====================================================== WARNING: possible circular locking dependency detected 5.9.0-rc8-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/10363 is trying to acquire lock: ffffffff8a05ac60 (console_owner){..-.}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1760 [inline] ffffffff8a05ac60 (console_owner){..-.}-{0:0}, at: vprintk_emit+0x482/0x740 kernel/printk/printk.c:2028 but task is already holding lock: ffff88801e627158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf6/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x94/0xce kernel/locking/spinlock.c:159 tty_port_tty_get+0x1f/0x100 drivers/tty/tty_port.c:288 tty_port_default_wakeup+0x11/0x40 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x487/0xa80 drivers/tty/serial/8250/8250_port.c:1832 serial8250_handle_irq.part.0+0x328/0x3d0 drivers/tty/serial/8250/8250_port.c:1919 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1892 [inline] serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1935 serial8250_interrupt+0xe6/0x190 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x223/0xaa0 kernel/irq/handle.c:156 handle_irq_event_percpu kernel/irq/handle.c:196 [inline] handle_irq_event+0x102/0x285 kernel/irq/handle.c:213 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:819 asm_call_irq_on_stack+0xf/0x20 __run_irq_on_irqstack arch/x86/include/asm/irq_stack.h:48 [inline] run_irq_on_irqstack_cond arch/x86/include/asm/irq_stack.h:101 [inline] handle_irq arch/x86/kernel/irq.c:230 [inline] __common_interrupt arch/x86/kernel/irq.c:249 [inline] common_interrupt+0x115/0x1f0 arch/x86/kernel/irq.c:239 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:572 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 arch_safe_halt arch/x86/include/asm/paravirt.h:150 [inline] default_idle+0x2f/0x50 arch/x86/kernel/process.c:688 default_idle_call+0x95/0xd0 kernel/sched/idle.c:98 cpuidle_idle_call kernel/sched/idle.c:168 [inline] do_idle+0x4a9/0x730 kernel/sched/idle.c:273 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:369 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x94/0xce kernel/locking/spinlock.c:159 serial8250_console_write+0x200/0xb30 drivers/tty/serial/8250/8250_port.c:3289 call_console_drivers kernel/printk/printk.c:1824 [inline] console_unlock+0xadb/0xe60 kernel/printk/printk.c:2501 vprintk_emit+0x2ff/0x740 kernel/printk/printk.c:2029 vprintk_func+0x8d/0x1d4 kernel/printk/printk_safe.c:393 printk+0xba/0xed kernel/printk/printk.c:2078 register_console kernel/printk/printk.c:2854 [inline] register_console+0x55f/0x830 kernel/printk/printk.c:2733 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:690 console_init+0x421/0x619 kernel/printk/printk.c:2954 start_kernel+0x31c/0x4b1 init/main.c:976 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 -> #0 (console_owner){..-.}-{0:0}: check_prev_add kernel/locking/lockdep.c:2496 [inline] check_prevs_add kernel/locking/lockdep.c:2601 [inline] validate_chain kernel/locking/lockdep.c:3218 [inline] __lock_acquire+0x2a96/0x5780 kernel/locking/lockdep.c:4441 lock_acquire+0x1f3/0xaf0 kernel/locking/lockdep.c:5029 console_trylock_spinning kernel/printk/printk.c:1781 [inline] vprintk_emit+0x4bf/0x740 kernel/printk/printk.c:2028 vprintk_func+0x8d/0x1d4 kernel/printk/printk_safe.c:393 printk+0xba/0xed kernel/printk/printk.c:2078 fail_dump lib/fault-inject.c:45 [inline] should_fail+0x472/0x5a0 lib/fault-inject.c:146 should_failslab+0x5/0xf mm/slab_common.c:1194 slab_pre_alloc_hook.constprop.0+0x3d/0x1f0 mm/slab.h:500 slab_alloc mm/slab.c:3302 [inline] __do_kmalloc mm/slab.c:3657 [inline] __kmalloc+0x6f/0x360 mm/slab.c:3668 kmalloc include/linux/slab.h:559 [inline] tty_buffer_alloc+0x23f/0x2a0 drivers/tty/tty_buffer.c:175 __tty_buffer_request_room+0x156/0x2a0 drivers/tty/tty_buffer.c:273 tty_insert_flip_string_fixed_flag+0x93/0x250 