Warning: Permanently added '[localhost]:11180' (ECDSA) to the list of known hosts. [ 111.596226][ T46] audit: type=1400 audit(1613396390.339:8): avc: denied { execmem } for pid=8599 comm="syz-executor100" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 111.628278][ T8600] IPVS: ftp: loaded support on port[0] = 21 executing program [ 111.756424][ T8600] ttyprintk ttyprintk: tty_port_close_start: tty->count = 1 port count = 2 [ 111.783855][ C0] [ 111.783869][ C0] ====================================================== [ 111.783879][ C0] WARNING: possible circular locking dependency detected [ 111.783888][ C0] 5.11.0-syzkaller #0 Not tainted [ 111.783895][ C0] ------------------------------------------------------ [ 111.783903][ C0] syz-executor100/8600 is trying to acquire lock: [ 111.783911][ C0] ffffffff8bc82ca0 (console_owner){....}-{0:0}, at: console_unlock+0x2fb/0xbb0 [ 111.783942][ C0] [ 111.783948][ C0] but task is already holding lock: [ 111.783975][ C0] ffffffff906b3358 (&port->lock){-.-.}-{2:2}, at: tty_port_close_start.part.0+0x28/0x550 [ 111.784002][ C0] [ 111.784007][ C0] which lock already depends on the new lock. [ 111.784013][ C0] [ 111.784016][ C0] [ 111.784022][ C0] the existing dependency chain (in reverse order) is: [ 111.784028][ C0] [ 111.784032][ C0] -> #2 (&port->lock){-.-.}-{2:2}: [ 111.784058][ C0] _raw_spin_lock_irqsave+0x39/0x50 [ 111.784066][ C0] tty_port_tty_get+0x1f/0x100 [ 111.784073][ C0] tty_port_default_wakeup+0x11/0x40 [ 111.784081][ C0] serial8250_tx_chars+0x487/0xa80 [ 111.784088][ C0] serial8250_start_tx+0x63a/0x9e0 [ 111.784094][ C0] __uart_start.isra.0+0x16d/0x1c0 [ 111.784101][ C0] uart_write+0x2fb/0x570 [ 111.784107][ C0] do_output_char+0x5de/0x850 [ 111.784114][ C0] n_tty_write+0x4c3/0xfd0 [ 111.784120][ C0] file_tty_write.constprop.0+0x521/0x8f0 [ 111.784128][ C0] redirected_tty_write+0xa1/0xc0 [ 111.784135][ C0] do_iter_readv_writev+0x46f/0x740 [ 111.784141][ C0] do_iter_write+0x188/0x670 [ 111.784147][ C0] vfs_writev+0x1aa/0x620 [ 111.784153][ C0] do_writev+0x139/0x300 [ 111.784159][ C0] do_syscall_64+0x2d/0x70 [ 111.784167][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.784174][ C0] [ 111.784178][ C0] -> #1 (&port_lock_key){-.-.}-{2:2}: [ 111.784205][ C0] _raw_spin_lock_irqsave+0x39/0x50 [ 111.784213][ C0] serial8250_console_write+0x880/0xa90 [ 111.784219][ C0] console_unlock+0x841/0xbb0 [ 111.784226][ C0] vprintk_emit+0x189/0x490 [ 111.784232][ C0] vprintk_func+0x8d/0x1e0 [ 111.784237][ C0] printk+0xba/0xed [ 111.784243][ C0] register_console+0x5d1/0x800 [ 111.784249][ C0] univ8250_console_init+0x3a/0x46 [ 111.784255][ C0] console_init+0x3c7/0x596 [ 111.784262][ C0] start_kernel+0x2fc/0x48c [ 111.784269][ C0] secondary_startup_64_no_verify+0xb0/0xbb [ 111.784275][ C0] [ 111.784279][ C0] -> #0 (console_owner){....}-{0:0}: [ 111.784301][ C0] __lock_acquire+0x2b26/0x54f0 [ 111.784308][ C0] lock_acquire+0x1a8/0x720 [ 111.784315][ C0] console_unlock+0x37a/0xbb0 [ 111.784322][ C0] vprintk_emit+0x189/0x490 [ 111.784329][ C0] vprintk_func+0x8d/0x1e0 [ 111.784336][ C0] printk+0xba/0xed [ 111.784343][ C0] tty_port_close_start.part.0+0x503/0x550 [ 111.784350][ C0] tty_port_close+0x46/0x170 [ 111.784357][ C0] tty_release+0x45e/0x1210 [ 111.784363][ C0] __fput+0x283/0x920 [ 111.784369][ C0] task_work_run+0xdd/0x190 [ 111.784375][ C0] exit_to_user_mode_prepare+0x249/0x250 [ 111.784382][ C0] syscall_exit_to_user_mode+0x19/0x50 [ 111.784390][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.784403][ C0] [ 111.784408][ C0] other info that might help us debug this: [ 111.784414][ C0] [ 111.784418][ C0] Chain exists of: [ 111.784422][ C0] console_owner --> &port_lock_key --> &port->lock [ 111.784459][ C0] [ 111.784464][ C0] Possible unsafe locking scenario: [ 111.784470][ C0] [ 111.784475][ C0] CPU0 CPU1 [ 111.784481][ C0] ---- ---- [ 111.784487][ C0] lock(&port->lock); [ 111.784501][ C0] lock(&port_lock_key); [ 111.784517][ C0] lock(&port->lock); [ 111.784531][ C0] lock(console_owner); [ 111.784543][ C0] [ 111.784548][ C0] *** DEADLOCK *** [ 111.784551][ C0] [ 111.784557][ C0] 3 locks held by syz-executor100/8600: [ 111.784563][ C0] #0: ffff8880163111c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 [ 111.784598][ C0] #1: ffffffff906b3358 (&port->lock){-.