program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x2) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000240), 0x18) [ 75.976824][ T5279] Bluetooth: hci0: command tx timeout [ 76.060159][ T5315] input: syz0 as /devices/virtual/input/input5 [ 76.091312][ T1370] [ 76.091322][ T1370] ====================================================== [ 76.091327][ T1370] WARNING: possible circular locking dependency detected [ 76.091333][ T1370] syzkaller #0 Not tainted [ 76.091339][ T1370] ------------------------------------------------------ [ 76.091343][ T1370] kworker/0:3/1370 is trying to acquire lock: [ 76.091349][ T1370] ffff8880398092c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 76.091461][ T1370] [ 76.091461][ T1370] but task is already holding lock: [ 76.091465][ T1370] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 76.091494][ T1370] [ 76.091494][ T1370] which lock already depends on the new lock. [ 76.091494][ T1370] [ 76.091498][ T1370] [ 76.091498][ T1370] the existing dependency chain (in reverse order) is: [ 76.091502][ T1370] [ 76.091502][ T1370] -> #3 (&buf->lock){+.+.}-{4:4}: [ 76.091518][ T1370] __mutex_lock+0x19d/0x1550 [ 76.091562][ T1370] tty_buffer_flush+0x74/0x2b0 [ 76.091576][ T1370] tty_ldisc_flush+0x6b/0xc0 [ 76.091590][ T1370] __do_SAK+0x25e/0x680 [ 76.091598][ T1370] vc_SAK+0x78/0x220 [ 76.091611][ T1370] process_scheduled_works+0xa8e/0x14e0 [ 76.091623][ T1370] worker_thread+0xa47/0xfb0 [ 76.091634][ T1370] kthread+0x388/0x470 [ 76.091648][ T1370] ret_from_fork+0x514/0xb70 [ 76.091663][ T1370] ret_from_fork_asm+0x1a/0x30 [ 76.091673][ T1370] [ 76.091673][ T1370] -> #2 (console_lock){+.+.}-{0:0}: [ 76.091690][ T1370] console_lock+0x76/0x90 [ 76.091700][ T1370] serial_core_register_port+0xc47/0x2840 [ 76.091715][ T1370] serial8250_register_8250_port+0x16b4/0x2090 [ 76.091728][ T1370] serial_pnp_probe+0x56a/0x7f0 [ 76.091742][ T1370] pnp_device_probe+0x30b/0x4c0 [ 76.091755][ T1370] really_probe+0x254/0xae0 [ 76.091768][ T1370] __driver_probe_device+0x1e8/0x360 [ 76.091798][ T1370] driver_probe_device+0x4f/0x240 [ 76.091809][ T1370] __driver_attach+0x339/0x600 [ 76.091819][ T1370] bus_for_each_dev+0x23b/0x2c0 [ 76.091832][ T1370] bus_add_driver+0x345/0x670 [ 76.091845][ T1370] driver_register+0x23a/0x320 [ 76.091857][ T1370] serial8250_init+0x8f/0x160 [ 76.091929][ T1370] do_one_initcall+0x250/0x870 [ 76.091944][ T1370] do_initcall_level+0x10a/0x1a0 [ 76.091957][ T1370] do_initcalls+0x59/0xa0 [ 76.091969][ T1370] kernel_init_freeable+0x29d/0x3e0 [ 76.091981][ T1370] kernel_init+0x1d/0x1d0 [ 76.091995][ T1370] ret_from_fork+0x514/0xb70 [ 76.092009][ T1370] ret_from_fork_asm+0x1a/0x30 [ 76.092017][ T1370] [ 76.092017][ T1370] -> #1 (&port->mutex){+.+.}-{4:4}: [ 76.092033][ T1370] __mutex_lock+0x19d/0x1550 [ 76.092045][ T1370] uart_set_termios+0x83/0x12e0 [ 76.092059][ T1370] tty_set_termios+0xcaf/0x1800 [ 76.092072][ T1370] set_termios+0x53d/0x6c0 [ 76.092084][ T1370] tty_mode_ioctl+0x49c/0x7c0 [ 76.092097][ T1370] tty_ioctl+0x9bd/0xdd0 [ 76.092111][ T1370] __se_sys_ioctl+0xfc/0x170 [ 76.092125][ T1370] do_syscall_64+0x174/0x580 [ 76.092137][ T1370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.092147][ T1370] [ 76.092147][ T1370] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 76.092163][ T1370] __lock_acquire+0x1520/0x2cf0 [ 76.092177][ T1370] lock_acquire+0x106/0x350 [ 76.092190][ T1370] down_write+0x96/0x200 [ 76.092203][ T1370] n_tty_flush_buffer+0x30/0x230 [ 76.092214][ T1370] tty_buffer_flush+0x1ec/0x2b0 [ 76.092228][ T1370] tty_ldisc_flush+0x6b/0xc0 [ 76.092241][ T1370] __do_SAK+0x25e/0x680 [ 76.092250][ T1370] vc_SAK+0x78/0x220 [ 76.092262][ T1370] process_scheduled_works+0xa8e/0x14e0 [ 76.092273][ T1370] worker_thread+0xa47/0xfb0 [ 76.092284][ T1370] kthread+0x388/0x470 [ 76.092297][ T1370] ret_from_fork+0x514/0xb70 [ 76.092311][ T1370] ret_from_fork_asm+0x1a/0x30 [ 76.092320][ T1370] [ 76.092320][ T1370] other info that might help us debug this: [ 76.092320][ T1370] [ 76.092324][ T1370] Chain exists of: [ 76.092324][ T1370] &tty->termios_rwsem --> console_lock --> &buf->lock [ 76.092324][ T1370] [ 76.092344][ T1370] Possible unsafe locking scenario: [ 76.092344][ T1370] [ 76.092348][ T1370] CPU0 CPU1 [ 76.092351][ T1370] ---- ---- [ 76.092354][ T1370] lock(&buf->lock); [ 76.092362][ T1370] lock(console_lock); [ 76.092370][ T1370] lock(&buf->lock); [ 76.092385][ T1370] lock(&tty->termios_rwsem); [ 76.092393][ T1370] [ 76.092393][ T1370] *** DEADLOCK *** [ 76.092393][ T1370] [ 76.092396][ T1370] 5 locks held by kworker/0:3/1370: [ 76.092402][ T1370] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 76.092431][ T1370] #1: ffffc900024ffc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 76.092460][ T1370] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 76.092488][ T1370] #3: ffff8880398090a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 76.092519][ T1370] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 76.092549][ T1370] [ 76.092549][ T1370] stack backtrace: [ 76.092556][ T1370] CPU: 0 UID: 0 PID: 1370 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 76.092568][ T1370] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.092574][ T1370] Workqueue: events vc_SAK [ 76.092587][ T1370] Call Trace: [ 76.092593][ T1370] [ 76.092597][ T1370] dump_stack_lvl+0xe8/0x150 [ 76.092613][ T1370] print_circular_bug+0x2e1/0x300 [ 76.092629][ T1370] check_noncircular+0x12e/0x150 [ 76.092641][ T1370] __lock_acquire+0x1520/0x2cf0 [ 76.092656][ T1370] ? __pfx___mutex_trylock_common+0x10/0x10 [ 76.092668][ T1370] ? rcu_is_watching+0x15/0xb0 [ 76.092678][ T1370] ? trace_contention_end+0x3d/0x140 [ 76.092690][ T1370] ? n_tty_flush_buffer+0x30/0x230 [ 76.092701][ T1370] lock_acquire+0x106/0x350 [ 76.092714][ T1370] ? n_tty_flush_buffer+0x30/0x230 [ 76.092728][ T1370] down_write+0x96/0x200 [ 76.092740][ T1370] ? n_tty_flush_buffer+0x30/0x230 [ 76.092751][ T1370] ? __pfx_down_write+0x10/0x10 [ 76.092767][ T1370] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 76.092778][ T1370] n_tty_flush_buffer+0x30/0x230 [ 76.092789][ T1370] ? tty_buffer_flush+0x1df/0x2b0 [ 76.092805][ T1370] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 76.092816][ T1370] tty_buffer_flush+0x1ec/0x2b0 [ 76.092832][ T1370] tty_ldisc_flush+0x6b/0xc0 [ 76.092847][ T1370] __do_SAK+0x25e/0x680 [ 76.092856][ T1370] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 76.092869][ T1370] vc_SAK+0x78/0x220 [ 76.092881][ T1370] ? process_scheduled_works+0xa20/0x14e0 [ 76.092892][ T1370] process_scheduled_works+0xa8e/0x14e0 [ 76.092909][ T1370] ? __pfx_process_scheduled_works+0x10/0x10 [ 76.092922][ T1370] ? assign_work+0x3cf/0x5d0 [ 76.092934][ T1370] worker_thread+0xa47/0xfb0 [ 76.092948][ T1370] ? __kthread_parkme+0x71/0x1f0 [ 76.092963][ T1370] kthread+0x388/0x470 [ 76.092977][ T1370] ? __pfx_worker_thread+0x10/0x10 [ 76.092989][ T1370] ? __pfx_kthread+0x10/0x10 [ 76.093003][ T1370] ret_from_fork+0x514/0xb70 [ 76.093018][ T1370] ? __pfx_ret_from_fork+0x10/0x10 [ 76.093033][ T1370] ? __switch_to+0xc89/0x1420 [ 76.093046][ T1370] ? __pfx_kthread+0x10/0x10 [ 76.093060][ T1370] ret_from_fork_asm+0x1a/0x30 [ 76.093073][ T1370] [ 76.292048][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.292081][ T1330] ieee802154 phy1 wpan1: encryption failed: -22