drivers/tty/tty_buffer.c:318 tty_insert_flip_string include/linux/tty_flip.h:37 [inline] pty_write+0x128/0x1f0 drivers/tty/pty.c:122 tty_put_char+0x122/0x150 drivers/tty/tty_io.c:3032 __process_echoes+0x577/0x9f0 drivers/tty/n_tty.c:728 flush_echoes drivers/tty/n_tty.c:829 [inline] __receive_buf drivers/tty/n_tty.c:1648 [inline] n_tty_receive_buf_common+0xb88/0x2bc0 drivers/tty/n_tty.c:1742 tiocsti drivers/tty/tty_io.c:2196 [inline] tty_ioctl+0xf2e/0x15f0 drivers/tty/tty_io.c:2572 tty_compat_ioctl+0x295/0x410 drivers/tty/tty_io.c:2818 __do_compat_sys_ioctl+0x1d3/0x230 fs/ioctl.c:842 do_syscall_32_irqs_on arch/x86/entry/common.c:78 [inline] __do_fast_syscall_32+0x60/0x90 arch/x86/entry/common.c:137 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:160 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &port->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->lock); lock(&port_lock_key); lock(&port->lock); lock(console_owner); *** DEADLOCK *** 4 locks held by syz-executor.0/10363: #0: ffff88801e7f6098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffff88801e7f62e8 (&o_tty->termios_rwsem/1){++++}-{3:3}, at: isig+0x37d/0x430 drivers/tty/n_tty.c:1152 #2: ffffc90007d9b378 (&ldata->output_lock){+.+.}-{3:3}, at: flush_echoes drivers/tty/n_tty.c:827 [inline] #2: ffffc90007d9b378 (&ldata->output_lock){+.+.}-{3:3}, at: __receive_buf drivers/tty/n_tty.c:1648 [inline] #2: ffffc90007d9b378 (&ldata->output_lock){+.+.}-{3:3}, at: n_tty_receive_buf_common+0xb49/0x2bc0 drivers/tty/n_tty.c:1742 #3: ffff88801e627158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf6/0x1f0 drivers/tty/pty.c:120 stack backtrace: CPU: 0 PID: 10363 Comm: syz-executor.0 Not tainted 5.9.0-rc8-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 check_noncircular+0x324/0x3e0 kernel/locking/lockdep.c:1827 check_prev_add kernel/locking/lockdep.c:2496 [inline] check_prevs_add kernel/locking/lockdep.c:2601 [inline] validate_chain kernel/locking/lockdep.c:3218 [inline] __lock_acquire+0x2a96/0x5780 kernel/locking/lockdep.c:4441 lock_acquire+0x1f3/0xaf0 kernel/locking/lockdep.c:5029 console_trylock_spinning kernel/printk/printk.c:1781 [inline] vprintk_emit+0x4bf/0x740 kernel/printk/printk.c:2028 vprintk_func+0x8d/0x1d4 kernel/printk/printk_safe.c:393 printk+0xba/0xed kernel/printk/printk.c:2078 fail_dump lib/fault-inject.c:45 [inline] should_fail+0x472/0x5a0 lib/fault-inject.c:146 should_failslab+0x5/0xf mm/slab_common.c:1194 slab_pre_alloc_hook.constprop.0+0x3d/0x1f0 mm/slab.h:500 slab_alloc mm/slab.c:3302 [inline] __do_kmalloc mm/slab.c:3657 [inline] __kmalloc+0x6f/0x360 mm/slab.c:3668 kmalloc include/linux/slab.h:559 [inline] tty_buffer_alloc+0x23f/0x2a0 drivers/tty/tty_buffer.c:175 __tty_buffer_request_room+0x156/0x2a0 drivers/tty/tty_buffer.c:273 tty_insert_flip_string_fixed_flag+0x93/0x250 drivers/tty/tty_buffer.c:318 tty_insert_flip_string include/linux/tty_flip.h:37 [inline] pty_write+0x128/0x1f0 drivers/tty/pty.c:122 tty_put_char+0x122/0x150 drivers/tty/tty_io.c:3032 __process_echoes+0x577/0x9f0 drivers/tty/n_tty.c:728 flush_echoes drivers/tty/n_tty.c:829 [inline] __receive_buf drivers/tty/n_tty.c:1648 [inline] n_tty_receive_buf_common+0xb88/0x2bc0 drivers/tty/n_tty.c:1742 tiocsti drivers/tty/tty_io.c:2196 [inline] tty_ioctl+0xf2e/0x15f0 drivers/tty/tty_io.c:2572 tty_compat_ioctl+0x295/0x410 drivers/tty/tty_io.c:2818 __do_compat_sys_ioctl+0x1d3/0x230 fs/ioctl.c:842 do_syscall_32_irqs_on arch/x86/entry/common.c:78 [inline] __do_fast_syscall_32+0x60/0x90 arch/x86/entry/common.c:137 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:160 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fec549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f55e60bc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005412 RDX: 0000000020000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000