-.}-{2:2}, at: tty_port_close_start.part.0+0x28/0x550 [ 111.784630][ C0] #2: ffffffff8bd63020 (console_lock){+.+.}-{0:0}, at: vprintk_func+0x8d/0x1e0 [ 111.784660][ C0] [ 111.784664][ C0] stack backtrace: [ 111.784670][ C0] CPU: 0 PID: 8600 Comm: syz-executor100 Not tainted 5.11.0-syzkaller #0 [ 111.784681][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 111.784690][ C0] Call Trace: [ 111.784695][ C0] dump_stack+0x107/0x163 [ 111.784701][ C0] check_noncircular+0x25f/0x2e0 [ 111.784709][ C0] ? stack_trace_consume_entry+0x160/0x160 [ 111.784716][ C0] ? print_circular_bug+0x480/0x480 [ 111.784722][ C0] ? memcpy+0x39/0x60 [ 111.784728][ C0] ? lockdep_lock+0xc6/0x200 [ 111.784734][ C0] ? call_rcu_zapped+0xb0/0xb0 [ 111.784739][ C0] __lock_acquire+0x2b26/0x54f0 [ 111.784745][ C0] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 111.784752][ C0] lock_acquire+0x1a8/0x720 [ 111.784758][ C0] ? console_unlock+0x2fb/0xbb0 [ 111.784764][ C0] ? lock_release+0x710/0x710 [ 111.784770][ C0] ? lock_downgrade+0x6d0/0x6d0 [ 111.784775][ C0] ? do_raw_spin_lock+0x120/0x2b0 [ 111.784781][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 111.784788][ C0] console_unlock+0x37a/0xbb0 [ 111.784795][ C0] ? console_unlock+0x2fb/0xbb0 [ 111.784801][ C0] ? devkmsg_read+0x740/0x740 [ 111.784808][ C0] ? lock_release+0x710/0x710 [ 111.784815][ C0] ? do_raw_spin_unlock+0x171/0x230 [ 111.784822][ C0] ? vprintk_func+0x8d/0x1e0 [ 111.784828][ C0] vprintk_emit+0x189/0x490 [ 111.784834][ C0] vprintk_func+0x8d/0x1e0 [ 111.784840][ C0] printk+0xba/0xed [ 111.784845][ C0] ? record_print_text.cold+0x16/0x16 [ 111.784852][ C0] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 111.784858][ C0] tty_port_close_start.part.0+0x503/0x550 [ 111.784865][ C0] tty_port_close+0x46/0x170 [ 111.784871][ C0] ? tpk_open+0x60/0x60 [ 111.784876][ C0] tty_release+0x45e/0x1210 [ 111.784883][ C0] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 111.784889][ C0] __fput+0x283/0x920 [ 111.784894][ C0] ? tty_release_struct+0xe0/0xe0 [ 111.784900][ C0] task_work_run+0xdd/0x190 [ 111.784908][ C0] exit_to_user_mode_prepare+0x249/0x250 [ 111.784915][ C0] syscall_exit_to_user_mode+0x19/0x50 [ 111.784922][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.784929][ C0] RIP: 0033:0x40667b [ 111.784940][ C0] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 03 fd ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 41 fd ff ff 8b 44 [ 111.784957][ C0] RSP: 002b:00007ffc3a9349f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 111.784971][ C0] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 000000000040667b [ 111.784980][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 111.784989][ C0] RBP: 00000000004ca41c R08: 0000000000000000 R09: 0000000100000000 [ 111.784998][ C0] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000032 [ 111.785007][ C0] R13: 00007ffc3a934a40 R14: 00007ffc3a934a90 R15: 0000000000000002 [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 VM DIAGNOSIS: 13:39:51 Registers: info registers vcpu 0 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff8418c51c RDI=ffffffff9069a5c0 RBP=ffffffff9069a580 RSP=ffffc90000007c38 R8 =0000000000000037 