------------[ cut here ]------------ ====================================================== WARNING: possible circular locking dependency detected 5.15.109-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/7699 is trying to acquire lock: ffff80001497f4b8 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138 but task is already holding lock: ffff80001508ed58 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (depot_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101 tell_cpu_to_push+0x1d8/0x408 kernel/sched/rt.c:2149 pull_rt_task kernel/sched/rt.c:2215 [inline] balance_rt+0x268/0x354 kernel/sched/rt.c:1560 put_prev_task_balance kernel/sched/core.c:5620 [inline] __pick_next_task kernel/sched/core.c:5660 [inline] pick_next_task kernel/sched/core.c:6188 [inline] __schedule+0x714/0x1e38 kernel/sched/core.c:6336 do_task_dead+0xcc/0xd0 kernel/sched/core.c:6390 do_exit+0x14c8/0x2134 kernel/exit.c:923 do_group_exit+0x110/0x268 kernel/exit.c:994 get_signal+0x634/0x1550 kernel/signal.c:2889 do_signal arch/arm64/kernel/signal.c:890 [inline] do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:597 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #2 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0xb4/0x110 kernel/locking/spinlock.c:368 raw_spin_rq_lock_nested+0x2c/0x44 kernel/sched/core.c:475 raw_spin_rq_lock kernel/sched/sched.h:1326 [inline] rq_lock kernel/sched/sched.h:1621 [inline] task_fork_fair+0x7c/0x23c kernel/sched/fair.c:11477 sched_cgroup_fork+0x334/0x3d8 kernel/sched/core.c:4462 copy_process+0x24d4/0x3750 kernel/fork.c:2312 kernel_clone+0x1d8/0xa58 kernel/fork.c:2601 kernel_thread+0x148/0x1bc kernel/fork.c:2653 rest_init+0x2c/0x38c init/main.c:701 arch_call_rest_init+0x14/0x20 init/main.c:889 start_kernel+0x440/0x600 init/main.c:1144 __primary_switched+0xa8/0xb0 arch/arm64/kernel/head.S:468 -> #1 (&p->pi_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 try_to_wake_up+0xb0/0xc2c kernel/sched/core.c:4026 wake_up_process+0x18/0x24 kernel/sched/core.c:4211 __up+0x11c/0x148 kernel/locking/semaphore.c:265 up+0x90/0xb0 kernel/locking/semaphore.c:190 __up_console_sem+0x8c/0x100 kernel/printk/printk.c:256 console_unlock+0x1160/0x1394 kernel/printk/printk.c:2750 do_fb_ioctl+0xc58/0xf9c drivers/video/fbdev/core/fbmem.c:1132 fb_ioctl+0xec/0x134 drivers/video/fbdev/core/fbmem.c:1205 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #0 ((console_sem).lock){-...}-{2:2}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3787 [inline] __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138 __down_trylock_console_sem+0x80/0x144 kernel/printk/printk.c:239 console_trylock+0xb8/0x1f8 kernel/printk/printk.c:2565 console_trylock_spinning+0x1c/0x280 kernel/printk/printk.c:1867 vprintk_emit+0x120/0x218 kernel/printk/printk.c:2267 vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279 vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50 _printk+0xdc/0x128 kernel/printk/printk.c:2289 __warn_printk+0xb4/0x134 kernel/panic.c:710 depot_alloc_stack lib/stackdepot.c:114 [inline] stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101 rto_push_irq_work_func+0x13c/0x340 kernel/sched/rt.c:2187 irq_work_single+0xbc/0x1e4 kernel/irq_work.c:155 flush_smp_call_function_queue+0x510/0x8c4 kernel/smp.c:666 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:902 [inline] ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948 handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:651 [inline] handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:899 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580 tomoyo_update_stat security/tomoyo/common.c:2340 [inline] tomoyo_supervisor+0x2dc/0x115c security/tomoyo/common.c:2079 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission+0x1f4/0x2fc security/tomoyo/file.c:587 tomoyo_check_open_permission+0x264/0x3f4 security/tomoyo/file.c:777 tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311 security_file_open+0x6c/0xb0 security/security.c:1650 do_dentry_open+0x29c/0xed8 fs/open.c:813 vfs_open+0x7c/0x90 fs/open.c:956 do_open fs/namei.c:3538 [inline] path_openat+0x1f28/0x26f0 fs/namei.c:3672 do_filp_open+0x1a8/0x3b4 fs/namei.c:3699 do_sys_openat2+0x128/0x3d8 fs/open.c:1211 do_sys_open fs/open.c:1227 [inline] __do_sys_openat fs/open.c:1243 [inline] __se_sys_openat fs/open.c:1238 [inline] __arm64_sys_openat+0x1f0/0x240 fs/open.c:1238 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Chain exists of: (console_sem).lock --> &rq->__lock --> depot_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(depot_lock); lock(&rq->__lock); lock(depot_lock); lock((console_sem).lock); *** DEADLOCK *** 2 locks held by syz-executor.0/7699: #0: ffff80001500ab38 (tomoyo_ss){....}-{0:0}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:268 #1: ffff80001508ed58 (depot_lock){-.-.