tmpfs: No value for mount option 'ÿÿÿÿ' (syz-executor.0,8785,0):ocfs2_parse_options:1484 ERROR: Unrecognized mount option "Ùa¹‘+ãù-¸ÍLò' ‰¢Q¥$&àÛ1ëdCDáê ÚE" or missing value ttyprintk ttyprintk: tty_port_close_start: tty->count = 1 port count = 6 ====================================================== WARNING: possible circular locking dependency detected 4.14.231-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.3/8810 is trying to acquire lock: (console_owner){-.-.}, at: [] console_trylock_spinning kernel/printk/printk.c:1658 [inline] (console_owner){-.-.}, at: [] vprintk_emit+0x32a/0x620 kernel/printk/printk.c:1922 but task is already holding lock: (&(&port->lock)->rlock){-.-.}, at: [] tty_port_close_start.part.0+0x28/0x4c0 drivers/tty/tty_port.c:573 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&(&port->lock)->rlock){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 tty_port_tty_get+0x1d/0x80 drivers/tty/tty_port.c:288 tty_port_default_wakeup+0x11/0x40 drivers/tty/tty_port.c:46 serial8250_tx_chars+0x3fe/0xbf0 drivers/tty/serial/8250/8250_port.c:1810 serial8250_handle_irq.part.0+0x28d/0x330 drivers/tty/serial/8250/8250_port.c:1897 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1870 [inline] serial8250_default_handle_irq+0x8a/0x1f0 drivers/tty/serial/8250/8250_port.c:1913 serial8250_interrupt+0xf3/0x210 drivers/tty/serial/8250/8250_core.c:129 __handle_irq_event_percpu+0xee/0x7f0 kernel/irq/handle.c:147 handle_irq_event_percpu kernel/irq/handle.c:187 [inline] handle_irq_event+0xf0/0x250 kernel/irq/handle.c:204 handle_edge_irq+0x224/0xc40 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1d0 arch/x86/kernel/irq.c:230 ret_from_intr+0x0/0x1e native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x47/0x370 arch/x86/kernel/process.c:558 cpuidle_idle_call kernel/sched/idle.c:156 [inline] do_idle+0x250/0x3c0 kernel/sched/idle.c:246 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:351 start_secondary+0x4db/0x670 arch/x86/kernel/smpboot.c:272 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 -> #1 (&port_lock_key){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 serial8250_console_write+0x7a7/0x9d0 drivers/tty/serial/8250/8250_port.c:3253 call_console_drivers kernel/printk/printk.c:1725 [inline] console_unlock+0x99d/0xf20 kernel/printk/printk.c:2400 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1923 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1996 register_console+0x6f4/0xad0 kernel/printk/printk.c:2719 univ8250_console_init+0x2f/0x3a drivers/tty/serial/8250/8250_core.c:691 console_init+0x46/0x53 kernel/printk/printk.c:2800 start_kernel+0x52e/0x770 init/main.c:634 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 -> #0 (console_owner){-.-.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_trylock_spinning kernel/printk/printk.c:1679 [inline] vprintk_emit+0x367/0x620 kernel/printk/printk.c:1922 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1996 tty_port_close_start.part.0+0x46c/0x4c0 drivers/tty/tty_port.c:575 tty_port_close_start drivers/tty/tty_port.c:647 [inline] tty_port_close+0x3b/0x130 drivers/tty/tty_port.c:640 tty_release+0x40b/0x10d0 drivers/tty/tty_io.c:1670 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &(&port->lock)->rlock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&port->lock)->rlock); lock(&port_lock_key); lock(&(&port->lock)->rlock); lock(console_owner); *** DEADLOCK *** 2 locks held by syz-executor.3/8810: #0: (&tty->legacy_mutex){+.+.}, at: [] tty_lock+0x5f/0x70 drivers/tty/tty_mutex.c:19 #1: (&(&port->lock)->rlock){-.-.