====================================================== WARNING: possible circular locking dependency detected 4.14.0+ #182 Not tainted ------------------------------------------------------ syz-executor3/9153 is trying to acquire lock: (console_lock){+.+.}, at: [] vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&pipe->mutex/1){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 pipe_lock_nested fs/pipe.c:67 [inline] pipe_lock+0x56/0x70 fs/pipe.c:75 iter_file_splice_write+0x264/0xf30 fs/splice.c:699 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x7d5/0x1630 fs/splice.c:1382 entry_SYSCALL_64_fastpath+0x1f/0x96 -> #2 (sb_writers){.+.+}: spin_lock include/linux/spinlock.h:315 [inline] lockref_get_not_dead+0x19/0x80 lib/lockref.c:180 -> #1 ((completion)&req.done){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 complete_acquire include/linux/completion.h:40 [inline] __wait_for_common kernel/sched/completion.c:109 [inline] wait_for_common kernel/sched/completion.c:123 [inline] wait_for_completion+0xcb/0x7b0 kernel/sched/completion.c:144 devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:115 device_add+0x120f/0x1640 drivers/base/core.c:1824 device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430 device_create_vargs drivers/base/core.c:2470 [inline] device_create+0xda/0x110 drivers/base/core.c:2506 vcs_make_sysfs+0x35/0x60 drivers/tty/vt/vc_screen.c:629 vc_allocate+0x4b7/0x6b0 drivers/tty/vt/vt.c:797 con_install+0x52/0x440 drivers/tty/vt/vt.c:2876 tty_driver_install_tty drivers/tty/tty_io.c:1215 [inline] tty_init_dev+0xf6/0x4a0 drivers/tty/tty_io.c:1315 tty_open_by_driver drivers/tty/tty_io.c:1942 [inline] tty_open+0x608/0xab0 drivers/tty/tty_io.c:1990 chrdev_open+0x257/0x730 fs/char_dev.c:417 do_dentry_open+0x682/0xd70 fs/open.c:752 vfs_open+0x107/0x230 fs/open.c:866 do_last fs/namei.c:3388 [inline] path_openat+0x1157/0x3530 fs/namei.c:3528 do_filp_open+0x25b/0x3b0 fs/namei.c:3563 do_sys_open+0x502/0x6d0 fs/open.c:1059 SYSC_open fs/open.c:1077 [inline] SyS_open+0x2d/0x40 fs/open.c:1072 entry_SYSCALL_64_fastpath+0x1f/0x96 -> #0 (console_lock){+.+.}: check_prevs_add kernel/locking/lockdep.c:2031 [inline] validate_chain kernel/locking/lockdep.c:2473 [inline] __lock_acquire+0x33ad/0x4840 kernel/locking/lockdep.c:3500 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 console_lock+0x4b/0x80 kernel/printk/printk.c:2047 vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219 do_loop_readv_writev fs/read_write.c:694 [inline] do_iter_read+0x3db/0x5b0 fs/read_write.c:918 vfs_readv+0x121/0x1c0 fs/read_write.c:980 kernel_readv fs/splice.c:361 [inline] default_file_splice_read+0x508/0xae0 fs/splice.c:416 do_splice_to+0x110/0x170 fs/splice.c:880 do_splice fs/splice.c:1173 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x11a8/0x1630 fs/splice.c:1382 entry_SYSCALL_64_fastpath+0x1f/0x96 other info that might help us debug this: Chain exists of: console_lock --> sb_writers --> &pipe->mutex/1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(sb_writers); lock(&pipe->mutex/1); lock(console_lock); *** DEADLOCK *** 1 lock held by syz-executor3/9153: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 fs/pipe.c:75 stack backtrace: CPU: 0 PID: 9153 Comm: syz-executor3 Not tainted 4.14.0+ #182 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_circular_bug+0x42d/0x610 kernel/locking/lockdep.c:1271 check_prev_add+0x8b1/0x1580 kernel/locking/lockdep.c:1914 check_prevs_add kernel/locking/lockdep.c:2031 [inline] validate_chain kernel/locking/lockdep.c:2473 [inline] __lock_acquire+0x33ad/0x4840 kernel/locking/lockdep.c:3500 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 console_lock+0x4b/0x80 kernel/printk/printk.c:2047 vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219 do_loop_readv_writev fs/read_write.c:694 [inline] do_iter_read+0x3db/0x5b0 fs/read_write.c:918 vfs_readv+0x121/0x1c0 fs/read_write.c:980 kernel_readv fs/splice.c:361 [inline] default_file_splice_read+0x508/0xae0 fs/splice.c:416 do_splice_to+0x110/0x170 fs/splice.c:880 do_splice fs/splice.c:1173 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x11a8/0x1630 fs/splice.c:1382 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x452879 RSP: 002b:00007f27f22e5be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452879 RDX: 0000000000000017 RSI: 0000000000000000 RDI: 0000000000000013 RBP: 0000000000000086 R08: 0000000000000003 R09: 0000000000000008 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f4d68 R13: 00000000ffffffff R14: 00007f27f22e66d4 R15: 0000000000000000 QAT: Invalid ioctl QAT: Invalid ioctl SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pig=9368 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pig=9368 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pig=9412 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pig=9412 comm=syz-executor7 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl nla_parse: 10 callbacks suppressed netlink: 7 bytes leftover after parsing attributes in process `syz-executor3'. PF_BRIDGE: br_mdb_parse() with unknown ifindex netlink: 7 bytes leftover after parsing attributes in process `syz-executor3'. PF_BRIDGE: br_mdb_parse() with unknown ifindex SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=9582 comm=syz-executor4 device lo entered promiscuous mode device lo left promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=9582 comm=syz-executor4 device lo entered promiscuous mode device lo left promiscuous mode kauditd_printk_skb: 102 callbacks suppressed audit: type=1326 audit(1510952824.943:5675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 dccp_invalid_packet: pskb_may_pull failed dccp_invalid_packet: pskb_may_pull failed device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode audit: type=1326 audit(1510952824.970:5676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1510952824.971:5677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=2 compat=0 ip=0x40cbb1 code=0x7ffc0000 audit: type=1326 audit(1510952824.971:5678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1510952824.971:5679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 device lo entered promiscuous mode device lo left promiscuous mode audit: type=1326 audit(1510952824.981:5680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=54 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1510952824.981:5681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 device lo entered promiscuous mode device lo left promiscuous mode audit: type=1326 audit(1510952824.981:5682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1510952824.981:5683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=293 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1510952824.982:5684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9623 comm="syz-executor7" exe="/root/syz-executor7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device syz7 entered promiscuous mode device syz7 left promiscuous mode device syz7 entered promiscuous mode device syz7 left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo left promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. device lo entered promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode