[ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.167' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.749513] [ 32.749516] ============================================ [ 32.749518] WARNING: possible recursive locking detected [ 32.749523] 4.19.211-syzkaller #0 Not tainted [ 32.749525] -------------------------------------------- [ 32.749530] syz-executor334/8077 is trying to acquire lock: [ 32.749534] 0000000029c9a2ba ((fb_notifier_list).rwsem){++++}, at: blocking_notifier_call_chain+0x6f/0xa0 [ 32.749552] [ 32.749552] but task is already holding lock: [ 32.749554] 0000000029c9a2ba ((fb_notifier_list).rwsem){++++}, at: blocking_notifier_call_chain+0x6f/0xa0 [ 32.749565] [ 32.749565] other info that might help us debug this: [ 32.749566] Possible unsafe locking scenario: [ 32.749566] [ 32.749568] CPU0 [ 32.749569] ---- [ 32.749570] lock((fb_notifier_list).rwsem); [ 32.749573] lock((fb_notifier_list).rwsem); [ 32.749576] [ 32.749576] *** DEADLOCK *** [ 32.749576] [ 32.749578] May be due to missing lock nesting notation [ 32.749578] [ 32.749582] 3 locks held by syz-executor334/8077: [ 32.749584] #0: 000000001f6fe38e (console_lock){+.+.}, at: do_fb_ioctl+0x772/0xb50 [ 32.749595] #1: 00000000f9305e10 (&fb_info->lock){+.+.}, at: do_fb_ioctl+0x77c/0xb50 [ 32.749605] #2: 0000000029c9a2ba ((fb_notifier_list).rwsem){++++}, at: blocking_notifier_call_chain+0x6f/0xa0 [ 32.749617] [ 32.749617] stack backtrace: [ 32.749624] CPU: 1 PID: 8077 Comm: syz-executor334 Not tainted 4.19.211-syzkaller #0 [ 32.749628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.749630] Call Trace: [ 32.749641] dump_stack+0x1fc/0x2ef [ 32.749650] __lock_acquire.cold+0x121/0x57e [ 32.749660] ? mark_held_locks+0xf0/0xf0 [ 32.749670] ? check_preemption_disabled+0x33/0x280 [ 32.749677] ? check_preemption_disabled+0x41/0x280 [ 32.749684] ? check_preemption_disabled+0x41/0x280 [ 32.749692] ? delay_tsc+0x8a/0xb0 [ 32.749699] ? vga16fb_update_fix+0x327/0x4a0 [ 32.749705] ? vga16fb_set_par+0x82b/0xa90 [ 32.749712] lock_acquire+0x170/0x3c0 [ 32.749719] ? blocking_notifier_call_chain+0x6f/0xa0 [ 32.749726] down_read+0x36/0x80 [ 32.749733] ? blocking_notifier_call_chain+0x6f/0xa0 [ 32.749739] blocking_notifier_call_chain+0x6f/0xa0 [ 32.749747] fb_set_var+0xd9a/0xf90 [ 32.749755] ? fb_set_suspend+0x130/0x130 [ 32.749762] ? cfb_imageblit+0xd43/0x1040 [ 32.749770] ? vga16fb_imageblit+0x6b4/0x2260 [ 32.749778] ? fb_pad_aligned_buffer+0xf7/0x150 [ 32.749785] ? fb_get_color_depth+0x11a/0x240 [ 32.749792] ? bit_cursor+0x1165/0x1740 [ 32.749797] ? fb_videomode_to_var+0xf/0x610 [ 32.749804] fbcon_switch+0x425/0x1ba0 [ 32.749811] ? bit_update_start+0x1f0/0x1f0 [ 32.749817] ? fbcon_event_notify+0x1d80/0x1d80 [ 32.749826] ? bit_update_start+0x1f0/0x1f0 [ 32.749832] ? fbcon_cursor+0x531/0x710 [ 32.749841] redraw_screen+0x37d/0x870 [ 32.749847] ? vc_init+0x440/0x440 [ 32.749854] ? bit_update_start+0x1f0/0x1f0 [ 32.749860] ? fbcon_cursor+0x531/0x710 [ 32.749866] fbcon_blank+0xae6/0xec0 [ 32.749874] ? con2fb_release_oldinfo.constprop.0+0x5f0/0x5f0 [ 32.749880] ? __lock_acquire+0x6de/0x3ff0 [ 32.749888] ? __lock_acquire+0x6de/0x3ff0 [ 32.749895] ? mark_held_locks+0xf0/0xf0 [ 32.749904] do_unblank_screen+0x241/0x610 [ 32.749910] fbcon_event_notify+0x1a3a/0x1d80 [ 32.749918] notifier_call_chain+0xc0/0x230 [ 32.749925] blocking_notifier_call_chain+0x85/0xa0 [ 32.749932] fb_blank+0x195/0x1d0 [ 32.749939] ? fb_set_logocmap+0x4a0/0x4a0 [ 32.749946] ? lock_acquire+0x170/0x3c0 [ 32.749952] do_fb_ioctl+0x7ec/0xb50 [ 32.749960] ? check_preemption_disabled+0x41/0x280 [ 32.749965] ? register_framebuffer+0x9e0/0x9e0 [ 32.749972] ? is_bpf_text_address+0xfc/0x1b0 [ 32.749980] ? kernel_text_address+0xbd/0xf0 [ 32.749987] ? __kernel_text_address+0x9/0x30 [ 32.749994] ? unwind_get_return_address+0x51/0x90 [ 32.750001] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.750007] ? __save_stack_trace+0xaf/0x190 [ 32.750015] ? check_preemption_disabled+0x41/0x280 [ 32.750024] ? trace_hardirqs_off+0x64/0x200 [ 32.750032] ? __kasan_slab_free+0x186/0x1f0 [ 32.750038] ? kmem_cache_free+0x7f/0x260 [ 32.750045] ? putname+0xe1/0x120 [ 32.750051] ? do_sys_open+0x2ba/0x520 [ 32.750058] ? do_syscall_64+0xf9/0x620 [ 32.750065] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.750071] ? mark_held_locks+0xf0/0xf0 [ 32.750078] ? mark_held_locks+0xf0/0xf0 [ 32.750085] ? debug_check_no_obj_freed+0x201/0x490 [ 32.750097] ? lock_downgrade+0x720/0x720 [ 32.750104] ? lock_acquire+0x170/0x3c0 [ 32.750109] fb_ioctl+0xdd/0x130 [ 32.750114] ? do_fb_ioctl+0xb50/0xb50 [ 32.750121] do_vfs_ioctl+0xcdb/0x12e0 [ 32.750128] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 32.750134] ? debug_check_no_obj_freed+0x201/0x490 [ 32.750141] ? ioctl_preallocate+0x200/0x200 [ 32.750148] ? putname+0xe1/0x120 [ 32.750155] ? putname+0xe1/0x120 [ 32.750161] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.750167] ? kmem_cache_free+0x226/0x260 [ 32.750174] ? putname+0xe1/0x120 [ 32.750180] ? do_sys_open+0x2bf/0x520 [ 32.750185] ? filp_open+0x70/0x70 [ 32.750191] ksys_ioctl+0x9b/0xc0 [ 32.750198] __x64_sys_ioctl+0x6f/0xb0 [ 32.750204] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 32.750210] do_syscall_64+0xf9/0x620 [ 32.750218] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.750224] RIP: 0033:0x7fbffd3ab239 [ 32.750231] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 32.750234] RSP: 002b:00007ffc55b2c838 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 32.750241] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbffd3ab239 [ 32.750245] RDX: 0000000000000000 RSI: 0000000000004611 RDI: 0000000000000005 [ 32.750248] RBP: 00007fbffd36f220 R08: 00000000