}, at: [] tty_port_close_start.part.0+0x28/0x4c0 drivers/tty/tty_port.c:573 stack backtrace: CPU: 1 PID: 8810 Comm: syz-executor.3 Not tainted 4.14.231-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_trylock_spinning kernel/printk/printk.c:1679 [inline] vprintk_emit+0x367/0x620 kernel/printk/printk.c:1922 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1996 tty_port_close_start.part.0+0x46c/0x4c0 drivers/tty/tty_port.c:575 tty_port_close_start drivers/tty/tty_port.c:647 [inline] tty_port_close+0x3b/0x130 drivers/tty/tty_port.c:640 tty_release+0x40b/0x10d0 drivers/tty/tty_io.c:1670 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4665f9 RSP: 002b:00007fb776e37188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffea RBX: 000000000056bf60 RCX: 00000000004665f9 RDX: 0000000000084000 RSI: 00000000200000c0 RDI: ffffffffffffff9c RBP: 00000000004bfbb9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffd6feb940f R14: 00007fb776e37300 R15: 0000000000022000 (syz-executor.0,8785,0):ocfs2_fill_super:1217 ERROR: status = -22 tmpfs: No value for mount option 'ÿÿÿÿ' print_req_error: I/O error, dev loop5, sector 0 (syz-executor.0,8868,1):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,8868,1):ocfs2_fill_super:1217 ERROR: status = -22 (syz-executor.0,8868,1):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,8868,1):ocfs2_fill_super:1217 ERROR: status = -22 input: syz0 as /devices/virtual/input/input34 EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue input: syz0 as /devices/virtual/input/input36 EXT4-fs error (device loop1): ext4_empty_dir:2742: inode #12: comm syz-executor.1: Directory hole found for htree leaf block EXT4-fs error (device loop1): ext4_free_inode:353: comm syz-executor.1: bit already cleared for inode 12 input: syz0 as /devices/virtual/input/input37 input: syz0 as /devices/virtual/input/input38 input: syz0 as /devices/virtual/input/input39 (syz-executor.0,9025,1):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,9025,1):ocfs2_fill_super:1217 ERROR: status = -22 input: syz0 as /devices/virtual/input/input40 input: syz0 as /devices/virtual/input/input41 EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue (syz-executor.0,9025,1):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,9025,1):ocfs2_fill_super:1217 ERROR: status = -22 EXT4-fs error (device loop1): ext4_empty_dir:2742: inode #12: comm syz-executor.1: Directory hole found for htree leaf block EXT4-fs error (device loop1): ext4_free_inode:353: comm syz-executor.1: bit already cleared for inode 12 input: syz0 as /devices/virtual/input/input42 input: syz0 as /devices/virtual/input/input43 EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue cannot load conntrack support for proto=2 input: syz0 as /devices/virtual/input/input44 EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs error (device loop1): ext4_empty_dir:2742: inode #12: comm syz-executor.1: Directory hole found for htree leaf block EXT4-fs error (device loop1): ext4_free_inode:353: comm syz-executor.1: bit already cleared for inode 12 EXT4-fs error (device loop2): ext4_empty_dir:2742: inode #12: comm syz-executor.2: Directory hole found for htree leaf block EXT4-fs error (device loop2): ext4_free_inode:353: comm syz-executor.2: bit already cleared for inode 12 IPVS: Scheduler module ip_vs_sip not found (syz-executor.0,9177,0):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,9177,0):ocfs2_fill_super:1217 ERROR: status = -22 EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue IPVS: Scheduler module ip_vs_sip not found EXT4-fs error (device loop1): ext4_empty_dir:2742: inode #12: comm syz-executor.1: Directory hole found for htree leaf block EXT4-fs error (device loop1): ext4_free_inode:353: comm syz-executor.1: bit already cleared for inode 12 EXT4-fs error (device