R9 =0000000000000000 R10=ffffffff8418c50d R11=000000000000001f R12=0000000000000000 R13=fffffbfff20d3503 R14=fffffbfff20d34ba R15=dffffc0000000000 RIP=ffffffff8418c542 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000002246300 ffffffff 00c00000 GS =0000 ffff88802ca00000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000000485b80 CR3=0000000019862000 CR4=00150ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000004c99e000000000004c99e0 XMM02=ffffffffffff00000000000000000000 XMM03=000000000000000000000000000000ff XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000034323031203030352036 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000000002f706 RBX=ffff8880116c2400 RCX=ffffffff88fb9920 RDX=0000000000000000 RSI=0000000000000001 RDI=ffffffff88fdf16f RBP=ffffed10022d8480 RSP=ffffc9000043fdf8 R8 =0000000000000000 R9 =ffff88802cb35c6b R10=ffffed1005966b8d R11=0000000000000000 R12=0000000000000001 R13=0000000000000001 R14=ffffffff8da3b448 R15=0000000000000000 RIP=ffffffff88fdedae RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802cb00000 ffffffff 00c00000 LDT=0000 0000000000000000 00000000 00000000 TR =0040 fffffe000003e000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000003c000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000002000004c CR3=0000000019862000 CR4=00150ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000004c99e000000000004c99e0 XMM02=ffffffffffff00000000000000000000 XMM03=000000000000000000000000000000ff XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000034323031203030352036 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 2 RAX=0000000000000000 RBX=0000000000000005 RCX=0000000000000000 RDX=ffffc9000034fb10 RSI=0000000000000005 RDI=ffffc9000034fb50 RBP=1ffff92000069f5e RSP=ffffc9000034fac8 R8 =ffffffff8998c600 R9 =ffffffff838fed77 R10=0000000000000003 R11=0000000000000005 R12=ffffc9000034fbc0 R13=00000000fffffff4 R14=ffffc9000034fb50 R15=0000000000000001 RIP=ffffffff838fb720 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fb3906a1500 ffffffff 00c00000 GS =0000 ffff88802cc00000 ffffffff 00c00000 LDT=0000 0000000000000000 00000000 00000000 TR =0040 fffffe0000079000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000077000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005597a6e5e528 CR3=0000000014a3b000 CR4=00150ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00009fc0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=6563697665642e61637974742d766564 XMM01=642e6563697665642e61637974742d76 XMM02=00642e6563697665642e61637974742d XMM03=7665642f6d65747379732f646d657473 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=ffffffffffffff00000000000000ffff XMM10=20202020202020000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 3 RAX=0000000000018da2 RBX=ffff8880116c8040 RCX=ffffffff88fb9920 RDX=0000000000000000 RSI=0000000000000001 RDI=ffffffff88fdf16f RBP=ffffed10022d9008 RSP=ffffc9000045fdf8 R8 =0000000000000000 R9 =ffff88802cd35c6b R10=ffffed10059a6b8d R11=0000000000000000 R12=0000000000000003 R13=0000000000000003 R14=ffffffff8da3b448 R15=0000000000000000 RIP=ffffffff88fdedae RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88802cd00000 ffffffff 00c00000 LDT=0000 0000000000000000 00000000 00000000 TR =0040 fffffe00000b4000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000b2000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f85a6f9d246 CR3=0000000019862000 CR4=00150ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000004c99e000000000004c99e0 XMM02=ffffffffffff00000000000000000000 XMM03=000000000000000000000000000000ff XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000034323031203030352036 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000