}-{2:2}, at: stack_depot_save+0x204/0x4a0 lib/stackdepot.c:307 stack backtrace: CPU: 1 PID: 7699 Comm: syz-executor.0 Not tainted 5.15.109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011 check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3787 [inline] __lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011 lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 down_trylock+0x28/0xd8 kernel/locking/semaphore.c:138 __down_trylock_console_sem+0x80/0x144 kernel/printk/printk.c:239 console_trylock+0xb8/0x1f8 kernel/printk/printk.c:2565 console_trylock_spinning+0x1c/0x280 kernel/printk/printk.c:1867 vprintk_emit+0x120/0x218 kernel/printk/printk.c:2267 vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2279 vprintk+0x218/0x2f0 kernel/printk/printk_safe.c:50 _printk+0xdc/0x128 kernel/printk/printk.c:2289 __warn_printk+0xb4/0x134 kernel/panic.c:710 depot_alloc_stack lib/stackdepot.c:114 [inline] stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101 rto_push_irq_work_func+0x13c/0x340 kernel/sched/rt.c:2187 irq_work_single+0xbc/0x1e4 kernel/irq_work.c:155 flush_smp_call_function_queue+0x510/0x8c4 kernel/smp.c:666 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:902 [inline] ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948 handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:651 [inline] handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:899 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580 tomoyo_update_stat security/tomoyo/common.c:2340 [inline] tomoyo_supervisor+0x2dc/0x115c security/tomoyo/common.c:2079 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission+0x1f4/0x2fc security/tomoyo/file.c:587 tomoyo_check_open_permission+0x264/0x3f4 security/tomoyo/file.c:777 tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311 security_file_open+0x6c/0xb0 security/security.c:1650 do_dentry_open+0x29c/0xed8 fs/open.c:813 vfs_open+0x7c/0x90 fs/open.c:956 do_open fs/namei.c:3538 [inline] path_openat+0x1f28/0x26f0 fs/namei.c:3672 do_filp_open+0x1a8/0x3b4 fs/namei.c:3699 do_sys_openat2+0x128/0x3d8 fs/open.c:1211 do_sys_open fs/open.c:1227 [inline] __do_sys_openat fs/open.c:1243 [inline] __se_sys_openat fs/open.c:1238 [inline] __arm64_sys_openat+0x1f0/0x240 fs/open.c:1238 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Stack depot reached limit capacity WARNING: CPU: 1 PID: 7699 at lib/stackdepot.c:114 stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312 Modules linked in: CPU: 1 PID: 7699 Comm: syz-executor.0 Not tainted 5.15.109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312 lr : depot_alloc_stack lib/stackdepot.c:114 [inline] lr : stack_depot_save+0x490/0x4a0 lib/stackdepot.c:312 sp : ffff800008017a90 x29: ffff800008017aa0 x28: 0000000000000120 x27: 00000000000000c0 x26: 0000000000000000 x25: 00000000000bbdd3 x24: ffff0001b3000000 x23: 0000000038fbbdd3 x22: 0000000000000108 x21: 0000000000000000 x20: 0000000000000021 x19: ffff800008017b00 x18: 0000000000010002 x17: ff8080000833451c x16: ffff8000119409d4 x15: ffff80000833451c x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000000000 x11: ff8080000832bfc4 x10: 0000000000010001 x9 : 13ae05a64c28b900 x8 : 13ae05a64c28b900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080171f8 x4 : ffff8000149af960 x3 : ffff80000854ade0 x2 : 0000000000000001 x1 : 0000000100010001 x0 : 0000000000000022 Call trace: stack_depot_save+0x494/0x4a0 lib/stackdepot.c:312 kasan_save_stack+0x54/0x68 mm/kasan/common.c:40 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 irq_work_queue_on+0xcc/0x224 kernel/irq_work.c:101 rto_push_irq_work_func+0x13c/0x340 kernel/sched/rt.c:2187 irq_work_single+0xbc/0x1e4 kernel/irq_work.c:155 flush_smp_call_function_queue+0x510/0x8c4 kernel/smp.c:666 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:902 [inline] ipi_handler+0x15c/0x7d4 arch/arm64/kernel/smp.c:948 handle_percpu_devid_irq+0x29c/0x7fc kernel/irq/chip.c:933 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:651 [inline] handle_domain_irq+0xec/0x178 kernel/irq/irqdesc.c:706 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:757 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:899 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580 tomoyo_update_stat security/tomoyo/common.c:2340 [inline] tomoyo_supervisor+0x2dc/0x115c security/tomoyo/common.c:2079 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission+0x1f4/0x2fc security/tomoyo/file.c:587 tomoyo_check_open_permission+0x264/0x3f4 security/tomoyo/file.c:777 tomoyo_file_open+0x138/0x1b0 security/tomoyo/tomoyo.c:311 security_file_open+0x6c/0xb0 security/security.c:1650 do_dentry_open+0x29c/0xed8 fs/open.c:813 vfs_open+0x7c/0x90 fs/open.c:956 do_open fs/namei.c:3538 [inline] path_openat+0x1f28/0x26f0 fs/namei.c:3672 do_filp_open+0x1a8/0x3b4 fs/namei.c:3699 do_sys_openat2+0x128/0x3d8 fs/open.c:1211 do_sys_open fs/open.c:1227 [inline] __do_sys_openat fs/open.c:1243 [inline] __se_sys_openat fs/open.c:1238 [inline] __arm64_sys_openat+0x1f0/0x240 fs/open.c:1238 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 2848 hardirqs last enabled at (2847): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline] hardirqs last enabled at (2847): [] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91 hardirqs last disabled at (2848): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (1328): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (1326): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace e3786c4ce23c87f0 ]--- vkms_vblank_simulate: vblank timer overrun