e0 [ 75.373874][ T5301] tty_set_termios+0xcaf/0x1800 [ 75.373883][ T5301] set_termios+0x53d/0x6c0 [ 75.373891][ T5301] tty_mode_ioctl+0x49c/0x7c0 [ 75.373900][ T5301] tty_ioctl+0x9bd/0xdd0 [ 75.373909][ T5301] __se_sys_ioctl+0xfc/0x170 [ 75.373920][ T5301] do_syscall_64+0x174/0x580 [ 75.373928][ T5301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.373934][ T5301] [ 75.373934][ T5301] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 75.373944][ T5301] __lock_acquire+0x1520/0x2cf0 [ 75.373954][ T5301] lock_acquire+0x106/0x350 [ 75.373963][ T5301] down_write+0x96/0x200 [ 75.373972][ T5301] n_tty_flush_buffer+0x30/0x230 [ 75.373979][ T5301] tty_buffer_flush+0x1ec/0x2b0 [ 75.373989][ T5301] tty_ldisc_flush+0x6b/0xc0 [ 75.374003][ T5301] __do_SAK+0x25e/0x680 [ 75.374009][ T5301] vc_SAK+0x78/0x220 [ 75.374016][ T5301] process_scheduled_works+0xa8e/0x14e0 [ 75.374024][ T5301] worker_thread+0xa47/0xfb0 [ 75.374032][ T5301] kthread+0x388/0x470 [ 75.374041][ T5301] ret_from_fork+0x514/0xb70 [ 75.374050][ T5301] ret_from_fork_asm+0x1a/0x30 [ 75.374056][ T5301] [ 75.374056][ T5301] other info that might help us debug this: [ 75.374056][ T5301] [ 75.374060][ T5301] Chain exists of: [ 75.374060][ T5301] &tty->termios_rwsem --> console_lock --> &buf->lock [ 75.374060][ T5301] [ 75.374078][ T5301] Possible unsafe locking scenario: [ 75.374078][ T5301] [ 75.374081][ T5301] CPU0 CPU1 [ 75.374084][ T5301] ---- ---- [ 75.374088][ T5301] lock(&buf->lock); [ 75.374096][ T5301] lock(console_lock); [ 75.374104][ T5301] lock(&buf->lock); [ 75.374110][ T5301] lock(&tty->termios_rwsem); [ 75.374115][ T5301] [ 75.374115][ T5301] *** DEADLOCK *** [ 75.374115][ T5301] [ 75.374117][ T5301] 5 locks held by kworker/0:4/5301: [ 75.374122][ T5301] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 75.374141][ T5301] #1: ffffc9000dd2fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 75.374160][ T5301] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 75.374178][ T5301] #3: ffff8880124850a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 75.374198][ T5301] #4: ffff888036db20b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 75.374219][ T5301] [ 75.374219][ T5301] stack backtrace: [ 75.374223][ T5301] CPU: 0 UID: 0 PID: 5301 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 75.374231][ T5301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.374236][ T5301] Workqueue: events vc_SAK [ 75.374245][ T5301] Call Trace: [ 75.374248][ T5301] [ 75.374252][ T5301] dump_stack_lvl+0xe8/0x150 [ 75.374263][ T5301] print_circular_bug+0x2e1/0x300 [ 75.374270][ T5301] check_noncircular+0x12e/0x150 [ 75.374278][ T5301] __lock_acquire+0x1520/0x2cf0 [ 75.374289][ T5301] ? __pfx___mutex_trylock_common+0x10/0x10 [ 75.374297][ T5301] ? rcu_is_watching+0x15/0xb0 [ 75.374304][ T5301] ? trace_contention_end+0x3d/0x140 [ 75.374311][ T5301] ? n_tty_flush_buffer+0x30/0x230 [ 75.374318][ T5301] lock_acquire+0x106/0x350 [ 75.374327][ T5301] ? n_tty_flush_buffer+0x30/0x230 [ 75.374337][ T5301] down_write+0x96/0x200 [ 75.374345][ T5301] ? n_tty_flush_buffer+0x30/0x230 [ 75.374353][ T5301] ? __pfx_down_write+0x10/0x10 [ 75.374362][ T5301] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 75.374370][ T5301] n_tty_flush_buffer+0x30/0x230 [ 75.374377][ T5301] ? tty_buffer_flush+0x1df/0x2b0 [ 75.374390][ T5301] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 75.374402][ T5301] tty_buffer_flush+0x1ec/0x2b0 [ 75.374417][ T5301] tty_ldisc_flush+0x6b/0xc0 [ 75.374429][ T5301] __do_SAK+0x25e/0x680 [ 75.374435][ T5301] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 75.374443][ T5301] vc_SAK+0x78/0x220 [ 75.374451][ T5301] ? process_scheduled_works+0xa20/0x14e0 [ 75.374459][ T5301] process_scheduled_works+0xa8e/0x14e0 [ 75.374470][ T5301] ? __pfx_process_scheduled_works+0x10/0x10 [ 75.374478][ T5301] ? assign_work+0x3cf/0x5d0 [ 75.374486][ T5301] worker_thread+0xa47/0xfb0 [ 75.374497][ T5301] ? __kthread_parkme+0x71/0x1f0 [ 75.374507][ T5301] kthread+0x388/0x470 [ 75.374517][ T5301] ? __pfx_worker_thread+0x10/0x10 [ 75.374525][ T5301] ? __pfx_kthread+0x10/0x10 [ 75.374535][ T5301] ret_from_fork+0x514/0xb70 [ 75.374545][ T5301] ? __pfx_ret_from_fork+0x10/0x10 [ 75.374555][ T5301] ? __switch_to+0xc89/0x1420 [ 75.374563][ T5301] ? __pfx_kthread+0x10/0x10 [ 75.374573][ T5301] ret_from_fork_asm+0x1a/0x30 [ 75.374581][ T5301]