program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) [ 92.572392][ T5319] input: syz0 as /devices/virtual/input/input5 [ 92.643627][ T9] [ 92.643635][ T9] ====================================================== [ 92.643638][ T9] WARNING: possible circular locking dependency detected [ 92.643641][ T9] syzkaller #0 Not tainted [ 92.643646][ T9] ------------------------------------------------------ [ 92.643649][ T9] kworker/0:0/9 is trying to acquire lock: [ 92.643653][ T9] ffff8880369202c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 92.643732][ T9] [ 92.643732][ T9] but task is already holding lock: [ 92.643735][ T9] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 92.643755][ T9] [ 92.643755][ T9] which lock already depends on the new lock. [ 92.643755][ T9] [ 92.643757][ T9] [ 92.643757][ T9] the existing dependency chain (in reverse order) is: [ 92.643759][ T9] [ 92.643759][ T9] -> #3 (&buf->lock){+.+.}-{4:4}: [ 92.643770][ T9] __mutex_lock+0x19d/0x1550 [ 92.643804][ T9] tty_buffer_flush+0x74/0x2b0 [ 92.643814][ T9] tty_ldisc_flush+0x6b/0xc0 [ 92.643824][ T9] __do_SAK+0x25e/0x680 [ 92.643829][ T9] vc_SAK+0x78/0x220 [ 92.643837][ T9] process_scheduled_works+0xa8e/0x14e0 [ 92.643845][ T9] worker_thread+0xa47/0xfb0 [ 92.643853][ T9] kthread+0x388/0x470 [ 92.643862][ T9] ret_from_fork+0x514/0xb70 [ 92.643872][ T9] ret_from_fork_asm+0x1a/0x30 [ 92.643902][ T9] [ 92.643902][ T9] -> #2 (console_lock){+.+.}-{0:0}: [ 92.643914][ T9] console_lock+0x76/0x90 [ 92.643922][ T9] serial_core_register_port+0xc47/0x2840 [ 92.643932][ T9] serial8250_register_8250_port+0x16b4/0x2090 [ 92.643941][ T9] serial_pnp_probe+0x56a/0x7f0 [ 92.643950][ T9] pnp_device_probe+0x30b/0x4c0 [ 92.643959][ T9] really_probe+0x254/0xae0 [ 92.643967][ T9] __driver_probe_device+0x1e8/0x360 [ 92.643974][ T9] driver_probe_device+0x4f/0x240 [ 92.643981][ T9] __driver_attach+0x339/0x600 [ 92.643988][ T9] bus_for_each_dev+0x23b/0x2c0 [ 92.643996][ T9] bus_add_driver+0x345/0x670 [ 92.644005][ T9] driver_register+0x23a/0x320 [ 92.644013][ T9] serial8250_init+0x8f/0x160 [ 92.644067][ T9] do_one_initcall+0x250/0x870 [ 92.644083][ T9] do_initcall_level+0x10a/0x1a0 [ 92.644092][ T9] do_initcalls+0x59/0xa0 [ 92.644100][ T9] kernel_init_freeable+0x29d/0x3e0 [ 92.644108][ T9] kernel_init+0x1d/0x1d0 [ 92.644118][ T9] ret_from_fork+0x514/0xb70 [ 92.644127][ T9] ret_from_fork_asm+0x1a/0x30 [ 92.644133][ T9] [ 92.644133][ T9] -> #1 (&port->mutex){+.+.}-{4:4}: [ 92.644143][ T9] __mutex_lock+0x19d/0x1550 [ 92.644151][ T9] uart_set_termios+0x83/0x12e0 [ 92.644161][ T9] tty_set_termios+0xcaf/0x1800 [ 92.644169][ T9] set_termios+0x53d/0x6c0 [ 92.644178][ T9] tty_mode_ioctl+0x49c/0x7c0 [ 92.644186][ T9] tty_ioctl+0x9bd/0xdd0 [ 92.644196][ T9] __se_sys_ioctl+0xfc/0x170 [ 92.644206][ T9] do_syscall_64+0x174/0x580 [ 92.644214][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.644220][ T9] [ 92.644220][ T9] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 92.644230][ T9] __lock_acquire+0x1520/0x2cf0 [ 92.644240][ T9] lock_acquire+0x106/0x350 [ 92.644248][ T9] down_write+0x96/0x200 [ 92.644257][ T9] n_tty_flush_buffer+0x30/0x230 [ 92.644264][ T9] tty_buffer_flush+0x1ec/0x2b0 [ 92.644274][ T9] tty_ldisc_flush+0x6b/0xc0 [ 92.644283][ T9] __do_SAK+0x25e/0x680 [ 92.644289][ T9] vc_SAK+0x78/0x220 [ 92.644296][ T9] process_scheduled_works+0xa8e/0x14e0 [ 92.644304][ T9] worker_thread+0xa47/0xfb0 [ 92.644311][ T9] kthread+0x388/0x470 [ 92.644320][ T9] ret_from_fork+0x514/0xb70 [ 92.644330][ T9] ret_from_fork_asm+0x1a/0x30 [ 92.644335][ T9] [ 92.644335][ T9] other info that might help us debug this: [ 92.644335][ T9] [ 92.644338][ T9] Chain exists of: [ 92.644338][ T9] &tty->termios_rwsem --> console_lock --> &buf->lock [ 92.644338][ T9] [ 92.644350][ T9] Possible unsafe locking scenario: [ 92.644350][ T9] [ 92.644352][ T9] CPU0 CPU1 [ 92.644354][ T9] ---- ---- [ 92.644356][ T9] lock(&buf->lock); [ 92.644361][ T9] lock(console_lock); [ 92.644366][ T9] lock(&buf->lock); [ 92.644372][ T9] lock(&tty->termios_rwsem); [ 92.644376][ T9] [ 92.644376][ T9] *** DEADLOCK *** [ 92.644376][ T9] [ 92.644378][ T9] 5 locks held by kworker/0:0/9: [ 92.644382][ T9] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 92.644401][ T9] #1: ffffc9000022fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 92.644419][ T9] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 92.644437][ T9] #3: ffff8880369200a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 92.644457][ T9] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 92.644477][ T9] [ 92.644477][ T9] stack backtrace: [ 92.644482][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 92.644491][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.644495][ T9] Workqueue: events vc_SAK [ 92.644504][ T9] Call Trace: [ 92.644507][ T9] [ 92.644510][ T9] dump_stack_lvl+0xe8/0x150 [ 92.644521][ T9] print_circular_bug+0x2e1/0x300 [ 92.644528][ T9] check_noncircular+0x12e/0x150 [ 92.644536][ T9] __lock_acquire+0x1520/0x2cf0 [ 92.644546][ T9] ? __pfx___mutex_trylock_common+0x10/0x10 [ 92.644554][ T9] ? rcu_is_watching+0x15/0xb0 [ 92.644560][ T9] ? trace_contention_end+0x3d/0x140 [ 92.644568][ T9] ? n_tty_flush_buffer+0x30/0x230 [ 92.644575][ T9] lock_acquire+0x106/0x350 [ 92.644584][ T9] ? n_tty_flush_buffer+0x30/0x230 [ 92.644593][ T9] down_write+0x96/0x200 [ 92.644601][ T9] ? n_tty_flush_buffer+0x30/0x230 [ 92.644609][ T9] ? __pfx_down_write+0x10/0x10 [ 92.644618][ T9] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 92.644626][ T9] n_tty_flush_buffer+0x30/0x230 [ 92.644633][ T9] ? tty_buffer_flush+0x1df/0x2b0 [ 92.644643][ T9] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 92.644651][ T9] tty_buffer_flush+0x1ec/0x2b0 [ 92.644662][ T9] tty_ldisc_flush+0x6b/0xc0 [ 92.644671][ T9] __do_SAK+0x25e/0x680 [ 92.644678][ T9] vc_SAK+0x78/0x220 [ 92.644686][ T9] ? process_scheduled_works+0xa20/0x14e0 [ 92.644694][ T9] process_scheduled_works+0xa8e/0x14e0 [ 92.644705][ T9] ? __pfx_process_scheduled_works+0x10/0x10 [ 92.644713][ T9] ? assign_work+0x3cf/0x5d0 [ 92.644721][ T9] worker_thread+0xa47/0xfb0 [ 92.644732][ T9] kthread+0x388/0x470 [ 92.644741][ T9] ? __pfx_worker_thread+0x10/0x10 [ 92.644749][ T9] ? __pfx_kthread+0x10/0x10 [ 92.644759][ T9] ret_from_fork+0x514/0xb70 [ 92.644769][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 92.644779][ T9] ? __switch_to+0xc89/0x1420 [ 92.644788][ T9] ? __pfx_kthread+0x10/0x10 [ 92.644797][ T9] ret_from_fork_asm+0x1a/0x30 [ 92.644805][ T9]