================================ WARNING: inconsistent lock state 5.5.0-rc1-syzkaller #0 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-R} usage. udevd/8960 [HC1[1]:SC0[0]:HE0:SE1] takes: ffffffff8a128718 (disc_data_lock){+-..}, at: sp_get.isra.0+0x1d/0xf0 drivers/net/ppp/ppp_synctty.c:138 {HARDIRQ-ON-W} state was registered at: lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline] _raw_write_lock_bh+0x33/0x50 kernel/locking/spinlock.c:319 sixpack_close+0x1d/0x250 drivers/net/hamradio/6pack.c:657 tty_ldisc_close.isra.0+0x119/0x1a0 drivers/tty/tty_ldisc.c:489 tty_set_ldisc+0x230/0x6b0 drivers/tty/tty_ldisc.c:585 tiocsetd drivers/tty/tty_io.c:2337 [inline] tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2597 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 10726 hardirqs last enabled at (10725): [] seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline] hardirqs last enabled at (10725): [] read_seqcount_begin include/linux/seqlock.h:164 [inline] hardirqs last enabled at (10725): [] read_seqbegin include/linux/seqlock.h:433 [inline] hardirqs last enabled at (10725): [] zone_span_seqbegin include/linux/memory_hotplug.h:75 [inline] hardirqs last enabled at (10725): [] page_outside_zone_boundaries mm/page_alloc.c:569 [inline] hardirqs last enabled at (10725): [] bad_range+0xea/0x420 mm/page_alloc.c:598 hardirqs last disabled at (10726): [] trace_hardirqs_off_thunk+0x1a/0x1c arch/x86/entry/thunk_64.S:42 softirqs last enabled at (10602): [] memcpy include/linux/string.h:380 [inline] softirqs last enabled at (10602): [] fpu__copy+0x17e/0x8c0 arch/x86/kernel/fpu/core.c:195 softirqs last disabled at (10600): [] fpu__copy+0xa7/0x8c0 arch/x86/kernel/fpu/core.c:183 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(disc_data_lock); lock(disc_data_lock); *** DEADLOCK *** 7 locks held by udevd/8960: #0: ffffffff89a14e90 (dup_mmap_sem.rw_sem){.+.+}, at: dup_mmap kernel/fork.c:490 [inline] #0: ffffffff89a14e90 (dup_mmap_sem.rw_sem){.+.+}, at: dup_mm+0x104/0x1430 kernel/fork.c:1360 #1: ffff888095e6cd18 (&mm->mmap_sem#2){++++}, at: dup_mmap kernel/fork.c:491 [inline] #1: ffff888095e6cd18 (&mm->mmap_sem#2){++++}, at: dup_mm+0x120/0x1430 kernel/fork.c:1360 #2: ffff88808dd1d4d8 (&mm->mmap_sem/1){+.+.}, at: dup_mmap kernel/fork.c:500 [inline] #2: ffff88808dd1d4d8 (&mm->mmap_sem/1){+.+.}, at: dup_mm+0x165/0x1430 kernel/fork.c:1360 #3: ffffffff89a41e40 (fs_reclaim){+.+.}, at: fs_reclaim_acquire.part.0+0x0/0x30 include/linux/uaccess.h:173 #4: ffff8880a73edf30 (&(&i->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:338 [inline] #4: ffff8880a73edf30 (&(&i->lock)->rlock){-.-.}, at: serial8250_interrupt+0x2d/0x1a0 drivers/tty/serial/8250/8250_core.c:116 #5: ffffffff8c104048 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x24/0x330 drivers/tty/serial/8250/8250_port.c:1823 #6: ffff88809510c090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref+0x22/0x90 drivers/tty/tty_ldisc.c:288 stack backtrace: CPU: 1 PID: 8960 Comm: udevd Not tainted 5.5.