loop2): ext4_empty_dir:2742: inode #12: comm syz-executor.2: Directory hole found for htree leaf block EXT4-fs error (device loop2): ext4_free_inode:353: comm syz-executor.2: bit already cleared for inode 12 (syz-executor.0,9229,0):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options cannot load conntrack support for proto=2 (syz-executor.0,9229,0):ocfs2_fill_super:1217 ERROR: status = -22 EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue cannot load conntrack support for proto=2 (syz-executor.0,9265,0):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,9265,0):ocfs2_fill_super:1217 ERROR: status = -22 EXT4-fs error (device loop2): ext4_empty_dir:2742: inode #12: comm syz-executor.2: Directory hole found for htree leaf block EXT4-fs error (device loop2): ext4_free_inode:353: comm syz-executor.2: bit already cleared for inode 12 (syz-executor.0,9272,1):ocfs2_parse_options:1484 ERROR: Unrecognized mount option "ó" or missing value (syz-executor.0,9272,1):ocfs2_fill_super:1217 ERROR: status = -22 (syz-executor.0,9279,1):ocfs2_parse_options:1484 ERROR: Unrecognized mount option "ó" or missing value (syz-executor.0,9279,1):ocfs2_fill_super:1217 ERROR: status = -22 cannot load conntrack support for proto=2 (syz-executor.0,9312,1):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options (syz-executor.0,9312,1):ocfs2_fill_super:1217 ERROR: status = -22 cannot load conntrack support for proto=2 (syz-executor.0,9312,1):ocfs2_parse_options:1498 ERROR: Invalid heartbeat mount options divide error: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 9334 Comm: syz-executor.3 Not tainted 4.14.231-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88804fc10680 task.stack: ffff88805f130000 RIP: 0010:fbcon_init+0xcb4/0x1cc0 drivers/video/fbdev/core/fbcon.c:1065 RSP: 0018:ffff88805f1377e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888238fe17c0 RCX: ffffc90008d2e000 RDX: 0000000000000000 RSI: ffff88805876f9b4 RDI: ffff888238fe1978 RBP: ffff88805876f600 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88804fc10680 R12: ffff8880b0a58580 R13: 0000000000000000 R14: ffff88805876f934 R15: 0000000000000000 FS: 00007fb776e37700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb776e16718 CR3: 000000009e5cc000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: visual_init+0x332/0x5e0 drivers/tty/vt/vt.c:746 vc_allocate+0x2c5/0x640 drivers/tty/vt/vt.c:802 con_install+0x4d/0x450 drivers/tty/vt/vt.c:2899 tty_driver_install_tty drivers/tty/tty_io.c:1225 [inline] tty_init_dev.part.0+0x99/0x400 drivers/tty/tty_io.c:1338 tty_init_dev drivers/tty/tty_io.c:1328 [inline] tty_open_by_driver drivers/tty/tty_io.c:1973 [inline] tty_open+0x669/0x8b0 drivers/tty/tty_io.c:2021 chrdev_open+0x23c/0x6d0 fs/char_dev.c:423 do_dentry_open+0x44b/0xec0 fs/open.c:777 vfs_open+0x105/0x220 fs/open.c:888 do_last fs/namei.c:3428 [inline] path_openat+0x628/0x2970 fs/namei.c:3569 do_filp_open+0x179/0x3c0 fs/namei.c:3603 do_sys_open+0x296/0x410 fs/open.c:1081 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4196e4 RSP: 002b:00007fb776e36cc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004196e4 RDX: 0000000000000002 RSI: 00007fb776e36d60 RDI: 00000000ffffff9c RBP: 00007fb776e36d60 R08: 0000000000000000 R09: 000000000000000e R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 R13: 00007ffd6feb940f R14: 00007fb776e37300 R15: 0000000000022000 Code: 54 24 30 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 8d 0d 00 00 31 d2 44 89 f8 48 8b 74 24 38 b5 b0 03 00 00 48 89 f2 48 c1 ea 03 89 44 24 30 48 b8 00 00 RIP: fbcon_init+0xcb4/0x1cc0 drivers/video/fbdev/core/fbcon.c:1065 RSP: ffff88805f1377e0 ---[ end trace df97a30af5176af3 ]---