R13: 00000000000008a6 R14: 00000000004ca018 R15: 000000000000000d
CPU: 0 PID: 27606 Comm: syz-executor.5 Not tainted 4.19.97-syzkaller #0
======================================================
WARNING: possible circular locking dependency detected
4.19.97-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/27332 is trying to acquire lock:
000000008b88fb4f (console_owner){-...}, at: console_trylock_spinning kernel/printk/printk.c:1669 [inline]
000000008b88fb4f (console_owner){-...}, at: vprintk_emit+0x3d5/0x6d0 kernel/printk/printk.c:1936

but task is already holding lock:
00000000807958d9 (&(&port->lock)->rlock){-.-.}, at: pty_write+0xff/0x200 drivers/tty/pty.c:120

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&(&port->lock)->rlock){-.-.}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
       tty_port_tty_get+0x22/0x90 drivers/tty/tty_port.c:288
       tty_port_default_wakeup+0x16/0x40 drivers/tty/tty_port.c:47
       tty_port_tty_wakeup+0x57/0x70 drivers/tty/tty_port.c:390
       uart_write_wakeup+0x46/0x70 drivers/tty/serial/serial_core.c:103
       serial8250_tx_chars+0x495/0xaf0 drivers/tty/serial/8250/8250_port.c:1806
       serial8250_handle_irq.part.0+0x261/0x2b0 drivers/tty/serial/8250/8250_port.c:1879
       serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1865 [inline]
       serial8250_default_handle_irq+0xc0/0x150 drivers/tty/serial/8250/8250_port.c:1895
       serial8250_interrupt+0xfc/0x1e0 drivers/tty/serial/8250/8250_core.c:125
       __handle_irq_event_percpu+0x144/0x8f0 kernel/irq/handle.c:149
       handle_irq_event_percpu+0x74/0x160 kernel/irq/handle.c:189
       handle_irq_event+0xa7/0x134 kernel/irq/handle.c:206
       handle_edge_irq+0x25e/0x8d0 kernel/irq/chip.c:797
       generic_handle_irq_desc include/linux/irqdesc.h:155 [inline]
       handle_irq+0x39/0x50 arch/x86/kernel/irq_64.c:87
       do_IRQ+0x99/0x1d0 arch/x86/kernel/irq.c:246
       ret_from_intr+0x0/0x1e
       native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
       arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:556
       default_idle_call+0x36/0x90 kernel/sched/idle.c:93
       cpuidle_idle_call kernel/sched/idle.c:153 [inline]
       do_idle+0x30c/0x4d0 kernel/sched/idle.c:263
       cpu_startup_entry+0xc8/0xe0 kernel/sched/idle.c:369
       start_secondary+0x3e8/0x5b0 arch/x86/kernel/smpboot.c:271
       secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

-> #1 (&port_lock_key){-.-.}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
       serial8250_console_write+0x7ca/0x9f0 drivers/tty/serial/8250/8250_port.c:3247
       univ8250_console_write+0x5f/0x70 drivers/tty/serial/8250/8250_core.c:590
       call_console_drivers kernel/printk/printk.c:1736 [inline]
       console_unlock+0xbdf/0x10d0 kernel/printk/printk.c:2429
       vprintk_emit+0x280/0x6d0 kernel/printk/printk.c:1937
       vprintk_default+0x28/0x30 kernel/printk/printk.c:1979
       vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
       printk+0xba/0xed kernel/printk/printk.c:2012
       register_console+0x77f/0xb90 kernel/printk/printk.c:2745
       univ8250_console_init+0x3e/0x4b drivers/tty/serial/8250/8250_core.c:685
       console_init+0x4f7/0x761 kernel/printk/printk.c:2831
       start_kernel+0x59c/0x8c5 init/main.c:660
       x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
       x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471
       secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

