RBP: 00007f57223831d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffcb457005f R14: 00007f5722383300 R15: 0000000000022000 CPU: 0 PID: 3615 Comm: syz-executor.5 Not tainted 4.14.293-syzkaller #0 ====================================================== WARNING: possible circular locking dependency detected 4.14.293-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.4/3624 is trying to acquire lock: (console_owner){-.-.}, at: [] log_next kernel/printk/printk.c:495 [inline] (console_owner){-.-.}, at: [] console_unlock+0x307/0xf20 kernel/printk/printk.c:2396 but task is already holding lock: (&(&port->lock)->rlock){-.-.}, at: [] tty_insert_flip_string_and_push_buffer+0x2b/0x160 drivers/tty/tty_buffer.c:569 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&(&port->lock)->rlock){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 tty_port_tty_get+0x1d/0x80 drivers/tty/tty_port.c:288 tty_port_default_wakeup+0x11/0x40 drivers/tty/tty_port.c:46 serial8250_tx_chars+0x3fe/0xc70 drivers/tty/serial/8250/8250_port.c:1828 serial8250_handle_irq.part.0+0x28d/0x330 drivers/tty/serial/8250/8250_port.c:1915 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1888 [inline] serial8250_default_handle_irq+0x8a/0x1f0 drivers/tty/serial/8250/8250_port.c:1931 serial8250_interrupt+0xf3/0x210 drivers/tty/serial/8250/8250_core.c:129 __handle_irq_event_percpu+0xee/0x7f0 kernel/irq/handle.c:147 handle_irq_event_percpu kernel/irq/handle.c:187 [inline] handle_irq_event+0xed/0x240 kernel/irq/handle.c:204 handle_edge_irq+0x224/0xc40 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1d0 arch/x86/kernel/irq.c:230 ret_from_intr+0x0/0x1e arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] uart_write+0x2dd/0x560 drivers/tty/serial/serial_core.c:632 do_output_char+0x4f5/0x750 drivers/tty/n_tty.c:447 process_output drivers/tty/n_tty.c:514 [inline] n_tty_write+0x3e3/0xda0 drivers/tty/n_tty.c:2345 do_tty_write drivers/tty/tty_io.c:959 [inline] tty_write+0x410/0x740 drivers/tty/tty_io.c:1043 redirected_tty_write+0x9c/0xb0 drivers/tty/tty_io.c:1064 do_loop_readv_writev fs/read_write.c:698 [inline] do_loop_readv_writev fs/read_write.c:682 [inline] do_iter_write+0x3da/0x550 fs/read_write.c:956 vfs_writev+0x125/0x290 fs/read_write.c:999 do_writev+0xfc/0x2c0 fs/read_write.c:1034 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb -> #1 (&port_lock_key){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 serial8250_console_write+0x7d5/0xa10 drivers/tty/serial/8250/8250_port.c:3273 call_console_drivers kernel/printk/printk.c:1727 [inline] console_unlock+0x99d/0xf20 kernel/printk/printk.c:2409 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1925 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1998 register_console+0x6f4/0xad0 kernel/printk/printk.c:2728 univ8250_console_init+0x2f/0x3a drivers/tty/serial/8250/8250_core.c:691 console_init+0x46/0x53 kernel/printk/printk.c:2809 start_kernel+0x521/0x763 init/main.c:638 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 -> #0 (console_owner){-.-.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_lock_spinning_enable kernel/printk/printk.c:1590 [inline] console_unlock+0x36f/0xf20 kernel/printk/printk.c:2406 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1925 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1998 fail_dump lib/fault-inject.c:44 [inline] should_fail.cold+0xdf/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x6d/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] tty_buffer_alloc+0xc0/0x270 drivers/tty/tty_buffer.c:169 __tty_buffer_request_room+0x12c/0x290 drivers/tty/tty_buffer.c:268 tty_insert_flip_string_fixed_flag+0x8b/0x210 drivers/tty/tty_buffer.c:313 tty_insert_flip_string include/linux/tty_flip.h:36 [inline] tty_insert_flip_string_and_push_buffer+0x3e/0x160 drivers/tty/tty_buffer.c:570 pty_write+0xc3/0xf0 drivers/tty/pty.c:118 tty_put_char+0xfe/0x120 drivers/tty/tty_io.c:2885 __process_echoes+0x48c/0x8c0 drivers/tty/n_tty.c:728 flush_echoes drivers/tty/n_tty.c:829 [inline] __receive_buf drivers/tty/n_tty.c:1648 [inline] n_tty_receive_buf_common+0x9a3/0x25a0 drivers/tty/n_tty.c:1742 tiocsti drivers/tty/tty_io.c:2185 [inline] tty_ioctl+0xe8a/0x1430 drivers/tty/tty_io.c:2572 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &(&port->lock)->rlock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&port->lock)->rlock); lock(&port_lock_key); lock(&(&port->lock)->rlock); lock(console_owner); *** DEADLOCK *** 6 locks held by syz-executor.4/3624: #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284 #1: (&port->buf.lock/1){+.