program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000240), 0x18) [ 114.846942][ T5299] Bluetooth: hci0: command tx timeout [ 114.912455][ T5336] input: syz0 as /devices/virtual/input/input5 [ 114.952720][ T4703] [ 114.952729][ T4703] ====================================================== [ 114.952735][ T4703] WARNING: possible circular locking dependency detected [ 114.952740][ T4703] syzkaller #0 Not tainted [ 114.952746][ T4703] ------------------------------------------------------ [ 114.952750][ T4703] kworker/0:4/4703 is trying to acquire lock: [ 114.952756][ T4703] ffff88801c3432c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 114.952861][ T4703] [ 114.952861][ T4703] but task is already holding lock: [ 114.952865][ T4703] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 114.952895][ T4703] [ 114.952895][ T4703] which lock already depends on the new lock. [ 114.952895][ T4703] [ 114.952899][ T4703] [ 114.952899][ T4703] the existing dependency chain (in reverse order) is: [ 114.952903][ T4703] [ 114.952903][ T4703] -> #3 (&buf->lock){+.+.}-{4:4}: [ 114.952918][ T4703] __mutex_lock+0x19d/0x1550 [ 114.952962][ T4703] tty_buffer_flush+0x74/0x2b0 [ 114.952976][ T4703] tty_ldisc_flush+0x6b/0xc0 [ 114.952990][ T4703] __do_SAK+0x25e/0x680 [ 114.952999][ T4703] vc_SAK+0x78/0x220 [ 114.953011][ T4703] process_scheduled_works+0xa8e/0x14e0 [ 114.953024][ T4703] worker_thread+0xa47/0xfb0 [ 114.953035][ T4703] kthread+0x388/0x470 [ 114.953049][ T4703] ret_from_fork+0x514/0xb70 [ 114.953064][ T4703] ret_from_fork_asm+0x1a/0x30 [ 114.953074][ T4703] [ 114.953074][ T4703] -> #2 (console_lock){+.+.}-{0:0}: [ 114.953088][ T4703] console_lock+0x76/0x90 [ 114.953099][ T4703] serial_core_register_port+0xc47/0x2840 [ 114.953113][ T4703] serial8250_register_8250_port+0x16b4/0x2090 [ 114.953127][ T4703] serial_pnp_probe+0x56a/0x7f0 [ 114.953141][ T4703] pnp_device_probe+0x30b/0x4c0 [ 114.953175][ T4703] really_probe+0x254/0xae0 [ 114.953187][ T4703] __driver_probe_device+0x1e8/0x360 [ 114.953198][ T4703] driver_probe_device+0x4f/0x240 [ 114.953209][ T4703] __driver_attach+0x339/0x600 [ 114.953219][ T4703] bus_for_each_dev+0x23b/0x2c0 [ 114.953233][ T4703] bus_add_driver+0x345/0x670 [ 114.953246][ T4703] driver_register+0x23a/0x320 [ 114.953258][ T4703] serial8250_init+0x8f/0x160 [ 114.953327][ T4703] do_one_initcall+0x250/0x870 [ 114.953344][ T4703] do_initcall_level+0x10a/0x1a0 [ 114.953357][ T4703] do_initcalls+0x59/0xa0 [ 114.953368][ T4703] kernel_init_freeable+0x29d/0x3e0 [ 114.953380][ T4703] kernel_init+0x1d/0x1d0 [ 114.953394][ T4703] ret_from_fork+0x514/0xb70 [ 114.953408][ T4703] ret_from_fork_asm+0x1a/0x30 [ 114.953417][ T4703] [ 114.953417][ T4703] -> #1 (&port->mutex){+.+.}-{4:4}: [ 114.953433][ T4703] __mutex_lock+0x19d/0x1550 [ 114.953445][ T4703] uart_set_termios+0x83/0x12e0 [ 114.953460][ T4703] tty_set_termios+0xcaf/0x1800 [ 114.953473][ T4703] set_termios+0x53d/0x6c0 [ 114.953486][ T4703] tty_mode_ioctl+0x49c/0x7c0 [ 114.953499][ T4703] tty_ioctl+0x9bd/0xdd0 [ 114.953519][ T4703] __se_sys_ioctl+0xfc/0x170 [ 114.953534][ T4703] do_syscall_64+0x174/0x580 [ 114.953546][ T4703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.953557][ T4703] [ 114.953557][ T4703] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 114.953573][ T4703] __lock_acquire+0x1520/0x2cf0 [ 114.953587][ T4703] lock_acquire+0x106/0x350 [ 114.953600][ T4703] down_write+0x96/0x200 [ 114.953612][ T4703] n_tty_flush_buffer+0x30/0x230 [ 114.953623][ T4703] tty_buffer_flush+0x1ec/0x2b0 [ 114.953639][ T4703] tty_ldisc_flush+0x6b/0xc0 [ 114.953652][ T4703] __do_SAK+0x25e/0x680 [ 