-> #0 (console_owner){-...}:
       lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3903
       console_trylock_spinning kernel/printk/printk.c:1690 [inline]
       vprintk_emit+0x412/0x6d0 kernel/printk/printk.c:1936
       vprintk_default+0x28/0x30 kernel/printk/printk.c:1979
       vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
       printk+0xba/0xed kernel/printk/printk.c:2012
       fail_dump lib/fault-inject.c:44 [inline]
       should_fail+0x6f1/0x85c lib/fault-inject.c:149
       should_fail_alloc_page mm/page_alloc.c:3086 [inline]
       prepare_alloc_pages mm/page_alloc.c:4344 [inline]
       __alloc_pages_nodemask+0x1ee/0x750 mm/page_alloc.c:4391
       __alloc_pages include/linux/gfp.h:496 [inline]
       __alloc_pages_node include/linux/gfp.h:509 [inline]
       kmem_getpages mm/slab.c:1412 [inline]
       cache_grow_begin+0x91/0x8c0 mm/slab.c:2682
       cache_alloc_refill mm/slab.c:3049 [inline]
       ____cache_alloc mm/slab.c:3132 [inline]
       ____cache_alloc mm/slab.c:3115 [inline]
       __do_cache_alloc mm/slab.c:3354 [inline]
       slab_alloc mm/slab.c:3389 [inline]
       __do_kmalloc mm/slab.c:3725 [inline]
       __kmalloc+0x68b/0x750 mm/slab.c:3736
       kmalloc include/linux/slab.h:520 [inline]
       tty_buffer_alloc drivers/tty/tty_buffer.c:170 [inline]
       __tty_buffer_request_room+0x1fb/0x5c0 drivers/tty/tty_buffer.c:268
       tty_insert_flip_string_fixed_flag+0x93/0x1f0 drivers/tty/tty_buffer.c:313
       tty_insert_flip_string include/linux/tty_flip.h:37 [inline]
       pty_write+0x133/0x200 drivers/tty/pty.c:122
       n_tty_write+0xafa/0x1140 drivers/tty/n_tty.c:2354
       do_tty_write drivers/tty/tty_io.c:960 [inline]
       tty_write+0x458/0x7a0 drivers/tty/tty_io.c:1044
       __vfs_write+0x114/0x810 fs/read_write.c:485
       __kernel_write+0x110/0x390 fs/read_write.c:506
       write_pipe_buf+0x15d/0x1f0 fs/splice.c:798
       splice_from_pipe_feed fs/splice.c:503 [inline]
       __splice_from_pipe+0x391/0x7d0 fs/splice.c:627
       splice_from_pipe+0x108/0x170 fs/splice.c:662
       default_file_splice_write+0x3c/0x90 fs/splice.c:810
       do_splice_from fs/splice.c:852 [inline]
       direct_splice_actor+0x123/0x190 fs/splice.c:1025
       splice_direct_to_actor+0x367/0x970 fs/splice.c:980
       do_splice_direct+0x1da/0x2a0 fs/splice.c:1068
       do_sendfile+0x597/0xce0 fs/read_write.c:1447
       __do_sys_sendfile64 fs/read_write.c:1508 [inline]
       __se_sys_sendfile64 fs/read_write.c:1494 [inline]
       __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1494
       do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  console_owner --> &port_lock_key --> &(&port->lock)->rlock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&(&port->lock)->rlock);
                               lock(&port_lock_key);
                               lock(&(&port->lock)->rlock);
  lock(console_owner);

 *** DEADLOCK ***

5 locks held by syz-executor.0/27332:
 #0: 00000000c2159ff9 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362
 #1: 0000000091e0c856 (&tty->atomic_write_lock){+.+.}, at: tty_write_lock+0x23/0x90 drivers/tty/tty_io.c:886
 #2: 00000000ce2549f7 (&tty->termios_rwsem){++++}, at: n_tty_write+0x1ab/0x1140 drivers/tty/n_tty.c:2314
 #3: 0000000070ba2769 (&ldata->output_lock){+.+.}, at: n_tty_write+0xabb/0x1140 drivers/tty/n_tty.c:2353
 #4: 00000000807958d9 (&(&port->lock)->rlock){-.-.}, at: pty_write+0xff/0x200 drivers/tty/pty.c:120

