====================================================== WARNING: possible circular locking dependency detected 5.17.0-rc5-next-20220222-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.2/3627 is trying to acquire lock: ffff888010c69818 (&pool->lock/1){-.-.}-{2:2}, at: __queue_work+0x366/0x1140 kernel/workqueue.c:1474 but task is already holding lock: ffffffff9061a530 (&port_lock_key){-.-.}-{2:2}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1916 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&port_lock_key){-.-.}-{2:2} : __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 serial8250_console_write+0x91a/0xb70 drivers/tty/serial/8250/8250_port.c:3359 call_console_drivers kernel/printk/printk.c:1953 [inline] console_unlock+0x9bc/0xdd0 kernel/printk/printk.c:2775 vprintk_emit+0x1b4/0x5f0 kernel/printk/printk.c:2273 vprintk+0x80/0x90 kernel/printk/printk_safe.c:50 _printk+0xba/0xed kernel/printk/printk.c:2294 register_console kernel/printk/printk.c:3132 [inline] register_console+0x410/0x7c0 kernel/printk/printk.c:3013 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:679 console_init+0x3c1/0x58d kernel/printk/printk.c:3232 start_kernel+0x30b/0x4a0 init/main.c:1068 secondary_startup_64_no_verify+0xc3/0xcb -> #2 (console_owner){....}-{0:0}: console_lock_spinning_enable kernel/printk/printk.c:1795 [inline] console_unlock+0x3b1/0xdd0 kernel/printk/printk.c:2772 vprintk_emit+0x1b4/0x5f0 kernel/printk/printk.c:2273 vprintk+0x80/0x90 kernel/printk/printk_safe.c:50 _printk+0xba/0xed kernel/printk/printk.c:2294 warn_flush_attempt kernel/workqueue.c:2613 [inline] check_flush_dependency.cold+0x18/0x4e kernel/workqueue.c:2635 start_flush_work kernel/workqueue.c:3049 [inline] __flush_work+0x25a/0xb10 kernel/workqueue.c:3091 flush_all_cpus_locked+0x148/0x1b0 mm/slub.c:2728 flush_all mm/slub.c:2737 [inline] __kmem_cache_shrink+0x11/0x20 mm/slub.c:4640 acpi_os_purge_cache+0x11/0x20 drivers/acpi/osl.c:1666 acpi_purge_cached_objects+0x37/0xd0 drivers/acpi/acpica/utxface.c:237 acpi_initialize_objects+0x2b/0x95 drivers/acpi/acpica/utxfinit.c:250 acpi_bus_init drivers/acpi/bus.c:1237 [inline] acpi_init+0x1d2/0x976 drivers/acpi/bus.c:1325 do_one_initcall+0x103/0x650 init/main.c:1302 do_initcall_level init/main.c:1375 [inline] do_initcalls init/main.c:1391 [inline] do_basic_setup init/main.c:1410 [inline] kernel_init_freeable+0x6b1/0x73a init/main.c:1615 kernel_init+0x1a/0x1d0 init/main.c:1504 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #1 (&pool->lock){-.-.}-{2:2}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 __queue_work+0x366/0x1140 kernel/workqueue.c:1474 queue_work_on+0xee/0x110 kernel/workqueue.c:1545 queue_work include/linux/workqueue.h:514 [inline] schedule_work include/linux/workqueue.h:575 [inline] put_pwq kernel/workqueue.c:1139 [inline] put_pwq+0x161/0x1b0 kernel/workqueue.c:1124 put_pwq_unlocked kernel/workqueue.c:1156 [inline] put_pwq_unlocked kernel/workqueue.c:1148 [inline] apply_wqattrs_cleanup+0x1e9/0x2d0 kernel/workqueue.c:3961 apply_workqueue_attrs_locked+0xe1/0x140 kernel/workqueue.c:4098 apply_workqueue_attrs+0x2c/0x50 kernel/workqueue.c:4129 padata_setup_cpumasks kernel/padata.c:422 [inline] padata_alloc+0x1bd/0x370 kernel/padata.c:1001 pcrypt_init_padata+0x1b/0xf5 crypto/pcrypt.c:323 pcrypt_init+0x70/0xef crypto/pcrypt.c:348 do_one_initcall+0x103/0x650 init/main.c:1302 do_initcall_level init/main.c:1375 [inline] do_initcalls init/main.c:1391 [inline] do_basic_setup init/main.c:1410 [inline] kernel_init_freeable+0x6b1/0x73a init/main.c:1615 kernel_init+0x1a/0x1d0 init/main.c:1504 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #0 (&pool->lock/1){-.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3096 [inline] check_prevs_add kernel/locking/lockdep.c:3219 [inline] validate_chain kernel/locking/lockdep.c:3834 [inline] __lock_acquire+0x2ac6/0x56c0 kernel/locking/lockdep.c:5060 lock_acquire kernel/locking/lockdep.c:5672 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5637 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 __queue_work+0x366/0x1140 kernel/workqueue.c:1474 queue_work_on+0xee/0x110 kernel/workqueue.c:1545 serial8250_rx_chars+0xcc/0xf0 drivers/tty/serial/8250/8250_port.c:1798 serial8250_handle_irq.part.0+0x292/0x3d0 drivers/tty/serial/8250/8250_port.c:1935 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1913 [inline] serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1957 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x22b/0x880 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xa7/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:817 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250 common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 lock_is_held_type+0xff/0x140 kernel/locking/lockdep.c:5720 lock_is_held include/linux/lockdep.h:279 [inline] rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125 