program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x3) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000240), 0x18) [ 75.372680][ T5323] input: syz0 as /devices/virtual/input/input5 [ 75.387716][ T5304] [ 75.387724][ T5304] ====================================================== [ 75.387728][ T5304] WARNING: possible circular locking dependency detected [ 75.387731][ T5304] syzkaller #0 Not tainted [ 75.387736][ T5304] ------------------------------------------------------ [ 75.387738][ T5304] kworker/0:4/5304 is trying to acquire lock: [ 75.387743][ T5304] ffff88803e5892c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 75.387829][ T5304] [ 75.387829][ T5304] but task is already holding lock: [ 75.387832][ T5304] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 75.387852][ T5304] [ 75.387852][ T5304] which lock already depends on the new lock. [ 75.387852][ T5304] [ 75.387855][ T5304] [ 75.387855][ T5304] the existing dependency chain (in reverse order) is: [ 75.387857][ T5304] [ 75.387857][ T5304] -> #3 (&buf->lock){+.+.}-{4:4}: [ 75.387868][ T5304] __mutex_lock+0x19d/0x1550 [ 75.387905][ T5304] tty_buffer_flush+0x74/0x2b0 [ 75.387915][ T5304] tty_ldisc_flush+0x6b/0xc0 [ 75.387924][ T5304] __do_SAK+0x25e/0x680 [ 75.387930][ T5304] vc_SAK+0x78/0x220 [ 75.387938][ T5304] process_scheduled_works+0xa8e/0x14e0 [ 75.387947][ T5304] worker_thread+0xa47/0xfb0 [ 75.387955][ T5304] kthread+0x388/0x470 [ 75.387964][ T5304] ret_from_fork+0x514/0xb70 [ 75.387974][ T5304] ret_from_fork_asm+0x1a/0x30 [ 75.387980][ T5304] [ 75.387980][ T5304] -> #2 (console_lock){+.+.}-{0:0}: [ 75.387991][ T5304] console_lock+0x76/0x90 [ 75.387998][ T5304] serial_core_register_port+0xc47/0x2840 [ 75.388008][ T5304] serial8250_register_8250_port+0x16b4/0x2090 [ 75.388018][ T5304] serial_pnp_probe+0x56a/0x7f0 [ 75.388027][ T5304] pnp_device_probe+0x30b/0x4c0 [ 75.388038][ T5304] really_probe+0x254/0xae0 [ 75.388049][ T5304] __driver_probe_device+0x1e8/0x360 [ 75.388059][ T5304] driver_probe_device+0x4f/0x240 [ 75.388069][ T5304] __driver_attach+0x339/0x600 [ 75.388078][ T5304] bus_for_each_dev+0x23b/0x2c0 [ 75.388091][ T5304] bus_add_driver+0x345/0x670 [ 75.388104][ T5304] driver_register+0x23a/0x320 [ 75.388113][ T5304] serial8250_init+0x8f/0x160 [ 75.388170][ T5304] do_one_initcall+0x250/0x870 [ 75.388180][ T5304] do_initcall_level+0x10a/0x1a0 [ 75.388188][ T5304] do_initcalls+0x59/0xa0 [ 75.388196][ T5304] kernel_init_freeable+0x29d/0x3e0 [ 75.388204][ T5304] kernel_init+0x1d/0x1d0 [ 75.388214][ T5304] ret_from_fork+0x514/0xb70 [ 75.388223][ T5304] ret_from_fork_asm+0x1a/0x30 [ 75.388235][ T5304] [ 75.388235][ T5304] -> #1 (&port->mutex){+.+.}-{4:4}: [ 75.388246][ T5304] __mutex_lock+0x19d/0x1550 [ 75.388270][ T5304] uart_set_termios+0x83/0x12e0 [ 75.388285][ T5304] tty_set_termios+0xcaf/0x1800 [ 75.388294][ T5304] set_termios+0x53d/0x6c0 [ 75.388303][ T5304] tty_mode_ioctl+0x49c/0x7c0 [ 75.388311][ T5304] tty_ioctl+0x9bd/0xdd0 [ 75.388321][ T5304] __se_sys_ioctl+0xfc/0x170 [ 75.388331][ T5304] do_syscall_64+0x174/0x580 [ 75.388339][ T5304] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.388346][ T5304] [ 75.388346][ T5304] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 75.388357][ T5304] __lock_acquire+0x1520/0x2cf0 [ 75.388366][ T5304] lock_acquire+0x106/0x350 [ 75.388375][ T5304] down_write+0x96/0x200 [ 75.388384][ T5304] n_tty_flush_buffer+0x30/0x230 [ 75.388392][ T5304] tty_buffer_flush+0x1ec/0x2b0 [ 75.388402][ T5304] tty_ldisc_flush+0x6b/0xc0 [ 75.388411][ T5304] __do_SAK+0x25e/0x680 [ 75.388416][ T5304] vc_SAK+0x78/0x220 [ 75.388424][ T5304] process_scheduled_works+0xa8e/0x14e0 [ 75.388432][ T5304] worker_thread+0xa47/0xfb0 [ 75.388439][ T5304] kthread+0x388/0x470 [ 75.388448][ T5304] ret_from_fork+0x514/0xb70 [ 75.388457][ T5304] ret_from_fork_asm+0x1a/0x30 [ 75.388463][ T5304] [ 75.388463][ T5304] other info that might help us debug this: [ 75.388463][ T5304] [ 75.388466][ T5304] Chain exists of: [ 75.388466][ T5304] &tty->termios_rwsem --> console_lock --> &buf->lock [ 75.388466][ T5304] [ 75.388478][ T5304] Possible unsafe locking scenario: [ 75.388478][ T5304] [ 75.388480][ T5304] CPU0 CPU1 [ 75.388482][ T5304] ---- ---- [ 75.388485][ T5304] lock(&buf->lock); [ 75.388490][ T5304] lock(console_lock); [ 75.388495][ T5304] lock(&buf->lock); [ 75.388500][ T5304] lock(&tty->termios_rwsem); [ 75.388506][ T5304] [ 75.388506][ T5304] *** DEADLOCK *** [ 75.388506][ T5304] [ 75.388508][ T5304] 5 locks held by kworker/0:4/5304: [ 75.388512][ T5304] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 75.388530][ T5304] #1: ffffc9000e197c40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 75.388549][ T5304] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 75.388568][ T5304] #3: ffff88803e5890a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 75.388587][ T5304] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 75.388608][ T5304] [ 75.388608][ T5304] stack backtrace: [ 75.388613][ T5304] CPU: 0 UID: 0 PID: 5304 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 75.388621][ T5304] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.388625][ T5304] Workqueue: events vc_SAK [ 75.388635][ T5304] Call Trace: [ 75.388638][ T5304] [ 75.388641][ T5304] dump_stack_lvl+0xe8/0x150 [ 75.388652][ T5304] print_circular_bug+0x2e1/0x300 [ 75.388659][ T5304] check_noncircular+0x12e/0x150 [ 75.388667][ T5304] __lock_acquire+0x1520/0x2cf0 [ 75.388677][ T5304] ? __pfx___mutex_trylock_common+0x10/0x10 [ 75.388685][ T5304] ? rcu_is_watching+0x15/0xb0 [ 75.388692][ T5304] ? trace_contention_end+0x3d/0x140 [ 75.388699][ T5304] ? n_tty_flush_buffer+0x30/0x230 [ 75.388706][ T5304] lock_acquire+0x106/0x350 [ 75.388715][ T5304] ? n_tty_flush_buffer+0x30/0x230 [ 75.388725][ T5304] down_write+0x96/0x200 [ 75.388734][ T5304] ? n_tty_flush_buffer+0x30/0x230 [ 75.388741][ T5304] ? __pfx_down_write+0x10/0x10 [ 75.388751][ T5304] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 75.388758][ T5304] n_tty_flush_buffer+0x30/0x230 [ 75.388766][ T5304] ? tty_buffer_flush+0x1df/0x2b0 [ 75.388776][ T5304] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 75.388784][ T5304] tty_buffer_flush+0x1ec/0x2b0 [ 75.388795][ T5304] tty_ldisc_flush+0x6b/0xc0 [ 75.388805][ T5304] __do_SAK+0x25e/0x680 [ 75.388810][ T5304] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 75.388818][ T5304] vc_SAK+0x78/0x220 [ 75.388827][ T5304] ? process_scheduled_works+0xa20/0x14e0 [ 75.388834][ T5304] process_scheduled_works+0xa8e/0x14e0 [ 75.388845][ T5304] ? __pfx_process_scheduled_works+0x10/0x10 [ 75.388854][ T5304] ? assign_work+0x3cf/0x5d0 [ 75.388862][ T5304] worker_thread+0xa47/0xfb0 [ 75.388871][ T5304] ? __kthread_parkme+0x71/0x1f0 [ 75.388881][ T5304] kthread+0x388/0x470 [ 75.388891][ T5304] ? __pfx_worker_thread+0x10/0x10 [ 75.388899][ T5304] ? __pfx_kthread+0x10/0x10 [ 75.388908][ T5304] ret_from_fork+0x514/0xb70 [ 75.388919][ T5304] ? __pfx_ret_from_fork+0x10/0x10 [ 75.388928][ T5304] ? __switch_to+0xc89/0x1420 [ 75.388937][ T5304] ? __pfx_kthread+0x10/0x10 [ 75.388947][ T5304] ret_from_fork_asm+0x1a/0x30 [ 75.388955][ T5304] [ 75.389553][ T5304] tty tty1: SAK: killed process 5322 (syz.0.0): by fd#3 [ 75.389589][ T5304] tty tty1: SAK: killed process 5323 (syz.0.0): by fd#3 [ 75.389596][ T5304] tty tty1: SAK: killed process 5324 (syz.0.0): by fd#3