stack backtrace:
CPU: 1 PID: 27332 Comm: syz-executor.0 Not tainted 4.19.97-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1221
 check_prev_add kernel/locking/lockdep.c:1861 [inline]
 check_prevs_add kernel/locking/lockdep.c:1974 [inline]
 validate_chain kernel/locking/lockdep.c:2415 [inline]
 __lock_acquire+0x2e19/0x49c0 kernel/locking/lockdep.c:3411
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3903
 console_trylock_spinning kernel/printk/printk.c:1690 [inline]
 vprintk_emit+0x412/0x6d0 kernel/printk/printk.c:1936
 vprintk_default+0x28/0x30 kernel/printk/printk.c:1979
 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
 printk+0xba/0xed kernel/printk/printk.c:2012
 fail_dump lib/fault-inject.c:44 [inline]
 should_fail+0x6f1/0x85c lib/fault-inject.c:149
 should_fail_alloc_page mm/page_alloc.c:3086 [inline]
 prepare_alloc_pages mm/page_alloc.c:4344 [inline]
 __alloc_pages_nodemask+0x1ee/0x750 mm/page_alloc.c:4391
 __alloc_pages include/linux/gfp.h:496 [inline]
 __alloc_pages_node include/linux/gfp.h:509 [inline]
 kmem_getpages mm/slab.c:1412 [inline]
 cache_grow_begin+0x91/0x8c0 mm/slab.c:2682
 cache_alloc_refill mm/slab.c:3049 [inline]
 ____cache_alloc mm/slab.c:3132 [inline]
 ____cache_alloc mm/slab.c:3115 [inline]
 __do_cache_alloc mm/slab.c:3354 [inline]
 slab_alloc mm/slab.c:3389 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x68b/0x750 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 tty_buffer_alloc drivers/tty/tty_buffer.c:170 [inline]
 __tty_buffer_request_room+0x1fb/0x5c0 drivers/tty/tty_buffer.c:268
 tty_insert_flip_string_fixed_flag+0x93/0x1f0 drivers/tty/tty_buffer.c:313
 tty_insert_flip_string include/linux/tty_flip.h:37 [inline]
 pty_write+0x133/0x200 drivers/tty/pty.c:122
 n_tty_write+0xafa/0x1140 drivers/tty/n_tty.c:2354
 do_tty_write drivers/tty/tty_io.c:960 [inline]
 tty_write+0x458/0x7a0 drivers/tty/tty_io.c:1044
 __vfs_write+0x114/0x810 fs/read_write.c:485
 __kernel_write+0x110/0x390 fs/read_write.c:506
 write_pipe_buf+0x15d/0x1f0 fs/splice.c:798
 splice_from_pipe_feed fs/splice.c:503 [inline]
 __splice_from_pipe+0x391/0x7d0 fs/splice.c:627
 splice_from_pipe+0x108/0x170 fs/splice.c:662
 default_file_splice_write+0x3c/0x90 fs/splice.c:810
 do_splice_from fs/splice.c:852 [inline]
 direct_splice_actor+0x123/0x190 fs/splice.c:1025
 splice_direct_to_actor+0x367/0x970 fs/splice.c:980
 do_splice_direct+0x1da/0x2a0 fs/splice.c:1068
 do_sendfile+0x597/0xce0 fs/read_write.c:1447
 __do_sys_sendfile64 fs/read_write.c:1508 [inline]
 __se_sys_sendfile64 fs/read_write.c:1494 [inline]
 __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1494
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2fc0a26c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f2fc0a276d4 RCX: 000000000045b349
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000040801001 R11: 0000000000000246 R12: 0000000000000005
R13: 00000000000008a6 R14: 00000000004ca018 R15: 000000000000000d
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x1b lib/fault-inject.c:149
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
 should_fail_alloc_page mm/page_alloc.c:3086 [inline]
 prepare_alloc_pages mm/page_alloc.c:4344 [inline]
 __alloc_pages_nodemask+0x1ee/0x750 mm/page_alloc.c:4391
 __alloc_pages include/linux/gfp.h:496 [inline]
 __alloc_pages_node include/linux/gfp.h:509 [inline]
 kmem_getpages mm/slab.c:1412 [inline]
 cache_grow_begin+0x91/0x8c0 mm/slab.c:2682
 ____cache_alloc_node+0x17c/0x1e0 mm/slab.c:3285
 __do_cache_alloc mm/slab.c:3361 [inline]
 slab_alloc mm/slab.c:3389 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x21a/0x750 mm/slab.c:3736
 kmalloc_array include/linux/slab.h:637 [inline]
 rw_copy_check_uvector+0x28c/0x330 fs/read_write.c:782
 import_iovec+0xc2/0x3e0 lib/iov_iter.c:1541
 vfs_readv+0xc6/0x160 fs/read_write.c:985
 do_readv+0x15e/0x370 fs/read_write.c:1020
 __do_sys_readv fs/read_write.c:1107 [inline]
 __se_sys_readv fs/read_write.c:1104 [inline]
 __x64_sys_readv+0x75/0xb0 fs/read_write.c:1104
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8e7ffd7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00007f8e7ffd86d4 RCX: 000000000045b349
RDX: 00000000000002dc RSI: 0000000020000100 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 000000000000085c R14: 00000000004c9a5a R15: 0000000000000002
CPU: 1 PID: 27819 Comm: syz-executor.0 Not tainted 4.19.97-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x1b lib/fault-inject.c:149
 __should_failslab+0x121/0x190 mm/failslab.c:32
 should_failslab+0x9/0x14 mm/slab_common.c:1557
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x71/0x750 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 tty_buffer_alloc drivers/tty/tty_buffer.c:170 [inline]
 __tty_buffer_request_room+0x1fb/0x5c0 drivers/tty/tty_buffer.c:268
 tty_insert_flip_string_fixed_flag+0x93/0x1f0 drivers/tty/tty_buffer.c:313
 tty_insert_flip_string include/linux/tty_flip.h:37 [inline]
 pty_write+0x133/0x200 drivers/tty/pty.c:122
 n_tty_write+0xafa/0x1140 drivers/tty/n_tty.c:2354
 do_tty_write drivers/tty/tty_io.c:960 [inline]
 tty_write+0x458/0x7a0 drivers/tty/tty_io.c:1044
 __vfs_write+0x114/0x810 fs/read_write.c:485
 __kernel_write+0x110/0x390 fs/read_write.c:506
 write_pipe_buf+0x15d/0x1f0 fs/splice.c:798
 splice_from_pipe_feed fs/splice.c:503 [inline]
 __splice_from_pipe+0x391/0x7d0 fs/splice.c:627
 splice_from_pipe+0x108/0x170 fs/splice.c:662
 default_file_splice_write+0x3c/0x90 fs/splice.c:810
 do_splice_from fs/splice.c:852 [inline]
 direct_splice_actor+0x123/0x190 fs/splice.c:1025
 splice_direct_to_actor+0x367/0x970 fs/splice.c:980
 do_splice_direct+0x1da/0x2a0 fs/splice.c:1068
 do_sendfile+0x597/0xce0 fs/read_write.c:1447
 __do_sys_sendfile64 fs/read_write.c:1508 [inline]
 __se_sys_sendfile64 fs/read_write.c:1494 [inline]
 __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1494
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b349
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2fc0a26c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f2fc0a276d4 RCX: 000000000045b349
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000040801001 R11: 0000000000000246 R12: 0000000000000005
R13: 00000000000008a6 R14: 00000000004ca018 R15: 000000000000000e
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pig=27995 comm=syz-executor.3
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
nla_parse: 9 callbacks suppressed
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=1716 comm=syz-executor.3
Enabling of bearer <udp:syz0> rejected, failed to enable media
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=34520 sclass=netlink_route_socket pig=4652 comm=syz-executor.3
nla_parse: 26 callbacks suppressed
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.