trace_lock_acquire include/trace/events/lock.h:13 [inline] lock_acquire+0x442/0x510 kernel/locking/lockdep.c:5643 __might_fault mm/memory.c:5249 [inline] __might_fault+0x104/0x170 mm/memory.c:5242 do_ipv6_getsockopt.constprop.0+0x17b/0x2690 net/ipv6/ipv6_sockglue.c:1145 ipv6_getsockopt+0x13c/0x270 net/ipv6/ipv6_sockglue.c:1495 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:4292 __sys_getsockopt+0x21f/0x6a0 net/socket.c:2224 __do_sys_getsockopt net/socket.c:2239 [inline] __se_sys_getsockopt net/socket.c:2236 [inline] __x64_sys_getsockopt+0xba/0x150 net/socket.c:2236 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Chain exists of: &pool->lock/1 --> console_owner --> &port_lock_key Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port_lock_key); lock(console_owner); lock(&port_lock_key); lock(&pool->lock/1); *** DEADLOCK *** 3 locks held by syz-executor.2/3627: #0: ffff88806f70ed30 (&i->lock){-.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline] #0: ffff88806f70ed30 (&i->lock){-.-.}-{2:2}, at: serial8250_interrupt+0x3a/0x200 drivers/tty/serial/8250/8250_core.c:116 #1: ffffffff9061a530 (&port_lock_key){-.-.}-{2:2}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1916 #2: ffffffff8bb866a0 (rcu_read_lock){....}-{1:2}, at: __queue_work+0xd0/0x1140 kernel/workqueue.c:1437 stack backtrace: CPU: 0 PID: 3627 Comm: syz-executor.2 Not tainted 5.17.0-rc5-next-20220222-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2176 check_prev_add kernel/locking/lockdep.c:3096 [inline] check_prevs_add kernel/locking/lockdep.c:3219 [inline] validate_chain kernel/locking/lockdep.c:3834 [inline] __lock_acquire+0x2ac6/0x56c0 kernel/locking/lockdep.c:5060 lock_acquire kernel/locking/lockdep.c:5672 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5637 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 __queue_work+0x366/0x1140 kernel/workqueue.c:1474 queue_work_on+0xee/0x110 kernel/workqueue.c:1545 serial8250_rx_chars+0xcc/0xf0 drivers/tty/serial/8250/8250_port.c:1798 serial8250_handle_irq.part.0+0x292/0x3d0 drivers/tty/serial/8250/8250_port.c:1935 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1913 [inline] serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1957 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x22b/0x880 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xa7/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:817 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250 common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0010:lock_is_held_type+0xff/0x140 kernel/locking/lockdep.c:5720 Code: 00 00 b8 ff ff ff ff 65 0f c1 05 fc 63 b3 76 83 f8 01 75 29 9c 58 f6 c4 02 75 3d 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ed eb b9 0f 0b 48 RSP: 0018:ffffc90003cffa40 EFLAGS: 00000292 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffffff8bb865e0 R08: 0000000000000000 R09: ffffffff8d952297 R10: fffffbfff1b2a452 R11: 000000000000001f R12: ffff88801dc21d00 R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000 lock_is_held include/linux/lockdep.h:279 [inline] rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125 trace_lock_acquire include/trace/events/lock.h:13 [inline] lock_acquire+0x442/0x510 kernel/locking/lockdep.c:5643 __might_fault mm/memory.c:5249 [inline] __might_fault+0x104/0x170 mm/memory.c:5242 do_ipv6_getsockopt.constprop.0+0x17b/0x2690 net/ipv6/ipv6_sockglue.c:1145 ipv6_getsockopt+0x13c/0x270 net/ipv6/ipv6_sockglue.c:1495 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:4292 __sys_getsockopt+0x21f/0x6a0 net/socket.c:2224 __do_sys_getsockopt net/socket.c:2239 [inline] __se_sys_getsockopt net/socket.c:2236 [inline] __x64_sys_getsockopt+0xba/0x150 net/socket.c:2236 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fa55688a67a Code: 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6c80bd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 0000000000000029 RCX: 00007fa55688a67a RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 00007fff6c80bd70 R08: 00007fff6c80bd6c R09: fefefefeff646b66 R10: 00007fff6c80bd70 R11: 0000000000000246 R12: 00007fff6c80bdd0 R13: 0000000000000003 R14: 00007fff6c80bd6c R15: 00007fa55696b8e0 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: b8 ff ff ff ff mov $0xffffffff,%eax 7: 65 0f c1 05 fc 63 b3 xadd %eax,%gs:0x76b363fc(%rip) # 0x76b3640b e: 76 f: 83 f8 01 cmp $0x1,%eax 12: 75 29 jne 0x3d 14: 9c pushfq 15: 58 pop %rax 16: f6 c4 02 test $0x2,%ah 19: 75 3d jne 0x58 1b: 48 f7 04 24 00 02 00 testq $0x200,(%rsp) 22: 00 23: 74 01 je 0x26 25: fb sti 26: 48 83 c4 08 add $0x8,%rsp * 2a: 44 89 e8 mov %r13d,%eax <-- trapping instruction 2d: 5b pop %rbx 2e: 5d pop %rbp 2f: 41 5c pop %r12 31: 41 5d pop %r13 33: 41 5e pop %r14 35: 41 5f pop %r15 37: c3 retq 38: 45 31 ed xor %r13d,%r13d 3b: eb b9 jmp 0xfffffff6 3d: 0f 0b ud2 3f: 48 rex.W