[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 64.126051][ T27] audit: type=1800 audit(1585582542.900:25): pid=9370 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 64.155106][ T27] audit: type=1800 audit(1585582542.900:26): pid=9370 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 64.198608][ T27] audit: type=1800 audit(1585582542.900:27): pid=9370 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.206' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 76.115827][ T9522] [ 76.118175][ T9522] ====================================================== [ 76.125172][ T9522] WARNING: possible circular locking dependency detected [ 76.132169][ T9522] 5.6.0-rc3-next-20200228-syzkaller #0 Not tainted [ 76.138648][ T9522] ------------------------------------------------------ [ 76.145652][ T9522] syz-executor385/9522 is trying to acquire lock: [ 76.152148][ T9522] ffff8880a1cb82a0 (&tty->termios_rwsem){++++}, at: n_tty_receive_buf_common+0x87/0x2ac0 [ 76.161978][ T9522] [ 76.161978][ T9522] but task is already holding lock: [ 76.169321][ T9522] ffffffff89f414c0 (sel_lock){+.+.}, at: paste_selection+0x155/0x490 [ 76.177368][ T9522] [ 76.177368][ T9522] which lock already depends on the new lock. [ 76.177368][ T9522] [ 76.187743][ T9522] [ 76.187743][ T9522] the existing dependency chain (in reverse order) is: [ 76.196731][ T9522] [ 76.196731][ T9522] -> #2 (sel_lock){+.+.}: [ 76.203212][ T9522] __mutex_lock+0x156/0x13c0 [ 76.208298][ T9522] set_selection_kernel+0x38a/0x13c0 [ 76.214078][ T9522] set_selection_user+0x94/0xd7 [ 76.219437][ T9522] tioclinux+0x115/0x480 [ 76.224171][ T9522] vt_ioctl+0x18a6/0x2450 [ 76.228996][ T9522] tty_ioctl+0xedd/0x1440 [ 76.233839][ T9522] ksys_ioctl+0x11a/0x180 [ 76.238677][ T9522] __x64_sys_ioctl+0x6f/0xb0 [ 76.243762][ T9522] do_syscall_64+0xf6/0x790 [ 76.248777][ T9522] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 76.255175][ T9522] [ 76.255175][ T9522] -> #1 (console_lock){+.+.}: [ 76.262101][ T9522] console_lock+0x44/0x80 [ 76.266933][ T9522] con_flush_chars+0x35/0x90 [ 76.272030][ T9522] n_tty_write+0xd49/0xf90 [ 76.276941][ T9522] tty_write+0x48f/0x7f0 [ 76.281689][ T9522] __vfs_write+0x76/0x100 [ 76.286526][ T9522] vfs_write+0x262/0x5c0 [ 76.293268][ T9522] ksys_write+0x127/0x250 [ 76.298093][ T9522] do_syscall_64+0xf6/0x790 [ 76.303090][ T9522] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 76.309487][ T9522] [ 76.309487][ T9522] -> #0 (&tty->termios_rwsem){++++}: [ 76.316925][ T9522] __lock_acquire+0x24b3/0x5270 [ 76.322269][ T9522] lock_acquire+0x197/0x420 [ 76.327293][ T9522] down_read+0x96/0x430 [ 76.331954][ T9522] n_tty_receive_buf_common+0x87/0x2ac0 [ 76.337993][ T9522] tty_ldisc_receive_buf+0xa9/0x190 [ 76.343685][ T9522] paste_selection+0x1e5/0x490 [ 76.348944][ T9522] tioclinux+0x12c/0x480 [ 76.353679][ T9522] vt_ioctl+0x18a6/0x2450 [ 76.358589][ T9522] tty_ioctl+0xedd/0x1440 [ 76.363499][ T9522] ksys_ioctl+0x11a/0x180 [ 76.368323][ T9522] __x64_sys_ioctl+0x6f/0xb0 [ 76.373476][ T9522] do_syscall_64+0xf6/0x790 [ 76.378481][ T9522] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 76.384924][ T9522] [ 76.384924][ T9522] other info that might help us debug this: [ 76.384924][ T9522] [ 76.395135][ T9522] Chain exists of: [ 76.395135][ T9522] &tty->termios_rwsem --> console_lock --> sel_lock [ 76.395135][ T9522] [ 76.407615][ T9522] Possible unsafe locking scenario: [ 76.407615][ T9522] [ 76.415044][ T9522] CPU0 CPU1 [ 76.420385][ T9522] ---- ---- [ 76.425726][ T9522] lock(sel_lock); [ 76.429515][ T9522] lock(console_lock); [ 76.436165][ T9522] lock(sel_lock); [ 76.442482][ T9522] lock(&tty->termios_rwsem); [ 76.447285][ T9522] [ 76.447285][ T9522] *** DEADLOCK *** [ 76.447285][ T9522] [ 76.455515][ T9522] 3 locks held by syz-executor385/9522: [ 76.461033][ T9522] #0: ffff8880a1cb8090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 [ 76.470213][ T9522] #1: ffff8880a97f90a8 (&buf->lock){+.+.}, at: paste_selection+0x122/0x490 [ 76.479131][ T9522] #2: ffffffff89f414c0 (sel_lock){+.+.}, at: paste_selection+0x155/0x490 [ 76.487698][ T9522] [ 76.487698][ T9522] stack backtrace: [ 76.493597][ T9522] CPU: 0 PID: 9522 Comm: syz-executor385 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 76.503469][ T9522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 76.513945][ T9522] Call Trace: [ 76.517236][ T9522] dump_stack+0x188/0x20d [ 76.521555][ T9522] check_noncircular+0x32e/0x3e0 [ 76.526508][ T9522] ? print_circular_bug.isra.0+0x220/0x220 [ 76.532297][ T9522] ? graph_lock+0x7e/0x210 [ 76.536700][ T9522] ? alloc_list_entry+0xb0/0xb0 [ 76.541531][ T9522] ? mark_lock+0xbc/0x1220 [ 76.545930][ T9522] __lock_acquire+0x24b3/0x5270 [ 76.550767][ T9522] ? mark_held_locks+0xe0/0xe0 [ 76.555513][ T9522] lock_acquire+0x197/0x420 [ 76.560002][ T9522] ? n_tty_receive_buf_common+0x87/0x2ac0 [ 76.565732][ T9522] down_read+0x96/0x430 [ 76.569870][ T9522] ? n_tty_receive_buf_common+0x87/0x2ac0 [ 76.575598][ T9522] ? down_read_killable+0x460/0x460 [ 76.580988][ T9522] ? __mutex_lock+0x458/0x13c0 [ 76.586358][ T9522] n_tty_receive_buf_common+0x87/0x2ac0 [ 76.591890][ T9522] ? paste_selection+0x147/0x490 [ 76.596848][ T9522] ? mark_lock+0xbc/0x1220 [ 76.601353][ T9522] tty_ldisc_receive_buf+0xa9/0x190 [ 76.606539][ T9522] ? n_tty_receive_buf_common+0x2ac0/0x2ac0 [ 76.612417][ T9522] paste_selection+0x1e5/0x490 [ 76.617252][ T9522] ? sel_pos+0x90/0x90 [ 76.621321][ T9522] ? wake_up_q+0x140/0x140 [ 76.625726][ T9522] tioclinux+0x12c/0x480 [ 76.629957][ T9522] vt_ioctl+0x18a6/0x2450 [ 76.634287][ T9522] ? complete_change_console+0x390/0x390 [ 76.639960][ T9522] ? tomoyo_path_number_perm+0x238/0x4d0 [ 76.645579][ T9522] ? tomoyo_execute_permission+0x470/0x470 [ 76.651463][ T9522] ? trace_hardirqs_off+0x50/0x220 [ 76.656571][ T9522] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 76.662460][ T9522] ? complete_change_console+0x390/0x390 [ 76.668075][ T9522] tty_ioctl+0xedd/0x1440 [ 76.672403][ T9522] ? tty_vhangup+0x30/0x30 [ 76.676812][ T9522] ? do_vfs_ioctl+0x506/0x12c0 [ 76.681556][ T9522] ? ioctl_file_clone+0x180/0x180 [ 76.686739][ T9522] ? file_open_root+0x3d0/0x3d0 [ 76.691572][ T9522] ? up_read+0x1a8/0x750 [ 76.695815][ T9522] ? tty_vhangup+0x30/0x30 [ 76.700210][ T9522] ksys_ioctl+0x11a/0x180 [ 76.704517][ T9522] __x64_sys_ioctl+0x6f/0xb0 [ 76.709091][ T9522] ? lockdep_hardirqs_on+0x417/0x5d0 [ 76.714354][ T9522] do_syscall_64+0xf6/0x790 [ 76.718837][ T9522] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 76.724704][ T9522] RIP: 0033:0x440219 [ 76.728581][ T9522] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 76.748191][ T9522] RSP: 002b:00007fff27a0f0f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.756667][ T9522] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440219 [ 76.764617][ T9522] RDX: 0000000020000200 RSI: 0