114.953660][ T4703] vc_SAK+0x78/0x220 [ 114.953672][ T4703] process_scheduled_works+0xa8e/0x14e0 [ 114.953684][ T4703] worker_thread+0xa47/0xfb0 [ 114.953695][ T4703] kthread+0x388/0x470 [ 114.953709][ T4703] ret_from_fork+0x514/0xb70 [ 114.953722][ T4703] ret_from_fork_asm+0x1a/0x30 [ 114.953731][ T4703] [ 114.953731][ T4703] other info that might help us debug this: [ 114.953731][ T4703] [ 114.953735][ T4703] Chain exists of: [ 114.953735][ T4703] &tty->termios_rwsem --> console_lock --> &buf->lock [ 114.953735][ T4703] [ 114.953754][ T4703] Possible unsafe locking scenario: [ 114.953754][ T4703] [ 114.953758][ T4703] CPU0 CPU1 [ 114.953761][ T4703] ---- ---- [ 114.953765][ T4703] lock(&buf->lock); [ 114.953773][ T4703] lock(console_lock); [ 114.953782][ T4703] lock(&buf->lock); [ 114.953790][ T4703] lock(&tty->termios_rwsem); [ 114.953798][ T4703] [ 114.953798][ T4703] *** DEADLOCK *** [ 114.953798][ T4703] [ 114.953802][ T4703] 5 locks held by kworker/0:4/4703: [ 114.953808][ T4703] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 114.953837][ T4703] #1: ffffc9000227fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 114.953865][ T4703] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 114.953892][ T4703] #3: ffff88801c3430a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 114.953923][ T4703] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 114.953953][ T4703] [ 114.953953][ T4703] stack backtrace: [ 114.953959][ T4703] CPU: 0 UID: 0 PID: 4703 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 114.953971][ T4703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.953977][ T4703] Workqueue: events vc_SAK [ 114.953990][ T4703] Call Trace: [ 114.953994][ T4703] [ 114.953999][ T4703] dump_stack_lvl+0xe8/0x150 [ 114.954014][ T4703] print_circular_bug+0x2e1/0x300 [ 114.954026][ T4703] check_noncircular+0x12e/0x150 [ 114.954038][ T4703] __lock_acquire+0x1520/0x2cf0 [ 114.954053][ T4703] ? __pfx___mutex_trylock_common+0x10/0x10 [ 114.954064][ T4703] ? rcu_is_watching+0x15/0xb0 [ 114.954075][ T4703] ? trace_contention_end+0x3d/0x140 [ 114.954086][ T4703] ? n_tty_flush_buffer+0x30/0x230 [ 114.954096][ T4703] lock_acquire+0x106/0x350 [ 114.954110][ T4703] ? n_tty_flush_buffer+0x30/0x230 [ 114.954124][ T4703] down_write+0x96/0x200 [ 114.954138][ T4703] ? n_tty_flush_buffer+0x30/0x230 [ 114.954149][ T4703] ? __pfx_down_write+0x10/0x10 [ 114.954163][ T4703] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 114.954175][ T4703] n_tty_flush_buffer+0x30/0x230 [ 114.954187][ T4703] ? tty_buffer_flush+0x1df/0x2b0 [ 114.954201][ T4703] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 114.954213][ T4703] tty_buffer_flush+0x1ec/0x2b0 [ 114.954229][ T4703] tty_ldisc_flush+0x6b/0xc0 [ 114.954244][ T4703] __do_SAK+0x25e/0x680 [ 114.954253][ T4703] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 114.954266][ T4703] vc_SAK+0x78/0x220 [ 114.954278][ T4703] ? process_scheduled_works+0xa20/0x14e0 [ 114.954289][ T4703] process_scheduled_works+0xa8e/0x14e0 [ 114.954306][ T4703] ? __pfx_process_scheduled_works+0x10/0x10 [ 114.954320][ T4703] ? assign_work+0x3cf/0x5d0 [ 114.954331][ T4703] worker_thread+0xa47/0xfb0 [ 114.954345][ T4703] ? __kthread_parkme+0x71/0x1f0 [ 114.954361][ T4703] kthread+0x388/0x470 [ 114.954375][ T4703] ? __pfx_worker_thread+0x10/0x10 [ 114.954387][ T4703] ? __pfx_kthread+0x10/0x10 [ 114.954402][ T4703] ret_from_fork+0x514/0xb70 [ 114.954416][ T4703] ? __pfx_ret_from_fork+0x10/0x10 [ 114.954431][ T4703] ? __switch_to+0xc89/0x1420 [ 114.954445][ T4703] ? __pfx_kthread+0x10/0x10 [ 114.954459][ T4703] ret_from_fork_asm+0x1a/0x30 [ 114.954471][ T4703]