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_usage_bug.cold+0x327/0x378 kernel/locking/lockdep.c:3101 valid_state kernel/locking/lockdep.c:3112 [inline] mark_lock_irq kernel/locking/lockdep.c:3309 [inline] mark_lock+0xbb4/0x1220 kernel/locking/lockdep.c:3666 mark_usage kernel/locking/lockdep.c:3554 [inline] __lock_acquire+0x1e55/0x4a00 kernel/locking/lockdep.c:3909 lock_acquire+0x190/0x410 kernel/locking/lockdep.c:4485 __raw_read_lock include/linux/rwlock_api_smp.h:149 [inline] _raw_read_lock+0x32/0x50 kernel/locking/spinlock.c:223 sp_get.isra.0+0x1d/0xf0 drivers/net/ppp/ppp_synctty.c:138 sixpack_write_wakeup+0x25/0x340 drivers/net/hamradio/6pack.c:402 tty_wakeup+0xe9/0x120 drivers/tty/tty_io.c:536 tty_port_default_wakeup+0x2b/0x40 drivers/tty/tty_port.c:50 tty_port_tty_wakeup+0x57/0x70 drivers/tty/tty_port.c:387 uart_write_wakeup+0x46/0x70 drivers/tty/serial/serial_core.c:104 serial8250_tx_chars+0x495/0xaf0 drivers/tty/serial/8250/8250_port.c:1761 serial8250_handle_irq.part.0+0x2a2/0x330 drivers/tty/serial/8250/8250_port.c:1834 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1820 [inline] serial8250_default_handle_irq+0xc0/0x150 drivers/tty/serial/8250/8250_port.c:1850 serial8250_interrupt+0xf1/0x1a0 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x15d/0x970 kernel/irq/handle.c:149 handle_irq_event_percpu+0x74/0x160 kernel/irq/handle.c:189 handle_irq_event+0xa7/0x134 kernel/irq/handle.c:206 handle_edge_irq+0x25e/0x8d0 kernel/irq/chip.c:830 generic_handle_irq_desc include/linux/irqdesc.h:156 [inline] do_IRQ+0xde/0x280 arch/x86/kernel/irq.c:250 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:607 RIP: 0010:lock_release+0x33/0x960 kernel/locking/lockdep.c:4493 Code: df 55 48 89 e5 41 57 41 56 4c 8d 75 d8 41 55 49 89 f5 41 54 49 89 fc 53 48 8d 9d 58 ff ff ff 48 c1 eb 03 48 81 ec a8 00 00 00 <48> c7 85 58 ff ff ff b3 8a b5 41 48 c7 85 60 ff ff ff 48 dc 3e 89 RSP: 0018:ffffc90001cb7690 EFLAGS: 00000286 ORIG_RAX: ffffffffffffffd7 RAX: 0000000000000001 RBX: 1ffff92000396ed7 RCX: ffffffff815ac222 RDX: dffffc0000000000 RSI: ffffffff81a9148f RDI: ffffffff89a41e40 RBP: ffffc90001cb7760 R08: 0000000000002c5e R09: fffffbfff1659da7 R10: ffff8880a88e6910 R11: ffff8880a88e6000 R12: ffffffff89a41e40 R13: ffffffff81a9148f R14: ffffc90001cb7738 R15: 0000000000000cc0 __fs_reclaim_release mm/page_alloc.c:4089 [inline] fs_reclaim_release mm/page_alloc.c:4102 [inline] fs_reclaim_release+0x22/0x30 mm/page_alloc.c:4099 slab_pre_alloc_hook mm/slab.h:563 [inline] slab_alloc mm/slab.c:3306 [inline] kmem_cache_alloc+0x30/0x710 mm/slab.c:3484 ptlock_alloc mm/memory.c:4739 [inline] ptlock_init include/linux/mm.h:1915 [inline] pgtable_pmd_page_ctor include/linux/mm.h:2001 [inline] pmd_alloc_one arch/x86/include/asm/pgalloc.h:99 [inline] __pmd_alloc+0xc9/0x460 mm/memory.c:4193 pmd_alloc include/linux/mm.h:1865 [inline] copy_pmd_range mm/memory.c:872 [inline] copy_pud_range mm/memory.c:926 [inline] copy_p4d_range mm/memory.c:948 [inline] copy_page_range+0x184e/0x20b0 mm/memory.c:1010 dup_mmap kernel/fork.c:604 [inline] dup_mm+0xa67/0x1430 kernel/fork.c:1360 copy_mm kernel/fork.c:1416 [inline] copy_process+0x2ad6/0x7230 kernel/fork.c:2072 _do_fork+0x146/0x1090 kernel/fork.c:2421 __do_sys_clone kernel/fork.c:2576 [inline] __se_sys_clone kernel/fork.c:2557 [inline] __x64_sys_clone+0x19a/0x260 kernel/fork.c:2557 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fe919c1cf46 Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81 c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00 RSP: 002b:00007fffdc9036d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007fffdc9036d0 RCX: 00007fe919c1cf46 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00007fffdc903730 R08: 0000000000002300 R09: 0000000000002300 R10: 00007fe91a539a70 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffdc9036f0 R14: 0000000000000000 R15: 0000000000d16540