+.}, at: [] tiocsti drivers/tty/tty_io.c:2183 [inline] #1: (&port->buf.lock/1){+.+.}, at: [] tty_ioctl+0xe20/0x1430 drivers/tty/tty_io.c:2572 #2: (&o_tty->termios_rwsem/1){++++}, at: [] isig+0x36d/0x420 drivers/tty/n_tty.c:1152 #3: (&ldata->output_lock){+.+.}, at: [] flush_echoes drivers/tty/n_tty.c:827 [inline] #3: (&ldata->output_lock){+.+.}, at: [] __receive_buf drivers/tty/n_tty.c:1648 [inline] #3: (&ldata->output_lock){+.+.}, at: [] n_tty_receive_buf_common+0x965/0x25a0 drivers/tty/n_tty.c:1742 #4: (&(&port->lock)->rlock){-.-.}, at: [] tty_insert_flip_string_and_push_buffer+0x2b/0x160 drivers/tty/tty_buffer.c:569 #5: (console_lock){+.+.}, at: [] vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 stack backtrace: CPU: 1 PID: 3624 Comm: syz-executor.4 Not tainted 4.14.293-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_lock_spinning_enable kernel/printk/printk.c:1590 [inline] console_unlock+0x36f/0xf20 kernel/printk/printk.c:2406 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1925 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1998 fail_dump lib/fault-inject.c:44 [inline] should_fail.cold+0xdf/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x6d/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] tty_buffer_alloc+0xc0/0x270 drivers/tty/tty_buffer.c:169 __tty_buffer_request_room+0x12c/0x290 drivers/tty/tty_buffer.c:268 tty_insert_flip_string_fixed_flag+0x8b/0x210 drivers/tty/tty_buffer.c:313 tty_insert_flip_string include/linux/tty_flip.h:36 [inline] tty_insert_flip_string_and_push_buffer+0x3e/0x160 drivers/tty/tty_buffer.c:570 pty_write+0xc3/0xf0 drivers/tty/pty.c:118 tty_put_char+0xfe/0x120 drivers/tty/tty_io.c:2885 __process_echoes+0x48c/0x8c0 drivers/tty/n_tty.c:728 flush_echoes drivers/tty/n_tty.c:829 [inline] __receive_buf drivers/tty/n_tty.c:1648 [inline] n_tty_receive_buf_common+0x9a3/0x25a0 drivers/tty/n_tty.c:1742 tiocsti drivers/tty/tty_io.c:2185 [inline] tty_ioctl+0xe8a/0x1430 drivers/tty/tty_io.c:2572 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f5723a0e409 RSP: 002b:00007f5722383168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f5723b20f80 RCX: 00007f5723a0e409 RDX: 0000000020000000 RSI: 0000000000005412 RDI: 0000000000000004 RBP: 00007f57223831d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffcb457005f R14: 00007f5722383300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3297 [inline] kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:980 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1168 [inline] netlink_sendmsg+0x91e/0xbc0 net/netlink/af_netlink.c:1868 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fbe3eac4409 RSP: 002b:00007fbe3d439168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fbe3ebd6f80 RCX: 00007fbe3eac4409 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 00007fbe3d4391d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffdb89e2c6f R14: 00007fbe3d439300 R15: 0000000000022000 CPU: 1 PID: 3606 Comm: syz-executor.2 Not tainted 4.14.293-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550 kmem_cache_zalloc include/linux/slab.h:651 [inline] fill_pool lib/debugobjects.c:110 [inline] __debug_object_init+0x578/0x7a0 lib/debugobjects.c:341 debug_object_init lib/debugobjects.c:393 [inline] debug_object_activate+0x391/0x490 lib/debugobjects.c:474 debug_rcu_head_queue kernel/rcu/rcu.h:152 [inline] __call_rcu.constprop.0+0x31/0x7d0 kernel/rcu/tree.c:3050 file_free fs/file_table.c:56 [inline] __fput+0x43b/0x7a0 fs/file_table.c:227 task_work_run+0x11f/0x190 kernel/task_work.c:113 get_signal+0x18a3/0x1ca0 kernel/signal.c:2223 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f9e4991d409 RSP: 002b:00007f9e48292168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 00007f9e49a2ff80 RCX: 00007f9e4991d409 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f9e482921d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffde92d1a2f R14: 00007f9e48292300 R15: 0000000000022000 Unknown ioctl 19305 Unknown ioctl -2147199944 Unknown ioctl 19305 Unknown ioctl -2147199944 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19313 Unknown ioctl 19305 Unknown ioctl 19313 Unknown ioctl 19305 Unknown ioctl 19313 Unknown ioctl 19305 Unknown ioctl 19313 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl 19304 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl -2147199944 Unknown ioctl 19305 Unknown ioctl 21511 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 21511 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 21511 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305 Unknown ioctl 19305